Authelia is a sign-in page that sits in front of your other apps, with two-factor sign-in if you want it. One login at your domain, and apps that have no login of their own get one.
On this page
At a glance#
- What it is
- Authentication & SSO Security
- Where it opens
- Web Interface
On its own port at
http://your-server:port, orauthelia.your-domainonce you have a domain - Updates
- Automatic A backup is taken first, and it rolls back if the update fails
- Backups
- Included Part of the daily backup when that's switched on
- Copies
- One per server
- Needs
- A domain, Traefik
What it's good for#
Some apps have no accounts at all, and some have a login you don't entirely trust to face the internet. Authelia is a gatekeeper for them. A visitor to the app's address is sent to Authelia's sign-in page first, and only reaches the app once they've signed in. Because the sign-in is remembered across your domain, signing in once covers every app behind it for a while.
It suits a server with a domain where you want a few web apps reachable from anywhere, but only by you and the people you choose. If the apps only ever need to be reached at home or over the LibrePortal VPN, keeping them private is simpler and needs no extra login at all.
Before you install#
Authelia needs a domain and Traefik, and LibrePortal won't install it without both. Its sign-in only works over HTTPS at your domain, because the "you're signed in" cookie it sets belongs to that domain.
That cookie is the thing to plan around. It covers your Authelia domain and everything under it, so an app at photos.example.com can sit behind Authelia at authelia.example.com. An app on a different domain can't: its visitors would reach a sign-in that can never finish. LibrePortal checks this, and says so loudly when you put an app behind Authelia on a domain the cookie doesn't cover.
Signing in#
LibrePortal makes one account, called admin, during the install. Its password is in the Login Details shown when the install finishes; press Welcome on the app's page to see it again.
LibrePortal writes that account into Authelia's user file before Authelia starts for the first time, so there's never a moment when it runs with a placeholder login. If the account can't be written (there's no generated password, say), the install says so, and Authelia has no user file and won't start at all rather than start with a login someone else could know.
Installs made with 0.4.6 or earlier started Authelia with a placeholder admin account and replaced it a moment later, which could fail and leave the placeholder in place. From 0.4.7, whenever Authelia starts and its user file still holds that placeholder, LibrePortal writes the generated password in its place and restarts Authelia. The password is then in the Login Details. Any other password is left alone.
Authelia's own page is mostly for you as a user: it's where you sign in, and where you add a second factor such as an authenticator app. There's no admin screen for managing people.
Putting an app behind it#
Each app has an Authelia Integration setting on its Config tab, which appears once Authelia is installed. Tick it, save, and the app's address at your domain is meant to send visitors to Authelia first.
Not working yet
In the current release, ticking Authelia Integration points the app's route at an Authelia check that LibrePortal never actually sets up in Traefik. Traefik drops a route that names a check it can't find, so the app's domain address stops answering instead of asking for a login. Leave the setting off for now, and use private access or the VPN to keep apps to yourself. To check: the authelia@docker forwardAuth middleware is referenced (scripts/network/traefik/traefik_port_middlewares.sh:61) but defined nowhere; rewrite this section once it exists
When it does work, every signed-in user can reach every app behind it: LibrePortal sets Authelia up with one rule, "a password is enough", and no per-app lists.
Two-factor sign-in#
Authelia can ask for a code from an authenticator app as well as your password. Adding one to your account needs Authelia to prove it's really you, which it normally does by email. LibrePortal doesn't give Authelia a mail server, so it writes those messages to a file on the server instead. On a standard install you can read the latest one with:
sudo cat /libreportal-containers/authelia/config/notification.txt
The same goes for Authelia's "forgotten password" link. It's awkward, but it does mean a stranger can't reset your password by guessing your email address.
Adding people#
There's no Tools button for this yet. Authelia keeps its users in a file, config/users_database.yml in its app folder, and LibrePortal writes that file at install with only the admin in it. Adding people means editing that file by hand, and a reinstall writes it again with just the admin, so keep a copy of anything you add.
To check: document adding Authelia users once LibrePortal has a tool for it
Good to know#
- Its web page is public on purpose. A sign-in page has to be reachable by anyone who's allowed to sign in from outside. After three wrong passwords in two minutes, Authelia refuses that account for five minutes.
- Updates are automatic within version 4. LibrePortal follows Authelia's 4.x line rather than "latest", because a new major version could rename its settings and leave every app behind it unreachable without an obvious error.
- Sessions last an hour, and end after five minutes of doing nothing unless you tick "remember me", which keeps you signed in for a month.
- Backups include its settings, its user file and its database (which holds registered second factors).
