I do run Authentik and even for applications I don't expose to the internet, for the sole reason of multiple accounts. I have friends who use my server so it's not just a single user environment. Thus, complete control of authentication is a must for me. Might be worth considering if this might apply to you too!
this post was submitted on 01 Nov 2023
1 points (100.0% liked)
Self-Hosted Main
515 readers
1 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
For Example
- Service: Dropbox - Alternative: Nextcloud
- Service: Google Reader - Alternative: Tiny Tiny RSS
- Service: Blogger - Alternative: WordPress
We welcome posts that include suggestions for good self-hosted alternatives to popular online services, how they are better, or how they give back control of your data. Also include hints and tips for less technical readers.
Useful Lists
- Awesome-Selfhosted List of Software
- Awesome-Sysadmin List of Software
founded 1 year ago
MODERATORS
I use Authentik exclusively for Immich and I have no regrets. The application is wonderful and I can use for other things if needed.
Immich is the only service that I host and expose that contains important data, so having the SSO (which I also have 2FA) already adds a lot of comfort to my mind.
The whole point of a homelab is traditionally overkill, so I don’t think there is such a line :)
I think it depends on your use case.
If you live alone, or maybe with one other person, the people staying at your house don't change, then why bother with SSO?
If you're like me, have 4 people living in the house, 2 are lodgers, sometimes people come and stay for a while and need home assistant access, different people need different privileges, you need to provision wireguard for everyone, etc.
Too much for a home lab?
Is this a challenge? People here have better equipment at home than my isp does. Don’t challenge this sub lol
I was actually looking at Keycloak myself due to needing something more “professional looking” and something more “enterprise-y” which translates to our security guy hearing more about keycloak than authentik. They all should work somewhat the same though, and have the same end functionality.
I’m not sure of the technical stuff, but I believe you could use something like Oauth2 Proxy in front of your services, but that may or may not be more trouble than it’s worth, assuming it works the way I think it does. I could be wrong.
Based on your setup, you might find ZITADEL (https://zitadel.com/docs/self-hosting/deploy/overview) a great fit for centralized login management. It's versatile enough to handle a variety of services and containers, making it ideal even for mixed environments like yours. It'll also be worth watching this video for a demo on how to set up SSO - https://www.youtube.com/watch?v=1T1uxKW06Vs