Is Authentik too much for a HomeLab? reddit / selfhosted ---------------------------------------------------------------------- lockstock27 · 2023-11-01 19:21 I've got 2 hosts. A slightly more powerful sff tower running my media stuff and arr services. VPN gateway that the arr's route through etc. I have a raspberry pi that's running my Adblocker, reverse proxy, Wireguard some stuff for a small business I run... So a website platform and invoice/time logging system. Anyway these various services are mostly secured by password. Only the website is accessible externally. Any other service is only accessible internally or via Wireguard VPN. Just at that stage asking myself "where do I draw the line?" Would be nice to centrally manage logins but I suspect the mismash of services I run wont all support SSO. I think In today it must be near 25-30 services / containers. Authentik looks good. But wondering whether it's just going to be something I only use a fraction of and "a bit overkill" for my needs? ---------------------------------------------------------------------- sk1nT7 · 2023-11-01 19:44 As you said: Not all of your containers will support SSO. Therefore, having Authentik in front does not bring that many benefits. You would still have to login to the proxy service. If the service supports basic auth though, you can passthrough those creds directly via Authentik. Nonetheless, the service would sit behind Authentik. So it could be seen as an additional authentication wall or security measure to restrict unauthorized access. For proxied services that support SSO, Authentik is great. The learning curve is a bit steep, due to custom namings like flows, binds etc. but once you get it, it's quite easy. If you want a more lightweight alternative, may have a look into Authelia. ---------------------------------------------------------------------- lockstock27 · 2023-11-01 19:53 Good call on the password vault. I need to sort mine out and get the correct urls and auto fill settings in place. That would fix 97.7% of my "issues" It's one of those things isn't it. You see another service in various articles or Reddit posts and you think "do I need that" Tbh I've had a bit of a play around tonight with Authentik as thought it would be worth a poke around as I think it could be useful for my business in the future. But yeah, I think this has already been answered. Great service just probably not needed for what I do at home. ---------------------------------------------------------------------- Ariquitaun · 2023-11-01 20:17 Use a password manager like bitwarden. Use the time you'd have wasted with sso enjoying life. ---------------------------------------------------------------------- indykoning · 2023-11-01 20:18 You're right probably not everything will support SSO but you'll be surprised with how many actually do in some capacity. Nextcloud, Mealie, Portainer, Proxmox, Jellyfin and by extension jellyseerr Are just some of the things I run that support it. And your *arrs could support it in some capacity by putting the proxy Auth in front and removing the password from the application. I went for it because the applications other people use that I'd like to manage have the support for it. Sure in my and most people's homelab it's overkill, but it's fun! ---------------------------------------------------------------------- mrpink57 · 2023-11-01 20:25 I'd put a depends. One benefit is even without SSO a user gets to use the same username/password across multiple services instead of a new username/password for each service, it is also easier for you to manage users and add/remove from groups. ---------------------------------------------------------------------- majia1988 · 2023-11-01 21:44 I use authelia and lldap. Tried Authentik, it used too much memory. ---------------------------------------------------------------------- reddittookmyuser · 2023-11-01 21:59 Yes. Authentik like Kubernetes is likely overkill for small homelab. For me the biggest selling point for still using them is that they present great learning opportunities. So it depends on what you are looking to get out of your homelab. If you want my advice do it, set it up, learn it, use it. If it proves to much of a hassle after having it up and running, document and save your configuraiton, and rollback to something simpler like Authelia. ---------------------------------------------------------------------- adamshand · 2023-11-01 22:08 LLDAP is much simpler than Authelia/Authentik/Keycloak (can get it up and running in minutes) and allows centralised logins for any service which supports LDAP. https://github.com/lldap/lldap#sample-client-configurations I didn't bother setting up LLDAP until I got annoyed with creating accounts for friends / family. When it was just me using everything, a password manager was fine. ---------------------------------------------------------------------- thelinedpaper · 2023-11-01 22:13 Authentik might be overkill, but it gives quite a bit of flexibility, and it's so versatile that with some work, you can make it work with most applications, they just won't necessarily all be SSO, but a single user/password at the least. ---------------------------------------------------------------------- lockstock27 · 2023-11-01 22:15 Good call on the proxy auth! ---------------------------------------------------------------------- packet_weaver · 2023-11-01 22:31 I would use something that’ll build experience you can use on the job. - Azure AD (check out Office 365 Developer for free access) - Okta developer (limited to 5 apps) - Keycloak (less popular) ---------------------------------------------------------------------- Judman13 · 2023-11-01 22:55 How does sso work with the jellyfin clients like the android and roku clients? ---------------------------------------------------------------------- LeftBus3319 · 2023-11-01 23:03 I do run Authentik and even for applications I don't expose to the internet, for the sole reason of multiple accounts. I have friends who use my server so it's not just a single user environment. Thus, complete control of authentication is a must for me. Might be worth considering if this might apply to you too! ---------------------------------------------------------------------- lilolalu · 2023-11-01 23:31 Jellyfin supports LDAP via plugin and authentik can act as a LDAP server. You don't have SSO that way but centralized credentials, which is maybe even more important than SSO. ---------------------------------------------------------------------- lilolalu · 2023-11-01 23:34 Authentik can act as an LDAP server so even if you would just use authentik for the moment it will give you much more flexibility for the future, i.e. setting up MFA is literally one click with authentik, regardless if you are using LDAP or OIDC behind the scenes. ---------------------------------------------------------------------- adamshand · 2023-11-01 23:36 Yeah I know, it's just a bit heavyweight for my little servers at home. :-) ---------------------------------------------------------------------- lilolalu · 2023-11-01 23:41 It never popped up on any of my server metrics in terms of RAM or CPU usage, so I would say that may be a bit of myth. I agree that it can appear extremely complex but the nice thing is you don't have to use much of that complexity in the beginning, I am using maybe 1/10th of what it's capable of. But it's there if you need it. If you are planning to use MFA or SSO it's one of the "simple" solutions compared to i.e. keycloak. ---------------------------------------------------------------------- adamshand · 2023-11-01 23:43 Interesting. Docs say "a host with at least 2 CPU cores and 2 GB of RAM" ?? ---------------------------------------------------------------------- lilolalu · 2023-11-01 23:46 Well the hardware recommendations i.e. for gitlab assume as a "small" installation that you want to serve 500 users. So these recommendations without context don't mean a lot. ---------------------------------------------------------------------- hunterhulk · 2023-11-01 23:53 many people just run both. so SSO with oidc login for browsers and ldap for phones etc ---------------------------------------------------------------------- kingmathyou · 2023-11-02 00:36 Authentik rules, highly recommend. Its a nice to have for a homelab, but definitely not required (it does take a lot of configuration to get correct). ---------------------------------------------------------------------- CactusBoyScout · 2023-11-02 00:47 I just setup Authentik and it's definitely the most confusing self- hosted thing I've setup thus far. But eventually with YouTube tutorials and a lot of Googling, I got the gist of it. But as others have pointed out, you can only really use it with some services. I use it with the *arrs and with Homepage. I mostly wanted to try it because Homepage doesn't support any authentication at all. So it was this or basic auth via NPM. ---------------------------------------------------------------------- chandz05 · 2023-11-02 00:55 I use Authelia with lldap too! Works so well ---------------------------------------------------------------------- pimenteldev · 2023-11-02 02:04 I use Authentik exclusively for Immich and I have no regrets. The application is wonderful and I can use for other things if needed. Immich is the only service that I host and expose that contains important data, so having the SSO (which I also have 2FA) already adds a lot of comfort to my mind. ---------------------------------------------------------------------- sexyshingle · 2023-11-02 03:48 SSO is not the same as a password manager ---------------------------------------------------------------------- TerminalFoo · 2023-11-02 04:54 I use Authentik extensively in