Authelia

Last reviewed Aug 26, 2026 · 780 words

Authelia is a gate, not a directory. It stands next to your reverse proxy and answers one question per request, whether this browser session is allowed through to this hostname, and that narrow job is why it runs in 128 MB of RAM and why the hard part of setting it up is never Authelia itself but the wiring to the proxy. If what you actually want is a login server that other apps talk OIDC to, that is Authentik's job, and the difference decides everything below.

Forward auth: the proxy asks, Authelia answers

Every request to a protected site hits the proxy first. The proxy makes a sub-request to Authelia on port 9091 carrying the original host, path and cookies. Authelia replies 200 (let it through, here are the user's headers) or 401 (redirect to the login portal). Nothing ever reaches the app without that exchange, and the app itself needs no changes, which is the whole appeal for the dozens of self-hosted tools that have weak or absent authentication.

On Caddy the wiring is a single directive inside the protected site:

forward_auth authelia:9091 {
    uri /api/authz/forward-auth
    copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
}

Traefik does the same with a forwardAuth middleware pointing at the same path, and nginx uses auth_request. The copy_headers line is how apps like Grafana or Gitea can trust the identity Authelia established, so the user lands already logged in. Which proxy to build this on is a separate decision; the reverse proxy showdown covers that.

The access rules are the actual product

Authelia's configuration has one section that earns its keep: access_control. Each rule matches a domain, optionally a path, a subject (user or group) and a network, and assigns one of three policies: bypass, one_factor, or two_factor.

access_control:
  default_policy: deny
  rules:
    - domain: "*.example.com"
      networks: [192.168.1.0/24]
      policy: one_factor
    - domain: grafana.example.com
      subject: "group:admins"
      policy: two_factor
    - domain: photos.example.com
      resources: ["^/api/.*$"]
      policy: bypass

That last rule is the one everybody needs eventually: mobile apps that talk to an API with their own tokens cannot pass through a browser login, so you bypass their paths while keeping the web UI protected. Getting this list right is 80 percent of a working Authelia install. The default policy of deny is correct; start from nothing allowed and add rules.

The file backend is fine for a household

User storage has two options. The file backend is a YAML list of users with argon2id password hashes, generated with authelia crypto hash generate argon2, and for 1 to 10 people it is simpler and more reliable than anything else. Past that, or the moment you want the same accounts in Nextcloud and Gitea, point Authelia at LDAP; lldap is the lightweight directory built for exactly this pairing. Second factors are TOTP, WebAuthn security keys and passkeys, and Duo push, all configured per user through the portal, and TOTP enrolment needs working outbound SMTP or the notifier's file mode for the verification links.

One secret you can never change

Authelia needs a handful of secrets: a JWT secret for reset links, a session secret, and storage.encryption_key. The last one encrypts TOTP seeds and WebAuthn data inside the storage database. Rotate it casually and every user's second factor becomes unreadable; the process to change it exists but is deliberate. Generate it once, store it with your backups, never regenerate it in a "let me tidy the compose file" moment. SQLite storage and in-memory sessions are perfectly adequate for a single instance; Redis and Postgres only matter when you run more than one Authelia.

Authelia or Authentik

Authentik is a full identity provider: OIDC, SAML, LDAP outpost, user self-service, a web admin UI, and roughly 10 times the memory. Authelia does forward-auth better and lighter, has narrower OIDC provider support, and is configured entirely in YAML with no admin GUI. The Authelia vs Authentik comparison goes deeper, but the rule is short: a handful of apps behind a proxy, take Authelia; a real SSO for apps that want to be OIDC clients, take Authentik.

What I'd do

Authelia beside Caddy, file backend with argon2id hashes, default_policy: deny, one_factor for LAN networks and two_factor for anything internet-facing, bypass rules for the mobile API paths I actually use. Secrets in a file that is part of the backup set, encryption_key treated as permanent. It runs for months on 50 MB of RAM and I forget it exists, which is the best compliment an auth layer gets.