one front door: Authelia SSO + 2FA for every self-hosted app

why your self-hosted stack is only as strong as its weakest login

if you run a homelab, you probably have a pile of apps. a media server, a photo backup thing, a dashboard, maybe a git server, maybe home assistant. each one has its own login page, its own password, and honestly, its own level of "did i actually set up 2fa on this one or did i mean to and forget." that's the real risk. not some elite hacker group, just you, three years from now, reusing a password on the one app you never got around to securing properly.

authelia fixes this by putting one authentication layer in front of everything. instead of fifteen doors with fifteen different locks, you get one solid front door with a deadbolt, and every app sits behind it.

what authelia actually does

authelia is an open source authentication and authorization server. it doesn't replace your apps' logins, it sits in front of them using your reverse proxy's "forward-auth" feature. when someone tries to hit any subdomain on your network, the proxy checks with authelia first. no valid session, no access, full stop. you get single sign-on and two factor auth applied consistently across your entire domain, instead of app by app, where it's easy to miss one.

run it in docker so it's isolated, easy to update, and easy to tear down and rebuild if you mess up the config, which you will the first time, that's normal.

the setting that matters most: default_policy: deny

default_policy: deny

this one line is the whole philosophy. it tells authelia: unless i explicitly say an app or route is allowed, nobody gets in. no exceptions by accident. you then define access rules per domain or path, and anything you forget to define stays locked instead of staying open.

this matters because the opposite setup, "allow by default, deny the stuff i remember to block," is how people end up with a random service quietly exposed to the internet with no auth in front of it for six months. deny by default means your mistakes fail closed instead of failing open.

forcing two factor across your whole domain

once the default policy is deny, you set your access control rules to require two_factor for the domain or subdomains you care about, instead of configuring 2fa separately inside every single app, half of which don't even support it well.

this is the actual upgrade. you're not just gatekeeping with a password anymore. even if someone phishes or guesses a password, they still hit a second factor before they're anywhere near your media server or your home automation panel. one policy, applied everywhere, instead of a patchwork where your most sensitive app has the weakest login.

connecting it to your reverse proxy

authelia doesn't do anything on its own, it needs to be wired into whatever's handling traffic, usually nginx, traefik, or caddy. you point the proxy's forward-auth setting at authelia's endpoint, so every request gets checked before it's allowed to reach the actual app. the proxy asks authelia "is this session legit," authelia says yes or no, and the proxy acts accordingly.

this is also why it's worth doing even if you only run two or three self-hosted apps right now. the setup cost is mostly upfront. once it's wired in, adding a new app behind the same protection is just adding a rule, not standing up a whole new auth system.

the takeaway

most self-hosted setups don't get broken into through some fancy exploit, they get walked through an unlocked door nobody remembered to lock. fifteen apps with fifteen different passwords means fifteen chances to get it wrong. one front door with deny-by-default and two factor required means one thing to get right, and you can actually verify it's right, because it's all in one config.

if you're running more than a couple of self-hosted services, audit what's actually sitting exposed right now. check whether every app has real auth in front of it, check whether 2fa is consistent or spotty, and if it's spotty, that's your sign to put authelia or something like it in front of all of it. lock the front door once, properly, instead of checking fifteen back windows forever.