[{"data":1,"prerenderedAt":122},["ShallowReactive",2],{"seo-verification":3,"marketplace-app-en-authelia":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"marketplace-app-en-authelia",{"slug":9,"slugs":10,"categorySlugs":11,"name":16,"description":17,"phase":18,"unavailableReason":19,"docsUrl":20,"logo":21,"github":22,"tagline":23,"longDescription":24,"features":25,"useCases":32,"steps":42,"faq":58,"specs":77,"compatibleOs":86,"relatedApps":88,"relatedPosts":115,"category":119},"authelia",{"fr":9,"en":9,"ar":9,"es":9},{"fr":12,"en":13,"ar":14,"es":15},"cybersecurity","cybersecurity-bastion","الأمن-السيبراني-والحصن","ciberseguridad-bastion","Authelia","Open-source authentication and authorization gateway — add MFA, SSO and fine-grained access control in front of any app without touching its code.",1,null,"https:\u002F\u002Fservorbit.com\u002Fblog\u002Fself-host-authelia-on-a-vps-mfa-and-sso-for-your-whole-stack","https:\u002F\u002Fcdn.simpleicons.org\u002Fauthelia","https:\u002F\u002Fgithub.com\u002Fauthelia\u002Fauthelia","Add MFA, SSO and fine-grained access control in front of any app — no code changes required.","Authelia is an open-source authentication and authorization server that acts as a reverse-proxy companion. It intercepts every request to your apps and enforces your policy: one-factor login, two-factor (TOTP, WebAuthn\u002FPasskeys), or bypass — based on domain, path, user group or network. Authelia itself handles the login portal; your app never needs to know it exists.\n\nDeployed on a ServOrbit VPS, Authelia runs as a lightweight Go binary (~25 MB RAM) alongside a Redis session store. It integrates with Nginx, Caddy, Traefik and HAProxy as a forward-auth endpoint, and doubles as a full OpenID Connect (OIDC) provider, letting you add Single Sign-On across your entire self-hosted stack from a single configuration file. Apache 2.0 licensed, ~28 k GitHub stars.",[26,27,28,29,30,31],"MFA out of the box: TOTP, WebAuthn\u002FPasskeys and Duo push — one config line per user or group","OpenID Connect (OIDC) certified provider: add SSO to any OIDC-compatible app in your stack","Fine-grained access control: allow, deny or require 2FA by domain, subdomain, path, IP network or user group","Reverse-proxy agnostic: native forward-auth support for Nginx, Caddy, Traefik, HAProxy and Envoy","Under 30 MB RAM at idle — runs comfortably alongside other services on a 1 GB VPS","File-based or LDAP user backend — start with a local users file, migrate to LDAP later without downtime",[33,36,39],{"title":34,"body":35},"Protect internal tools","Put Authelia in front of Grafana, Dockge, Gitea or any admin UI. Users authenticate once at your auth portal and are forwarded to any protected app without re-entering credentials.",{"title":37,"body":38},"Add MFA to apps that don't support it","Many self-hosted apps have basic password auth or none at all. Authelia adds TOTP or passkey authentication at the proxy layer — zero changes to the app, zero code to write.",{"title":40,"body":41},"Self-hosted SSO across your stack","Configure Authelia as an OIDC provider and connect Nextcloud, Gitea, Mattermost and more. One login session, all your apps — on infrastructure you own.",[43,46,49,52,55],{"title":44,"body":45},"Create the VPS","Order a ServOrbit VPS with at least 1 vCPU and 512 MB RAM (1 GB recommended). Ubuntu 24.04 LTS is the recommended OS. A domain name pointing to this VPS is required — Authelia's session cookies and OIDC callbacks require HTTPS with a valid FQDN.",{"title":47,"body":48},"Choose the access address","The installer asks for it before it starts, from two targets — a subdomain of one of your own domains, for example `auth.yourdomain.com`, or the free subdomain that comes with your VPS (`authelia.\u003Cyour-vps>.servorbit-dns.com`), so buying a domain name is not a prerequisite. ServOrbit creates the DNS record when the domain uses our managed DNS — otherwise the client area tells you the exact record to create — and SSL is handled automatically by the ServOrbit reverse proxy using Let's Encrypt.",{"title":50,"body":51},"Deploy Authelia","Select the Authelia template in the ServOrbit Marketplace. The provisioning job deploys the Compose stack (Authelia + Redis), generates all secrets, writes the initial configuration and creates the admin user. The portal is accessible at `https:\u002F\u002Fauth.yourdomain.com` within minutes.",{"title":53,"body":54},"Configure your reverse proxy","Add a `forward_auth` directive to the Nginx, Caddy or Traefik configuration of each app you want to protect. Authelia's documentation has copy-paste