How Authelia Performs Multi-Factor Authentication
Authelia sits between your reverse proxy and the apps behind it, intercepting requests and performing auth checks before forwarding traffic, giving you true MFA that can be integrated with something like Google Authenticator, or Yubikey/Titan key, etc…
Stop exposing unsecured apps. Learn how to deploy Authelia in Docker with a KeyDB backend and SWAG to enforce centralized Multi-Factor Authentication.
Setting up Authelia can be a bit intensive at first, but very worth the payoff / time and effort!
Disclaimers: I’m the author & run this exact setup, in production for myself. It’s a “battle tested” setup, which has been in use for a few years now. Written & verified by a human! The header image is a composite of my Authelia MFA token page & AI generated infographic. NO ADS or affiliate marketing on page!
Happy to chat in the comments!
Oh, you’re actually that corelab. I use your Vaulwarden guide as reference when I rebuild a while ago. Thanks for the write up !
Though, I wish you have something for Traefik and I know you wrote about why you chose SWAG but mine’s all docker anyway that’s why I go with Traefik.
There’s not many articles talking about TF with multiple host without going full Kubernetes. Looking up forward auth (for something without native OIDC) is confusing af.
Well hello there!
Yes, the one and only Core Lab Joe, in the digital flesh (packets, tcp-stream!). Thanks for reading and I’m glad it helped you!
I’m picky when writing tech guides and generally will only write (and recommend!) what I run, and what I have experience with, so that would not be traefik.
My entire system/setup is all dockerized as well. I run 50+ dockers, and anything publicly exposed goes through my SWAG instance. It doesn’t matter what reverse proxy you use, or even if the apps are containers or not really, it’s all networking.
That said I’ve got a good Traefik resource for you, FoxxMD Blog and his migrating from SWAG to Traefik post!
One of the things I need to tackle fully myself, understand, break, troubleshoot and then fix is OIDC for myself, so I can write a good guide on it. A lot of apps do natively do it now, but from what I understand for those that do not, you can use Authelia and the like to slap that authentication into (over top) of it.