How Authelia Performs Multi-Factor Authentication
Authelia sits between your reverse proxy and the apps behind it, intercepting requests and performing auth checks before forwarding traffic, giving you true MFA that can be integrated with something like Google Authenticator, or Yubikey/Titan key, etc…
Stop exposing unsecured apps. Learn how to deploy Authelia in Docker with a KeyDB backend and SWAG to enforce centralized Multi-Factor Authentication.
Setting up Authelia can be a bit intensive at first, but very worth the payoff / time and effort!
Disclaimers: I’m the author & run this exact setup, in production for myself. It’s a “battle tested” setup, which has been in use for a few years now. Written & verified by a human! The header image is a composite of my Authelia MFA token page & AI generated infographic. NO ADS or affiliate marketing on page!
Happy to chat in the comments!
Very cool Guide. Injust got done Setting up authentik and im Not doing anything in that regard soon, but I’ll keep an eye put for authelia
Very nice site set up man. Looks like a lot of good info and a lot of work involved. I too use Authelia as an added security step. I have your site bookmarked and will peruse it’s contents in a bit. Thanks for sharing.
Thank you for taking a peek!
Let me know if there’s something you’re looking for. The search function isn’t to bad but sometimes the posts can get buried a bit ;)
You bet. So far, it’s an enjoyable read.
Honestly, the one major thing I want from Authelia is the ability to add to it without deauthenticating the entire userbase.
Well, that and an easier way to organize than everything in one single file…
Is rayfish compatible with Authelia or Yggdrasil?
Never heard of Rayfish but just googled, it’s a mesh VPN so probably wouldn’t want to push that through a reverse proxy to authelia, it would just slow it down…
I personally use wireguard as my VPN, not tailscale or headscale or any of that but I do understand some people need something that can get around CGNAT or other issues.
SWAG. SWAG. SWAG.
Apparently it is just a customized nginx set up.
If you knew what was under the hood you would not say it’s “just” customized nginx… It’s more like customised, optimized and simplified.
It has many enhancements builtin like automatic certificate generation and renewal, fail2ban, prebuilt optimized configs, and easily enhanced security with crowdsec and even geofencing.
But made way easier than doing that separately with raw NGINX.
It’s much more friendly to pickup and run with then raw NGINX.