snippets for every major proxy. ServOrbit VPS instances ship with Caddy by default.",{"title":56,"body":57},"Add users and enable MFA","Log in to the Authelia portal with the default admin credentials, register your TOTP app (Google Authenticator, Ente Auth, Aegis…) or a passkey, then create additional users. Update access control rules in `configuration.yml` to enforce 2FA for sensitive apps and one-factor for others.",[59,62,65,68,71,74],{"q":60,"a":61},"What is Authelia?","Authelia is an open-source (Apache 2.0) authentication and authorization gateway. It sits in front of your apps as a forward-auth endpoint, enforcing MFA and fine-grained access control without any changes to the apps themselves.",{"q":63,"a":64},"Does Authelia replace each app's own login?","It depends on the app. For apps without authentication (internal dashboards, admin UIs), Authelia adds a login wall at the proxy layer. For OIDC-compatible apps like Gitea or Nextcloud, Authelia can become the identity provider and replace the app's own login entirely, giving you true SSO.",{"q":66,"a":67},"How much RAM does Authelia need?","Very little. Authelia itself idles under 30 MB RAM. Add ~20 MB for the Redis session store. A 512 MB VPS is sufficient for personal use; 1 GB is comfortable for a team of 10-20 users.",{"q":69,"a":70},"Does Authelia require a domain name?","Yes, and the installer asks for that address before it starts. Session cookies require a proper domain (`Domain=.yourdomain.com`), and OIDC callbacks and Let's Encrypt certificates require a publicly resolvable FQDN with HTTPS: Authelia cannot work correctly behind a plain IP address. You choose the address at install time, from two targets — a subdomain of one of your own domains, or the free subdomain that comes with your VPS (`authelia.\u003Cyour-vps>.servorbit-dns.com`): buying a domain name is not a prerequisite. Either way ServOrbit installs the nginx reverse proxy and the TLS certificate, and the portal answers at `https:\u002F\u002F\u003Cyour-address>`.",{"q":72,"a":73},"Which reverse proxies does Authelia support?","Authelia has first-class support for Nginx, Caddy, Traefik, HAProxy, Envoy and Skipper via its `forward_auth` \u002F `ext_authz` endpoint. The documentation provides copy-paste configuration snippets for each proxy.",{"q":75,"a":76},"Is Authelia compatible with passkeys and hardware security keys?","Yes. Authelia v4.38+ supports WebAuthn (FIDO2), which covers passkeys, Touch ID, Face ID, YubiKeys and any FIDO2-compliant hardware key. Users can register multiple second-factor methods and choose at login time.",{"ram":78,"cpu":79,"stack":80,"port":85},"512 MB (1 GB recommended)","1 vCPU",[81,82,83,84],"Docker","Go","SQLite","Redis 7","9091",[87],"ubuntu-24.04",[89,97,106],{"name":90,"slug":91,"categorySlug":13,"categoryName":92,"categoryColor":93,"logo":94,"tagline":95,"description":96},"Vaultwarden","vaultwarden","Cybersecurity & Bastion","text-red-400 bg-red-500\u002F10","https:\u002F\u002Fcdn.jsdelivr.net\u002Fgh\u002Fselfhst\u002Ficons\u002Fsvg\u002Fvaultwarden.svg","Self-hosted Bitwarden in one Rust container — unlimited passwords, zero subscription, your data stays on your VPS.","Self-hosted Bitwarden-compatible password manager written in Rust. All Bitwarden clients work out of the box — browser extensions, mobile apps, desktop — under 50 MB RAM.",{"name":98,"slug":99,"categorySlug":100,"categoryName":101,"categoryColor":102,"logo":103,"tagline":104,"description":105},"WireGuard Server","wireguard-server","networking-vpn","Networking & VPN","text-sky-400 bg-sky-500\u002F10","https:\u002F\u002Fcdn.simpleicons.org\u002Fwireguard","Modern VPN built into the Linux kernel — secure connections for your teams and infrastructure.","Modern, minimal VPN built into the Linux kernel. Secure connections for your teams and infrastructure.",{"name":107,"slug":108,"categorySlug":109,"categoryName":110,"categoryColor":111,"logo":112,"tagline":113,"description":114},"Caddy","caddy","application-deployment-devops","Application Deployment & DevOps","text-success bg-success\u002F10","https:\u002F\u002Fcdn.simpleicons.org\u002Fcaddy","Automatic SSL for your applications — effortless HTTPS, auto-renewed certificates.","A modern web server and reverse proxy with automatic HTTPS. Let's Encrypt SSL certificates are obtained and renewed on their own, with minimal configuration via a Caddyfile.",[116,117,118],"self-host-authelia-vps","deploy-vaultwarden-vps","securiser-vps-crowdsec",{"key":120,"slug":13,"name":92,"objective":121,"icon":120,"color":93},"security","Harden infrastructure security.",1790177629653]