Self-host Authelia

SSO & Identity

deployed & timed by usprices checked · Jul 2026

A lightweight, open-source authentication and authorization server providing 2FA and SSO via a forward-auth portal in front of your reverse proxy — a self-hosted gatekeeper for existing apps, not a full identity provider.

Key facts

CategorySSO & Identity

LicenseApache-2.0

StackGo

Min RAM256 MB

Dockeryes

Difficulty

Our recommendation

Pick Authelia when you want to put SSO and two-factor in front of apps you already run — it's a lightweight forward-auth portal and 2FA gateway that pairs with your reverse proxy. It's tiny and focused; if you need to be a full OIDC provider for other software, reach for authentik, Keycloak, or Zitadel instead.

What you need

Any VPS with at least 256 MB of RAM
A domain you control — most self-hosted setups need HTTPS in front of them
About an afternoon — budget time for troubleshooting

Install with Docker Compose

Save this as compose.yml and run docker compose up -d:

# Authelia — official Lite compose bundle (test/eval config)
git clone https://github.com/authelia/authelia.git && cd authelia/examples/compose/lite
# edit users_database.yml + configuration.yml for your domain, then:
docker compose up -d

vps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly

What you take on

Authelia does one job well, so the caveats are mostly about what it deliberately is not:

non-negotiableIt's forward-auth first. It authenticates requests passing through Traefik, Nginx, or Caddy; a newer OIDC-provider mode exists but is narrower than a full IdP — don't assume it drops in for Auth0's app-to-app flows.

non-negotiableIt's config-file driven. Users, rules, and providers live in YAML you edit and version — precise and reproducible, but not a click-to-add admin UI.

non-negotiableIt wants a session backend at scale. Past a single node it needs Redis for sessions — plan for it rather than discovering it under load.