Authelia
A light login portal with two-factor auth in front of your reverse proxy
Authelia adds a login page and two-factor authentication in front of web apps through your reverse proxy, and can also act as an OpenID Connect provider. It is Apache-2.0 licensed, written in Go, and uses very little memory.
Best for when
- you run a reverse proxy and want two-factor login in front of apps
- you want an authentication layer that uses almost no resources
- you are comfortable managing configuration in files
Watch out for
- there is no admin web interface, users and rules are managed in files or LDAP
- it depends on a reverse proxy with forward authentication support
- misconfigured access rules can quietly expose an app or lock you out
A gate in front of your apps
Authelia works with reverse proxies that support forward authentication. Each request is checked first, and anyone without a session is sent to the Authelia portal to sign in with a password and a second factor such as TOTP or a WebAuthn key. Access rules decide which users can reach which domains.
It suits people who already run a reverse proxy and want a simple, solid login layer for dashboards and tools. It can also serve OpenID Connect to apps that support it, which covers a good part of single sign-on needs.
What running it costs
It is a single Go binary using tens of megabytes of RAM. Users live in a YAML file or an LDAP directory, and settings are a configuration file rather than a web interface. For more than one instance you add Redis for sessions and a SQL database for storage.
Back up the configuration, the users file and the storage database. Because it guards other apps, a mistake in its rules can lock you out or let too much through, so test access rules carefully after every change.
