Comparisons

authentik when you need a real identity provider — OIDC, SAML, and LDAP for the apps that speak them, a built-in user directory, and a web admin UI more than one person can operate. Pick Authelia when all you want is SSO and MFA in front of a handful of self-hosted apps behind your reverse proxy: one Go binary, 256 MB, and access rules you keep in git.

authentik if you want a modern, self-hoster-friendly IdP with a visual flow builder and broad protocol support without a JVM to babysit. Pick Keycloak if you need the deepest SAML/LDAP standards coverage and enterprise-proven maturity, and you can feed it a JVM.

authentik if you need a real identity provider — passwords, MFA, SAML, LDAP, and a directory apps can federate with. Pick Pocket ID if all you want is passkey-only sign-in for a handful of self-hosted apps and nothing else, in a container a fraction of the size.

authentik if you need a real identity provider with a user directory, SAML/LDAP, and enrollment flows for apps that federate with it. Pick Tinyauth if all you want is the smallest possible login screen in front of a reverse proxy — one Go container, no directory to manage, and AGPL is not a concern for you.

authentik if you want a full-featured self-hosted identity provider — SAML, LDAP, SCIM, and a proxy provider for apps that speak no protocol at all. Pick Zitadel if you're building your own product and want API-first, multi-tenant identity with passwordless as the default, and you're comfortable with AGPL.

Coolify wins for most self-hosters: it's the more mature project, with a far larger community and a simpler single-node default. Dokploy is the pick when you genuinely need multi-server Docker Swarm orchestration.

ntfy if you want to fire notifications straight from scripts and cron with a one-line curl and subscribe from any device — it's the more flexible pub/sub model. Pick Gotify if you'd rather have a tidy web UI with per-app tokens and a simple, self-contained server for your own alerts.

Immich if a Google Photos-style mobile experience with automatic phone backup matters most — it is the closest clone and improving fast. Pick PhotoPrism if you want a stable organizer for an existing collection and care less about phone sync.

Zitadel if you want a modern, API-first identity platform with multi-tenancy and passwordless built in, and a lighter footprint than Keycloak carries in practice. Pick Keycloak if you need the deepest SAML/LDAP standards coverage, must avoid AGPL, or Red Hat's backing and a decade of production history matter to your organization.