Authelia

Authelia is an open-source authentication and authorization server that adds single sign-on and two-factor authentication to existing web applications without requiring any changes to those applications. It works as a companion to a reverse proxy (such as nginx, Traefik, or Caddy): the proxy forwards authentication decisions to Authelia, which allows, denies, or redirects each request based on configurable access-control rules.

It supports OpenID Connect 1.0 and OAuth 2.0, multiple second-factor methods (FIDO2/WebAuthn security keys, TOTP authenticator apps, and Duo push notifications), and passwordless authentication via passkeys. Access rules can be scoped by subdomain, user, group membership, request path, method, or network, with a choice of one-factor or two-factor policy per rule, and it can be installed as a standalone binary, system package, or container, with an official Helm chart for Kubernetes.

Authelia is a fit for teams and self-hosters who want to add centralized login and 2FA to a set of existing web apps sitting behind a reverse proxy, rather than modifying each application to handle authentication itself.