Adding Authentication to any self hosted app
reddit / selfhosted

----------------------------------------------------------------------
Excellent-Focus-9905 · 2023-12-02 11:56

Hello,

I am new to self-hosting and have a home lab where I run applications.
However, I am unable to implement authentication for my apps. I am
seeking a solution to this issue. I am behind CG-NAT and currently
utilize Cloudflare Tunnel and SSH proxy to access all my applications.

Thank you for any suggestions you may have.

----------------------------------------------------------------------
Simplixt · 2023-12-02 13:30

If you using Cloudflare Tunnel, you can just use Cloudflare Access?
E.g. a OTP you get per e-mail ...

[https://developers.cloudflare.com/cloudflare-one/identity/one-time-
pin/](https://developers.cloudflare.com/cloudflare-one/identity/one-
time-pin/)

----------------------------------------------------------------------
Anejey · 2023-12-02 13:34

If you are gonna go the self-hosted route, you can use something like
Authentik for centralised authentication. It supports pretty much
everything you'll need... LDAP, OAuth2, proxy auth...

Although, since you already are using Cloudflare, you can setup
authentication through Zero Trust. You can find many guides for that
online.

----------------------------------------------------------------------
Excellent-Focus-9905 · 2023-12-02 20:43

Thank You so much

----------------------------------------------------------------------
Excellent-Focus-9905 · 2023-12-02 22:22

Is there any way to integrate passkeys into Cloudflare Access?

----------------------------------------------------------------------
arcadianarcadian · 2023-12-02 22:28

Authelia.

----------------------------------------------------------------------
jppp2 · 2023-12-02 22:56

I am using Cloudflare, unbound DNS (on OPNsense), caddy, authentik and
tailscale.

Cloudflare has a wildcard dns record to my local Caddy instance as
does OPNsense for my private subdomain (*.prv.domain.xyz to local ip;
19.168.x.y), caddy has entries for authentik and local services,
authentik has an oAith/openID provider which the services use for auth
(faceID, yubikey, passkeys etc, tailscale has a subnet into my local
ip for when I'm not at home.

----------------------------------------------------------------------
Excellent-Focus-9905 · 2023-12-02 23:39

Is authentik easy to setup?

----------------------------------------------------------------------
jppp2 · 2023-12-03 00:19

Define easy (sorry), it took me a while to get it working properly for
my setup but has been flawless, as far as I know, ever since. Let me
know if/where you got stuck

----------------------------------------------------------------------
rrrmmmrrrmmm · 2023-12-04 10:09

Use any of the OAuth solutions. If you want something tiny file based
use [Authelia](https://www.authelia.com/) and if you want to have
OAuth and LDAP in one solution use [KanIDM](https://kanidm.com/).

KanIDM can do more. To have Authelia working with LDAP you'd need
another services (i.e. LLDAP) but maybe you don't need LDAP (although
it can be handy for some services).