Does Authelia replace each app's own login?

It depends on the app. For apps without authentication (internal dashboards, admin UIs), Authelia adds a login wall at the proxy layer. For OIDC-compatible apps like Gitea or Nextcloud, Authelia can become the identity provider and replace the app's own login entirely, giving you true SSO.

How much RAM does Authelia need?

Very little. Authelia itself idles under 30 MB RAM. Add ~20 MB for the Redis session store. A 512 MB VPS is sufficient for personal use; 1 GB is comfortable for a team of 10-20 users.

Is Authelia compatible with passkeys and hardware security keys?

Yes. Authelia v4.38+ supports WebAuthn (FIDO2), which covers passkeys, Touch ID, Face ID, YubiKeys and any FIDO2-compliant hardware key. Users can register multiple second-factor methods and choose at login time.

Client Area

Cybersecurity & Bastion

Authelia

Name: Authelia
Availability: InStock

Add MFA, SSO and fine-grained access control in front of any app — no code changes required.

Official documentation Source code

root@mon-serveur — ssh

# when the VPS is created
✓ Authelia installedroot@mon-serveur:~#

About Authelia

Authelia is an open-source authentication and authorization server that acts as a reverse-proxy companion. It intercepts every request to your apps and enforces your policy: one-factor login, two-factor (TOTP, WebAuthn/Passkeys), or bypass — based on domain, path, user group or network. Authelia itself handles the login portal; your app never needs to know it exists.

Deployed on a ServOrbit VPS, Authelia runs as a lightweight Go binary (~25 MB RAM) alongside a Redis session store. It integrates with Nginx, Caddy, Traefik and HAProxy as a forward-auth endpoint, and doubles as a full OpenID Connect (OIDC) provider, letting you add Single Sign-On across your entire self-hosted stack from a single configuration file. Apache 2.0 licensed, ~28 k GitHub stars.

What gets installed

Ready when the VPS starts

Compatible OS: Ubuntu 24.04
Application: Authelia
Tech stack: DockerGoSQLiteRedis 7
Minimum RAM: 512 MB (1 GB recommended)
Minimum CPU: 1 vCPU
Default port: 9091
Access: root over SSH

Key features

MFA out of the box: TOTP, WebAuthn/Passkeys and Duo push — one config line per user or group
OpenID Connect (OIDC) certified provider: add SSO to any OIDC-compatible app in your stack
Fine-grained access control: allow, deny or require 2FA by domain, subdomain, path, IP network or user group
Reverse-proxy agnostic: native forward-auth support for Nginx, Caddy, Traefik, HAProxy and Envoy
Under 30 MB RAM at idle — runs comfortably alongside other services on a 1 GB VPS
File-based or LDAP user backend — start with a local users file, migrate to LDAP later without downtime

When to use this solution?

Protect internal tools

Put Authelia in front of Grafana, Dockge, Gitea or any admin UI. Users authenticate once at your auth portal and are forwarded to any protected app without re-entering credentials.

Add MFA to apps that don't support it

Many self-hosted apps have basic password auth or none at all. Authelia adds TOTP or passkey authentication at the proxy layer — zero changes to the app, zero code to write.

Self-hosted SSO across your stack

Configure Authelia as an OIDC provider and connect Nextcloud, Gitea, Mattermost and more. One login session, all your apps — on infrastructure you own.

Guide

Deploy Authelia on your VPS

Create the VPS
Order a ServOrbit VPS with at least 1 vCPU and 512 MB RAM (1 GB recommended). Ubuntu 24.04 LTS is the recommended OS. A domain name pointing to this VPS is required — Authelia's session cookies and OIDC callbacks require HTTPS with a valid FQDN.
Choose the access address
The installer asks for it before it starts, from two targets — a subdomain of one of your own domains, for example auth.yourdomain.com, or the free subdomain that comes with your VPS (authelia.<your-vps>.servorbit-dns.com), so buying a domain name is not a prerequisite. ServOrbit creates the DNS record when the domain uses our managed DNS — otherwise the client area tells you the exact record to create — and SSL is handled automatically by the ServOrbit reverse proxy using Let's Encrypt.
Deploy Authelia
Select the Authelia template in the ServOrbit Marketplace. The provisioning job deploys the Compose stack (Authelia + Redis), generates all secrets, writes the initial configuration and creates the admin user. The portal is accessible at https://auth.yourdomain.com within minutes.
Configure your reverse proxy
Add a forward_auth directive to the Nginx, Caddy or Traefik configuration of each app you want to protect. Authelia's documentation has copy-paste snippets for every major proxy. ServOrbit VPS instances ship with Caddy by default.
Add users and enable MFA
Log in to the Authelia portal with the default admin credentials, register your TOTP app (Google Authenticator, Ente Auth, Aegis…) or a passkey, then create additional users. Update access control rules in configuration.yml to enforce 2FA for sensitive apps and one-factor for others.

Frequently asked questions

Questions about Authelia

← Back to Cybersecurity & Bastion All applications

Authelia is an open-source (Apache 2.0) authentication and authorization gateway. It sits in front of your apps as a forward-auth endpoint, enforcing MFA and fine-grained access control without any changes to the apps themselves.

Yes, and the installer asks for that address before it starts. Session cookies require a proper domain (Domain=.yourdomain.com), and OIDC callbacks and Let's Encrypt certificates require a publicly resolvable FQDN with HTTPS: Authelia cannot work correctly behind a plain IP address. You choose the address at install time, from two targets — a subdomain of one of your own domains, or the free subdomain that comes with your VPS (authelia.<your-vps>.servorbit-dns.com): buying a domain name is not a prerequisite. Either way ServOrbit installs the nginx reverse proxy and the TLS certificate, and the portal answers at https://<your-address>.

Authelia has first-class support for Nginx, Caddy, Traefik, HAProxy, Envoy and Skipper via its forward_auth / ext_authz endpoint. The documentation provides copy-paste configuration snippets for each proxy.

Embed the deploy button

Maintaining a project that uses Authelia? This button lets your readers deploy it on a VPS in one click, without reading Docker documentation.

Markdown

[![Deploy Authelia on ServOrbit](https://servorbit.com/brand/deploy/button.svg)](https://servorbit.com/vps-cloud?template=authelia&utm_source=deploy-badge&utm_medium=referral&utm_campaign=authelia)

HTML

<a href="https://servorbit.com/vps-cloud?template=authelia&utm_source=deploy-badge&utm_medium=referral&utm_campaign=authelia"><img src="https://servorbit.com/brand/deploy/button.svg" alt="Deploy Authelia on ServOrbit" height="40"></a>

The button points to a VPS order with the template preselected. The image is served from servorbit.com — nothing to host on your side.

Complementary solutions

Cybersecurity & Bastion

Need help?

Browse our help center and FAQ, or reach our team — callback, WhatsApp or email.

Message us on WhatsApp

or write to us

Authelia

About Authelia

Ready when the VPS starts

Key features

When to use this solution?

Protect internal tools

Add MFA to apps that don't support it

Self-hosted SSO across your stack

Deploy Authelia on your VPS

Create the VPS

Choose the access address

Deploy Authelia

Configure your reverse proxy

Add users and enable MFA

Questions about Authelia

Embed the deploy button

Complementary solutions

Vaultwarden

WireGuard Server

Caddy

Need help?