Questions about Traefik and Authentik / Authelia reddit / selfhosted ---------------------------------------------------------------------- Azsde · 2023-10-24 08:59 Hello everyone, I have a Traefik installation and I wish to increase the security of my setup. I plan to deploy a crowdsec bouncer, but I also have stumbled upon Authentik and Authelia, and I am not sure I totally understand their purpose. From what I understand, those services would allow to only allow Traefik to redirect the user to the appropriate service if correctly authenticated, is that correct? Also, using either Authentik or Authelia, user can use SSO to register/login ? How can I control who can register? Finally, assuming my understanding of those services is correct, I suspect that using a web browser to access the services, the login UI will be prompted, but what if I use a mobile application? For instance I use immich to backup my pictures, so in the app settings I have : immich.mydomain.com, how would that works out if I use either Authentik or Authelia? I thank you in advance for your answers. ---------------------------------------------------------------------- sk1nT7 · 2023-10-24 09:17 >From what I understand, those services would allow to only allow Traefik to redirect the user to the appropriate service if correctly authenticated, is that correct? Exactly. In Traefik, this is often called a forwardAuth middleware. Only if you are authenticated against Authelia/Authentik, Traefik will obtain the go to proxy the user request to the actual proxy service. >Also, using either Authentik or Authelia, user can use SSO to register/login ? How can I control who can register? Yes but it depends on the proxied application. Some do not support OAuth/OIDC/SAML and whatever. Then, you have to authenticate against Authelia/Authentik and a second time at the service via username and password usually. Some apps however support it. Then you can setup the app and Authelia/Authentik for SSO. If done, only a single login against Authelia/Authentik is required and you'll be automatically logged into the app. No second login necessary. Authelia/Authentik will handle it. >For instance I use immich to backup my pictures, so in the immich mobile app server settings I have : immich.mydomain.com, how would that works out if I use either Authentik or Authelia? Unfortunately, Immich does not support OAuth/OIDC/SAML yet. Therefore, you are left with authenticating against Authelia/Authentik and then as well against immich via your user credentials. As correctly assumed, this requires a web browser to obtain the Authelia/Authentik login screen. For the immich mobile app, this is not possible. There is some discussion on GitHub here about this topic: https://github.com/immich-app/immich/discussions/3118 I've also implemented Authentik with Traefik. May read here: https://blog.lrvt.de/authentik-traefik-azure-ad/ ---------------------------------------------------------------------- ElevenNotes · 2023-10-24 09:20 How about accessing your selfhosted applications that only you use only via VPN? Exposing your selfhosted applications to the world is only needed if, well, you need the whole or a part of the world to access it? Authentik works great for authentication, but that’s about it, and you are right, most apps don’t work anymore if you add an authentication layer that does not natively exist on it. ---------------------------------------------------------------------- Azsde · 2023-10-24 09:29 I need to share some services with my relatives, so for the services that I only use, I am currently using a VPN, but for the others services it is too much to ask them to install a VPN. ---------------------------------------------------------------------- ElevenNotes · 2023-10-24 09:37 There is that pro and contra dilemma. It would certainly be a lot easier if you could mesh their networks with yours, by installing either your preferred VPN solution on their router or give them a device like an RPi to proxy requests through to you. If you want and need to expose your services for your relatives to the web, at least block everything except your country and add authentication to everything and make sure that all your apps are hosted on isolated networks. ---------------------------------------------------------------------- bo0tzz · 2023-10-24 10:15 > Unfortunately, Immich does not support OAuth/OIDC/SAML yet. This is wrong. https://immich.app/docs/administration/oauth ---------------------------------------------------------------------- sk1nT7 · 2023-10-24 10:20 True, it does. However, the mobile does not work with it properly or? Just the web app. ---------------------------------------------------------------------- Wojojojo90 · 2023-10-24 11:36 > Then, you have to authenticate against Authelia/Authentik and a second time at the service via username and password usually. FYI that at least in Authentik you can avoid the second login. Check the instructions they have on setting up Sonarr for more details, but you can save the app credentials in Authentik, then if your identity is authorized for access Authentik will automatically attach the credentials for the app: https://goauthentik.io/integrations/services/sonarr/ Works for anything that has http basic auth ---------------------------------------------------------------------- Wojojojo90 · 2023-10-24 12:04 I've had no issues with oidc on Android or web app ---------------------------------------------------------------------- sk1nT7 · 2023-10-24 12:36 Nice thanks!