Authentik vs Keycloak vs Authelia: SSO for Homelabs

Define SSO scope first

Homelabs usually need "one login for a handful of web apps + MFA," not enterprise federation. List apps (proxy, Nextcloud, forge, dashboards) before picking a platform.

Authelia — forward auth specialist

Login portal + 2FA + per-domain/path rules beside Traefik/Caddy/Nginx. Modest resources. Check OIDC coverage against your list — heavy SAML/brokering is outside the sweet spot.

Authentik — UI-forward homelab IdP

Flows, MFA, growing OIDC/proxy support. Spreadsheet auth method per hostname. Use outposts where supported.

Keycloak — full identity platform

Realms, roles, brokering, SAML. Needs SSD + monitored RAM and clone-tested upgrades. Choose when you need IAM practice or SAML, not because the feature list is long.

Decision table

MFA and recovery

TOTP/WebAuthn for admins. Offline backup codes. Document spouse recovery — shared break-glass accounts beat nothing, documented codes beat shared accounts.

[Add real environment data here]
IdP + version:
Protected apps:
Idle RAM (measured):
Break-glass procedure location:

Related reading

See Traefik + Authelia SSO tutorial, Automatic SSL certificates, and Secure remote access.