Skip to content

Self-host Authelia

updated Jul 2026prices checked · Aug 2026Install verified on Ubuntu 26.04 · Aug 2026 · how we test

A lightweight, open-source authentication and authorization server providing 2FA and SSO via a forward-auth portal in front of your reverse proxy — a self-hosted gatekeeper for existing apps, not a full identity provider.

Key facts

CategorySSO & Identity
LicenseApache-2.0
StackGo
Min RAM256 MB
Dockeryes
Difficulty
Our recommendation

Pick Authelia when you want to put SSO and two-factor in front of apps you already run — it's a lightweight forward-auth portal and 2FA gateway that pairs with your reverse proxy. It's tiny and focused; if you need to be a full OIDC provider for other software, reach for authentik, Keycloak, or Zitadel instead.

What you need

  • Any VPS with at least 256 MB of RAM
  • A domain you control — most self-hosted setups need HTTPS in front of them
  • About an afternoon — budget time for troubleshooting

Install

Run these commands on your server:

# Authelia — official Lite compose bundle (test/eval config)
git clone https://github.com/authelia/authelia.git && cd authelia/examples/compose/lite
# edit users_database.yml + configuration.yml for your domain, then:
docker compose up -d
vps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly

What you take on

Authelia does one job well, so the caveats are mostly about what it deliberately is not:

non-negotiableIt's forward-auth first. It authenticates requests passing through Traefik, Nginx, or Caddy; a newer OIDC-provider mode exists but is narrower than a full IdP — don't assume it drops in for Auth0's app-to-app flows.
non-negotiableIt's config-file driven. Users, rules, and providers live in YAML you edit and version — precise and reproducible, but not a click-to-add admin UI.
non-negotiableIt wants a session backend at scale. Past a single node it needs Redis for sessions — plan for it rather than discovering it under load.

Head-to-head

SSOAug 2026
Authelia
vs
authentik

A tiny forward-auth gate vs. a full identity provider.

Read the verdict →

More in SSO & Identity

SSO & Identity

authentik

An open-source identity provider supporting SAML, OAuth2/OIDC, and LDAP — a flexible, self-hostable alternative to Auth0, Okta, and Azure AD with a visual flow-based login builder.
PythonGoTypeScript
moderateRead guide →
SSO & Identity

Keycloak

A mature, enterprise-grade open-source identity and access management server — SSO, SAML, and OpenID Connect with user federation, built on Quarkus and backed by Red Hat.
JavaQuarkus
hardRead guide →
SSO & Identity

Pocket ID

A simple, self-hostable OIDC provider that lets users sign in to your apps with passkeys only — no passwords, built for small self-hosted setups that just need lightweight SSO.
GoSvelteKit
easyRead guide →
SSO & Identity

Tinyauth

The tiniest self-hosted login screen for your apps — a single small Go container that adds authentication, OAuth login, and access controls in front of Traefik, Nginx, or Caddy, and since v5 doubles as an OpenID Certified OIDC provider.
Go
easyRead guide →

We use analytics cookies (Google Analytics, PostHog) to see which guides are useful. No ad networks, no cross-site tracking. See our privacy policy.