Put a single login and a second factor in front of every self-hosted app: your reverse proxy asks Authelia whether each request is allowed. Rules match by domain, user, group or network, and the portal handles passwords, WebAuthn keys and TOTP.
The key facts for Authelia.
| Requirement | Authelia |
|---|---|
| Price | Free |
| Web UI | Yes |
| Architecture | x86 + ARM |
| Containers | 1The app alone |
| Database | SQLite |
| Runtime | Go |
| Docker | Yes |
| Linux package | Yes |
Yes. Authelia is not meant to be exposed directly. It answers forward-auth checks from Traefik, nginx, Caddy, HAProxy, Envoy or SWAG, or acts as an OpenID Connect provider for apps that support it, and it has to be served over HTTPS.
User credentials come from a YAML file or an LDAP server. Sessions, second-factor registrations and identity data go in SQLite by default, or PostgreSQL for production, and Redis is recommended for sessions once more than one instance runs.
Yes. It accepts WebAuthn security keys and passkeys, time-based one-time passwords from an authenticator app and Duo push. You can ask for one or two factors per rule.
More apps in Security.
See all self-hosted apps →Updated
