Self-host Authelia

updated Jul 2026deployed by usprices checked · Jul 2026Install verified on Ubuntu 26.04 · Aug 2026 · how we test

We earn commissions when you shop through the links below. Full disclosure →

A lightweight, open-source authentication and authorization server providing 2FA and SSO via a forward-auth portal in front of your reverse proxy — a self-hosted gatekeeper for existing apps, not a full identity provider.

Key facts

CategorySSO & Identity

LicenseApache-2.0

StackGo

Min RAM256 MB

Official imageyes

Measured idle RAM30 MB

Difficulty

Sourcegithub.com/authelia/authelia

Websiteauthelia.com

Our recommendation

Pick Authelia when you want to put SSO and two-factor in front of apps you already run — it's a lightweight forward-auth portal and 2FA gateway that pairs with your reverse proxy. It's tiny and focused; if you need to be a full OIDC provider for other software, reach for authentik, Keycloak, or Zitadel instead.

Follow the Authelia deploy guide →

What you need

Any VPS with at least 256 MB of RAM
A domain you control — most self-hosted setups need HTTPS in front of them
About an afternoon — budget time for troubleshooting

Where to host itaffiliate disclosure

Hetzner Cloudrun it on

From $23.59/mo · 2 vCPU / 4 GB / 80 GB · EU + US

Get Hetzner Cloud

Kamaterafree trial

From $4/mo · 1 vCPU / 1 GB / 20 GB · US + EU + Asia

Start free on Kamatera →

DigitalOceanalso works on

From $6/mo · 1 vCPU / 1 GB / 25 GB · US + EU + Asia

Deploy on DigitalOcean →

Paid link — we earn a commission if you shop through it.

Install

Run these commands on your server:

# Authelia — official Lite compose bundle (test/eval config)
git clone https://github.com/authelia/authelia.git && cd authelia/examples/compose/lite
# edit users_database.yml + configuration.yml for your domain, then:
docker compose up -d

deploy guideHow to Deploy Authelia on a VPS vps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly

What you take on

Authelia does one job well, so the caveats are mostly about what it deliberately is not:

non-negotiableIt's forward-auth first. It authenticates requests passing through Traefik, Nginx, or Caddy; a newer OIDC-provider mode exists but is narrower than a full IdP — don't assume it drops in for Auth0's app-to-app flows.

non-negotiableIt's config-file driven. Users, rules, and providers live in YAML you edit and version — precise and reproducible, but not a click-to-add admin UI.

non-negotiableIt wants a session backend at scale. Past a single node it needs Redis for sessions — plan for it rather than discovering it under load.