29,092 stars · Apache-2.0 · v4.39.28 (2026-09-17) · Track this in Scout
A single sign-in page with a second factor, placed in front of every private web service behind a reverse proxy.
▶Repo detailsthe review · specs · pros & cons · install
What it is
Authelia is a small program that sits beside a reverse proxy (the piece of software that receives web requests and passes them on to the right service). The proxy asks Authelia about every request, and Authelia either lets it through or shows a login page first.
What it is good for. Anyone running several private web services on one machine — a photo library, a wiki, a monitoring page — who has been protecting them with one shared password, or with nothing at all. It replaces that with one login, one password policy and a second factor. It is also the cheapest way to add two-factor sign-in to software that has no such feature of its own.
- One account list, one login page, one set of rules for everything behind the proxy. Adding a new service means adding four lines to a rules file.
- Second-factor sign-in of several kinds: a code from a phone app, a hardware key, or a push notification.
- It is written in Go and ships as a single program in a container (a container is a way to run a program inside its own sealed box, so it cannot disturb anything else on the machine). It uses very little memory.
- It does not work on its own. It needs a reverse proxy — nginx, Traefik, Caddy or HAProxy — already installed and understood. If that sentence was unfamiliar, this is not a twenty-minute job.
- Everything is configured by editing a YAML file. There is no setup screen, and a mistake in that file locks everybody out, including the person who made it.
- It protects things that sit behind the proxy. Anything reachable another way, such as an SSH login or a database port, is untouched by it.
- goauthentik/authentik
25,733 stars, the same job with a full web interface for managing users and applications; much more to learn and noticeably heavier to run.
Track this in Scout - keycloak/keycloak
36,930 stars, the long-established enterprise answer backed by Red Hat; far more capable and far more machine to feed.
Track this in Scout - oauth2-proxy/oauth2-proxy
14,909 stars, does only the proxy half and hands the actual sign-in to Google, GitHub or another provider; simpler, but it keeps no accounts of its own.
Track this in Scout
mkdir authelia && cd authelia # write docker-compose.yml and config/configuration.yml first — see the guide docker compose up -d