the homelab. It is not overkill. SSO when done right can unify the login experience, authentication, and authorization. Even things that don't support SSO natively can instead utilize forward authentication or a proxy for authentication. Compared to all the SSO options out there with a similar feature set, Authentik was the easiest. Authelia does exist, but it doesn't support everything that Authentik does. ---------------------------------------------------------------------- zahnza · 2023-11-02 05:38 Woooosh ---------------------------------------------------------------------- darknekolux · 2023-11-02 05:45 Bold of you to think I would enjoy otherwise ---------------------------------------------------------------------- lestrenched · 2023-11-02 06:44 The commenter meant for the OP to use an SSO as a common layer of authentication for everything, and then use a password manager to manage passwords for every service. ---------------------------------------------------------------------- SawkeeReemo · 2023-11-02 07:17 I really need to figure out how to set this up. …also need more free time and less of a fried brain. 😅 ---------------------------------------------------------------------- VIDGuide · 2023-11-02 07:40 The whole point of a homelab is traditionally overkill, so I don’t think there is such a line :) ---------------------------------------------------------------------- Azelphur · 2023-11-02 09:21 I think it depends on your use case. If you live alone, or maybe with one other person, the people staying at your house don't change, then why bother with SSO? If you're like me, have 4 people living in the house, 2 are lodgers, sometimes people come and stay for a while and need home assistant access, different people need different privileges, you need to provision wireguard for everyone, etc. ---------------------------------------------------------------------- honestly_a_shoe · 2023-11-02 10:08 I wouldn't recommend removing auth from your *arrs, but you can use proxy auth to pass basic credentials in Authentik. ---------------------------------------------------------------------- Feahnor · 2023-11-02 12:17 Too much for a home lab? Is this a challenge? People here have better equipment at home than my isp does. Don’t challenge this sub lol ---------------------------------------------------------------------- No_Ja · 2023-11-02 13:08 Genuine question, if your arrs are only available on lan or when connected by vpn, why would you not remove password? ---------------------------------------------------------------------- thecomputerguy7 · 2023-11-02 13:08 I was actually looking at Keycloak myself due to needing something more “professional looking” and something more “enterprise-y” which translates to our security guy hearing more about keycloak than authentik. They all should work somewhat the same though, and have the same end functionality. I’m not sure of the technical stuff, but I believe you could use something like [Oauth2 Proxy](https://oauth2-proxy.github.io/oauth2-proxy/) in front of your services, but that may or may not be more trouble than it’s worth, assuming it works the way I think it does. I could be wrong. ---------------------------------------------------------------------- honestly_a_shoe · 2023-11-02 13:13 It's more that using a [multi- layered](https://www.ibm.com/docs/en/i/7.3?topic=security-layered- defense-approach) security approach is encouraged in cybersecurity. It's just so if someone does manage to get access to your network, they can't just go ham with all your services. ---------------------------------------------------------------------- HTTP_404_NotFound · 2023-11-02 13:32 It works perfectly in my lab. Huge fan of it. But, I also have quite a few services using it... 3 or 4 dozen. ---------------------------------------------------------------------- atheken · 2023-11-02 14:54 IMO, everything should be behind Authentik or another auth layer, even if there are user accounts on the destination. This is so that random bots can't poke around your apps indiscriminately, and is another layer of protection if an app you're hosting has an undiscovered/unpactched CVE. You can allow the sessions to be long-lived, and even bypass the auth layer for internal requests if you want to make it a bit more convenient. For apps that allow it, you can also use the auth layer as your login provider, so for some stuff it's still only one layer. ---------------------------------------------------------------------- Skotticus · 2023-11-02 15:38 What YouTuber were you watching? It seems like Cooptonian is the only person on the planet doing Authentik tutorials beyond basic setup (his videos are great!), but I'd love to see some others in the interest of learning Authentik from a different perspective. ---------------------------------------------------------------------- Skotticus · 2023-11-02 15:44 