[{"data":1,"prerenderedAt":141},["ShallowReactive",2],{"seo-verification":3,"blog-self-host-authelia-on-a-vps-mfa-and-sso-for-your-whole-stack-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"slugs":9,"title":12,"excerpt":13,"readTime":14,"views":15,"isPinned":16,"publishedAt":17,"category":18,"categories":24,"featuredImage":26,"bgImage":27,"posterImage":28,"relatedSolution":29,"intro":31,"sections":32,"ctaTitle":82,"ctaBody":83,"ctaButton":84,"ctaUrl":85,"relatedPosts":86},162,"self-host-authelia-on-a-vps-mfa-and-sso-for-your-whole-stack",{"fr":10,"en":8,"ar":11},"self-host-authelia-vps","استضافة-authelia-على-vps-مصادقة-ثنائية-ودخول-موحد-لمنظومتك","Self-Host Authelia on a VPS: MFA and SSO for Your Whole Stack","Deploy Authelia on your VPS to add MFA, SSO and fine-grained access control in front of any self-hosted app — no code changes, one configuration file.",5,2,false,"2026-07-04T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[25],{"id":19,"name":20,"slug":21,"color":22,"icon":23},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fself-host-authelia-vps-poster.svg",{"categorySlug":23,"appSlug":30},"authelia","Most self-hosted apps have basic password auth at best — and plenty have none at all. Authelia (Apache 2.0, ~28k stars) is an open-source authentication and authorization gateway that sits in front of your apps as a reverse-proxy companion. It enforces MFA and access policy at the proxy layer, doubles as a full OIDC provider for SSO across your stack, and idles under 30 MB RAM. Here is how to deploy it on a ServOrbit VPS in under 15 minutes.",[33,37,47,50,75,79],{"type":34,"title":35,"body":36},"h2","Why a reverse-proxy auth gateway","Every self-hosted tool you add to your VPS is a new attack surface. Some have solid auth (Gitea, Nextcloud), others are designed for trusted networks (Prometheus, Dockge, internal dashboards) and ship with no authentication at all. Adding a username+password check to each app individually takes time, creates inconsistency, and still leaves you managing dozens of separate credential stores.\n\nAuthelia solves this at the infrastructure level. You configure it once — rules like 'anyone accessing `*.internal.yourdomain.com` must complete two-factor authentication' — and your reverse proxy enforces those rules on every request before they reach the app. The apps themselves need no changes.",{"type":38,"title":39,"items":40},"ul","What self-hosted Authelia gives you",[41,42,43,44,45,46],"MFA for any app: TOTP (Google Authenticator, Ente Auth, Aegis), WebAuthn\u002FPasskeys (Touch ID, Face ID, YubiKey) and Duo push — configured once, enforced everywhere.","OpenID Connect (OIDC) provider: configure Authelia as the identity provider for Gitea, Nextcloud, Mattermost and any OIDC-compatible app. One login, all your apps.","Fine-grained access control: define policies per domain, subdomain, URL path, IP network or user group — allow, deny, one-factor, or two-factor.","Reverse-proxy agnostic: copy-paste integration with Nginx, Caddy, Traefik, HAProxy and Envoy via a single `forward_auth` directive.","Under 30 MB RAM at idle — add it to any existing VPS without impacting running workloads.","File-based or LDAP user backend — start simple, scale later.",{"type":34,"title":48,"body":49},"Requirements","A VPS with at least 1 vCPU and 512 MB RAM (1 GB recommended) running Ubuntu 22.04 or Debian 12, with Docker and Docker Compose v2 installed. A domain name pointing to the VPS is **required** — Authelia's session cookies and OIDC callbacks must be scoped to a proper FQDN, and HTTPS via Let's Encrypt is mandatory. If your VPS already runs Caddy or Nginx as a reverse proxy, Authelia slots in alongside it.",{"type":51,"title":52,"steps":53},"steps","Deploy Authelia with Docker Compose",[54,57,60,63,66,69,72],{"title":55,"body":56},"Write the Compose file","Create `\u002Fopt\u002Fauthelia\u002Fcompose.yaml`. The stack is two services: `authelia\u002Fauthelia:4.39.20` and `redis:7-alpine`. Authelia stores session data in Redis and application state (SQLite database, notification log) in a named Docker volume mounted at `\u002Fdata`. Two bind mounts from `.\u002F` provide the configuration file and the users database — these are generated by ServOrbit's provisioning job.",{"title":58,"body":59},"Create configuration.yml","Authelia reads its configuration from `\u002Fconfig\u002Fconfiguration.yml` (bind-mounted from the host). The minimum configuration sets the server address (`tcp:\u002F\u002F:9091`), the file authentication backend (`\u002Fconfig\u002Fusers.yml`), the session domain and secret, the SQLite storage path, the Redis session host, and the access control rules. Start with `default_policy: deny` and add `one_factor` rules for your domains.",{"title":61,"body":62},"Create the users database","Authelia's file backend reads from a YAML file of usernames, bcrypt-hashed passwords, emails and groups. Generate a hash for your admin password with: `docker run --rm authelia\u002Fauthelia:4.39.20 authelia crypto hash generate bcrypt`. Paste the output into `users.yml`. On ServOrbit, the provisioning job writes this file automatically with a generated password displayed in the job output.",{"title":64,"body":65},"Start the stack and verify","Run `docker compose up -d` in `\u002Fopt\u002Fauthelia`. Check that both containers are healthy with `docker compose ps`. Authelia exposes a health endpoint at `GET \u002Fapi\u002Fhealth` — `curl -s http:\u002F\u002Flocalhost:9091\u002Fapi\u002Fhealth` should