Traefik + Authelia SSO Tutorial: Protect Homelab Apps

Outcome

Protect a sample app behind Traefik with Authelia login and TOTP. Prerequisites: Traefik Docker provider, working TLS on hello app, Authelia on its own subdomain.

Order of operations (do not skip)

1) Hello container with valid HTTPS 2) Authelia portal HTTPS 3) One protected app 4) Then duplicate labels. Auth bugs multiply if you wire five apps first.

Network layout

Shared Docker network for Traefik + backends. Authelia needs persistent storage for users/TOTP. Consistent container names for labels.

# shape only — pin tags you tested
services:
  traefik:
    image: traefik:v3.1
    command:
      - --providers.docker=true
      - --entrypoints.websecure.address=:443
    ports: ["443:443"]
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks: [proxy]
  authelia:
    image: authelia/authelia:4.38.17
    volumes: ["./authelia:/config"]
    networks: [proxy]
networks:
  proxy:

Authelia essentials

Default deny; explicit allows. One-factor vs two-factor per domain. Seed users; disable open registration.

Cookie domain: parent you own — too broad leaks sessions across hosts. Match auth URL Traefik calls.

Traefik forwardAuth middleware

Point middleware at Authelia verify endpoint; attach to routers that need protection. Enable passHostHeader / trust forwarded headers as required by your Traefik major version docs.

[Add real environment data here]
Traefik version:
Authelia version:
auth.example.com:
app.example.com:

Test MFA then scale out

Enroll TOTP for a test user. Confirm one-factor domains skip second factor; admin domains require it. Rate-limit login endpoints. Duplicate labels only after one app works.

Troubleshooting

• Redirect loops → verify URL or cookie domain wrong
• Websocket apps fail → headers/middleware order
• Works on one host only → cookie domain too narrow/wide

Related reading

See Authentik vs Keycloak vs Authelia, Automatic SSL certificates, and Docker Compose hardening.