- One per server. Every protected app points at the one Authelia.
What the install asks#
When you install Authelia, LibrePortal asks for a little more than usual before it starts:
- Quick settings
Addresses and ports#
Authelia has one port. LibrePortal picks a free port number for each when you install, so yours will differ from anyone else's. The Config tab's Network section shows them, and the app's Open button uses the right one. "Anyone" means it's reachable from wherever your server is reachable; you can make it private later.
| What it is | Who can reach it | With a domain |
|---|---|---|
| Web Interface | Anyone | authelia.your-domain |
Settings#
These are Authelia's own settings on its Config tab. The settings every app shares, like backups, updates and where its data lives, are explained in App pages and settings.
| Setting | What it does | Starts as |
|---|---|---|
| Who Signs In | Chosen when Authelia is installed. My LibrePortal people: everyone on the People list signs in with the same username and password. A separate admin: one extra login made for Authelia. Changing it here does not move anyone. Choices: My LibrePortal people, A separate admin |
people |
| Authelia Admin Username | Username for the seeded Authelia admin account | Empty |
| Only Apps You Give Them Advanced | Off, every signed-in person opens every app behind Authelia. On, each person opens only the apps you give them under Admin, People. Switch it on from Admin, Single sign-on once each person has their apps; the switch there applies it at once. | On |
| Require 2-step sign-in | Protected apps, and apps that sign in through Authelia, ask for a second step after the password: a code from an authenticator app, a passkey or a security key. Each person adds one the first time they sign in, which asks for a one-time code; without mail for Authelia, read it on the Tools tab (Show Sign-in Verification Code). Off, a password alone opens every app behind Authelia. Saving restarts Authelia. | On |
In its config file#
A few more aren't on the Config tab yet. They live in the app's config file, described here so you know they exist. How to change them.
| Setting | What it does | Starts as |
|---|---|---|
NameCFG_AUTHELIA_DISPLAY_NAME |
What this app is called on your dashboards. Leave empty to use its usual name | Empty |
Show on the LibrePortal DashboardCFG_AUTHELIA_SHOW_ON_DASHBOARD |
Whether this app gets a shortcut on the front page of the LibrePortal WebUI, separate from any Dashy dashboard Choices: true, false |
false |
Use single sign-on for my appsCFG_AUTHELIA_PROTECT_APPS |
When Authelia is installed, put the apps you already have behind it (sign-in or gate) where that is safe. Turns itself off once applied | true |
Detailed logsCFG_AUTHELIA_VERBOSE_LOGS |
Whether Authelia writes its normal, chattier logs, including who connected, instead of only warnings and errors. Choices: true, false |
false |
Debug logging for 24 hoursCFG_AUTHELIA_DEBUG_LOGS |
Turn on to see everything Authelia is doing while you look for a problem; it turns itself off after 24 hours. Choices: true, false |
false |
Tools#
Authelia's Tools tab has 5 buttons for jobs you'd otherwise need a terminal for. Each one runs as a task, so you can watch it on the Tasks page and read what it did. More about Tools.
Add a person to the single sign-on identity store. One credential, used across the apps that sign in with it.
The code someone needs to finish setting up 2-step sign-in, when no email is set up.
The sign-in portal's name, logo, icon and theme, on Admin → Branding.
Put the sign-in portal's saved logo, icon and title in place again.
Re-apply single sign-on across every app: wire the ones turned on, unwire the ones turned off, and restart the portal once.
Works with#
These are the other apps Authelia knows how to work with. Once it's installed, its page shows the same list with whether each one is connected. How this works.
- Grafana: Shows dashboards for the apps that have one. works with every app
- Prometheus: Collects metrics from the apps that can export them. works with every app
- Uptime Kuma: Watches your apps and shows when one goes down. works with every app
Privacy and security#
All clear Authelia is your sign-in gate and sends nothing anywhere on its own. It talks only to services you set up yourself, such as your mail server.
What leaves this server#
- Mail and sign-in providers you configure yourself
What LibrePortal turns off#
Nothing needed switching off.
Licence: Apache-2.0. Audited: 21 October 2026. See the privacy of every app and the Promise.
Sources#
Under the hood#
- It runs this image:
docker.io/authelia/authelia:4.39.28@sha256:bd97cff4fcbf715b5ff1f9ae286afbe6033afce385302520b0368122d43a6f54. - It can sit behind Authelia's sign-in once Authelia is installed.
- Its own project and documentation: github.com/authelia/authelia
Ports, settings, tools and connections on this page are read from LibrePortal v0.10.97's app catalogue each time the guide is built.