return `{\"status\":\"OK\"}`. The login portal is then available at `https:\u002F\u002Fauth.yourdomain.com` once your reverse proxy is configured.",{"title":67,"body":68},"Add the forward_auth directive to your proxy","For Caddy, add `forward_auth authelia:9091` to the site blocks you want to protect, referencing the Authelia container's service name if both are on the same Docker network. For Nginx, add `auth_request \u002Fauthelia;` and the corresponding location block. Authelia's documentation has exact copy-paste snippets for every major proxy. Reload your proxy config — every protected app now requires a login through Authelia.",{"title":70,"body":71},"Register your MFA device","Log in to the Authelia portal at `https:\u002F\u002Fauth.yourdomain.com` with your admin credentials. You will be prompted to register a second factor. Open your TOTP app (Google Authenticator, Ente Auth or Aegis), scan the QR code, and confirm. For passkeys (WebAuthn), click 'Security Key or Passkey' and follow your browser's prompt — Face ID, Touch ID and YubiKeys all work. Future logins require your password plus the registered factor.",{"title":73,"body":74},"Logging in for the first time","Open your portal's address: Authelia asks for a username and a password. Enter admin and the password you were given (available in the Applications section of your client area), then register your authentication app (TOTP) or your passkey immediately — that second factor is what will protect everything you later place behind this portal.",{"type":76,"title":77,"body":78},"tip","Use Authelia as an OIDC provider for true SSO","Once Authelia is running, you can register your other self-hosted apps as OIDC clients. In `configuration.yml`, add an `identity_providers.oidc` block listing each app's client ID, secret and redirect URIs. Then configure the app (Gitea, Nextcloud, Grafana…) to use Authelia as its OIDC provider. Users authenticate once at `auth.yourdomain.com` and are silently forwarded to every OIDC-connected app — no separate login prompts, one session for your entire stack.",{"type":34,"title":80,"body":81},"Access control rules","Authelia's access control section is where you define who can reach what. Rules are evaluated top-to-bottom; the first match wins. A minimal production config might bypass your public-facing apps, require one-factor for general internal tools, and enforce two-factor for anything sensitive (admin panels, secrets managers, databases). Use the `groups` field in `users.yml` to distinguish admins from regular users and apply stricter policies to admin-group members.","Deploy Authelia on your VPS in one click","Add MFA and SSO to your entire self-hosted stack without changing a single app. ServOrbit provisions a ready-to-use Authelia instance — configuration generated, admin user created, reverse proxy integration ready.","Deploy Authelia","\u002Fvps-cloud?template=authelia",[87,103,120],{"id":88,"slug":89,"slugs":90,"title":93,"excerpt":94,"readTime":14,"views":95,"isPinned":16,"publishedAt":96,"category":97,"categories":98,"featuredImage":26,"bgImage":27,"posterImage":100,"relatedSolution":101},131,"self-host-your-password-manager-deploy-vaultwarden-on-vps",{"fr":91,"en":89,"ar":92},"deploy-vaultwarden-vps","استضف-مدير-كلمات-المرور-بنفسك-انشر-vaultwarden-على-vps","Self-Host Your Password Manager: Deploy Vaultwarden on VPS","Self-host Vaultwarden on a VPS to get unlimited Bitwarden-compatible password management, team vaults and TOTP at a fixed monthly cost — under 50 MB RAM.",0,"2026-06-24T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[99],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fdeploy-vaultwarden-vps-poster.svg",{"categorySlug":23,"appSlug":102},"vaultwarden",{"id":104,"slug":105,"slugs":106,"title":109,"excerpt":110,"readTime":111,"views":95,"isPinned":16,"publishedAt":112,"category":113,"categories":114,"featuredImage":26,"bgImage":27,"posterImage":116,"relatedSolution":117},108,"securing-your-vps-with-crowdsec",{"fr":107,"en":105,"ar":108},"securiser-vps-crowdsec","تأمين-خادمك-الافتراضي-vps-باستخدام-crowdsec","Securing your VPS with CrowdSec","Deploy CrowdSec on your VPS to block attacks thanks to behavioral detection and a shared community blocklist.",4,"2026-03-04T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[115],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fsecuriser-vps-crowdsec-poster.svg",{"categorySlug":118,"appSlug":119},"cybersecurity-bastion","crowdsec",{"id":121,"slug":122,"slugs":123,"title":126,"excerpt":127,"readTime":111,"views":95,"isPinned":16,"publishedAt":128,"category":129,"categories":135,"featuredImage":26,"bgImage":27,"posterImage":137,"relatedSolution":138},161,"how-to-self-host-dockge-on-a-vps-visual-docker-compose-manager",{"fr":124,"en":122,"ar":125},"self-host-dockge-vps","استضافة-dockge-على-vps-مدير-مرئي-لـ-docker-compose","How to Self-Host Dockge on a VPS: Visual Docker Compose Manager","Deploy Dockge on your VPS: a lightweight open-source visual manager to create, edit and monitor your Docker Compose stacks from a clean web UI, no command line.","2026-07-03T00:00:00+00:00",{"id":130,"name":131,"slug":132,"color":133,"icon":134},7,"Self-hosting","self-hosting","bg-indigo-500\u002F10 text-indigo-400","cloud",[136],{"id":130,"name":131,"slug":132,"color":133,"icon":134},"\u002Fblog\u002Fcovers\u002Fself-host-dockge-vps-poster.svg",{"categorySlug":139,"appSlug":140},"application-deployment-devops","dockge",1787581011862]