This is one of the two main reasons to run Authentik. If it was just me using the services, I probably would just stick to Bitwarden and have everything that doesn't have an auth layer be local only. The other reason is security: adding auth layers and 2FA to apps that don't have them but that you still want to expose. ---------------------------------------------------------------------- CactusBoyScout · 2023-11-02 15:50 Yeah he had the best videos but I also watched Sids Tech video using Sonarr as a demo. They go over how to pass basic auth, which is helpful. ---------------------------------------------------------------------- Skotticus · 2023-11-02 21:29 Thanks, sounds like a good resource! I've had a frustrating time figuring out basic auth in a way that doesn't require me to know every user's password for every service... ---------------------------------------------------------------------- CactusBoyScout · 2023-11-02 21:52 Oh yeah I’m the only user so can’t help you there. Authentik has a discord though. They can probably help. ---------------------------------------------------------------------- fuken33 · 2023-11-02 23:31 I use caddy-security with lldap and caddy-docker-proxy. Much easier to setup and maintain ---------------------------------------------------------------------- indykoning · 2023-11-03 10:37 This is exactly how I do it, OIDC for web based clients, LDAP for apps not supporting oidc and for jellyseerr. So on TV devices I simply use username and password or quick connect ---------------------------------------------------------------------- hunterhulk · 2023-11-03 11:02 if you use the jellyseer branch you. can use oidc. its pretty stable ---------------------------------------------------------------------- SnooDoubts2008 · 2023-11-16 05:47 Based on your setup, you might find ZITADEL (https://zitadel.com/docs/self-hosting/deploy/overview) a great fit for centralized login management. It's versatile enough to handle a variety of services and containers, making it ideal even for mixed environments like yours. It'll also be worth watching this video for a demo on how to set up SSO - https://www.youtube.com/watch?v=1T1uxKW06Vs ---------------------------------------------------------------------- MoogleStiltzkin · 2023-11-30 15:15 no i don't think it's overkill. maybe you have an web app without any sort of auth challenges for credentials. then you'd want to have something in place yes? or go further, have a SSO so it works for all your web apps without having to sign into everything 1 by 1. just once is enough. Or maybe you want to add totp for 2fa, or have passwordless webauth as an option for logging in without entering a username or password. authentik can do all these things. ​ it doesn't hurt to have this layer. the worse nuisance it can do, is you have to use your mobile to fingerprint to sign in. but in returns it gives you that extra layer of security that requires authorization to access. ​ i recommend checking ibracorp, cooptonian and jim's garage. They have good videos on setting up authentik. ---------------------------------------------------------------------- MoogleStiltzkin · 2023-11-30 15:18 >needing something more “professional looking” and something more “enterprise-y” which translates to our security guy hearing more about keycloak than authentik. They all should work somewhat the same though, and have the same end functionality. in this type of environment, setting up a vlan to segment out the network might not be a bad idea as well. then those people who just need the internet can get that, but without touching any of the other stuff on his private vlan which is kept separate. ---------------------------------------------------------------------- MoogleStiltzkin · 2023-11-30 15:21 i thought immich already has it's own login system? just wondering though, how did you configure immich to work with authentik. was it using oauth? ---------------------------------------------------------------------- MoogleStiltzkin · 2023-11-30 15:42 cooptonian number 1. but other solid mentions that covered authentik were IBRACORP and Jim's garage. recommend watching all of them. But cooptonians helped me the most. ---------------------------------------------------------------------- pimenteldev · 2023-12-02 11:25 I moved from Authentik to Zitadel (because of UI only, I think Zitadel is prettier), although it's pretty much the same thing. Yes, I'm using OAUTH. Immich has support for it with Auth Code grant type. You can check more details here, it's really straight forward: [ https://immich.app/docs/administration/oauth](https://immich.app/docs/ administration/oauth) ---------------------------------------------------------------------- MoogleStiltzkin · 2023-12-05 10:05 thats weird. cauz i started out with zitadel, but then i switched to authentik. seems like you did the reverse xd. ​ anyway thx