Deploy Authelia

Deploy and Host Authelia on Railway

Authelia is an open-source authentication and authorization server that puts a single sign-on portal, two-factor authentication and an OpenID Connect 1.0 provider in front of the apps you already run. It is a single Go binary, used by homelabs and engineering teams who want one login and one place to enforce 2FA without paying per seat — the answer to five internal tools with five separate user lists.

Deploy Authelia on Railway and you get the whole identity stack, not a lone container: the portal, an lldap directory with a web UI for users and groups, PostgreSQL for two-factor secrets and OAuth 2.0 state, Redis as the session store, and Mailpit to catch the one-time codes Authelia emails during credential registration. Sign-ins hit the portal, which binds to lldap over the private network to check the password, records the second factor in Postgres and keeps the session in Redis — every piece wired together on first boot.

Getting Started with Authelia on Railway

Set an admin password when you deploy — the one value the template asks for, and the first directory account. Open the Authelia service URL and sign in as admin with it. Authelia then asks you to register a second factor and emails a one-time code, which lands in the Mailpit inbox published by the mailpit service (sign in there as admin with the Mailpit password). Paste the code, scan the QR with any authenticator app, confirm the six digits, and the account is protected. Next open the lldap service URL, sign in with the same credentials, and create the accounts your team will use — every user added there can sign in to Authelia at once. To check the deployment end to end, request /.well-known/openid-configuration on the Authelia domain: a JSON document naming the authorization and token endpoints means it is live.

About Hosting Authelia

Authelia solves the problem of every self-hosted tool having its own login form. It answers one question — is this person allowed in, and have they proved it twice — then hands the answer over through OpenID Connect or a reverse proxy's forward-auth hook. Self-host it when you want SSO you control, or when per-user pricing is out of proportion to a small team.

• One sign-in portal with password policy enforcement and brute-force regulation
• Second factors: TOTP apps, WebAuthn security keys and passkeys, Duo push
• A full OpenID Connect 1.0 provider with consent screens, refresh tokens and group claims
• Forward-auth endpoints for NGINX, Traefik, Caddy, HAProxy and Envoy
• Access rules by domain, path, user, group and network, and email-verified password reset

The Railway architecture splits those responsibilities across small services. Authelia keeps only its OpenID Connect signing key on a volume. lldap is the directory — LDAP on the private network, an admin UI for you. PostgreSQL holds encrypted TOTP secrets, WebAuthn credentials, OAuth 2.0 grants and the audit log. Redis holds sessions so they survive deployments. Mailpit captures outbound mail; repoint the SMTP variables at a real provider when you go live.

Why Deploy Authelia on Railway

Railway removes the setup work around a self-hosted identity provider.

• Private networking between portal, directory, database and cache
• Managed PostgreSQL and Redis, no tuning required
• HTTPS and certificates for every service domain
• Volumes so signing keys and accounts survive redeploys
• One-click redeploys when a new Authelia release ships

Common Use Cases

• A single sign-on portal in front of internal dashboards, wikis and admin panels
• OpenID Connect login for Grafana, Proxmox, Nextcloud, Portainer or your own app
• Mandatory two-factor authentication on everything a small team touches
• A private user directory for staff and contractors, with no cloud provider

Dependencies for Authelia

• Authelia — the gridalpha/authelia-railway repository, built on authelia/authelia:latest
• lldap — lldap/lldap:stable, the LDAP directory and its admin UI
• PostgreSQL and Redis — Railway managed: two-factor and OAuth 2.0 state, and the session store
• Mailpit — axllent/mailpit:latest, SMTP sink for codes and notifications

Environment Variables Reference

Deployment Dependencies

• Authelia documentation and source
• authelia/authelia on Docker Hub
• lldap on GitHub

Hardware Requirements for Self-Hosting Authelia

Authelia idles at roughly 30 MB of RAM, which is why it is chosen over heavier identity providers; PostgreSQL and Redis are most of the footprint.

Self-Hosting Authelia with Docker

Outside Railway, Authelia reads a YAML configuration file. A minimal run mounts a config directory and publishes the portal port:

docker run -d --name authelia \
  -v $(pwd)/config:/config \
  -p 9091:9091 \
  authelia/authelia:latest

Two values in that file cannot be typed by hand. Generate the signing key and hash a client secret with Authelia's own CLI first:

docker run --rm -v $(pwd)/config:/config authelia/authelia:latest \
  authelia crypto pair rsa generate --directory /config/oidc
docker run --rm authelia/authelia:latest \
  authelia crypto hash generate pbkdf2 --variant sha512 --password 'your-client-secret'

The Railway template does both on first boot and keeps the key on a volume, so issued tokens stay valid across redeploys.

How Much Does Authelia Cost to Self-Host?

Authelia is free and open source under the Apache 2.0 licence: no paid tier, no seat limits, no enterprise edition holding features back — every protocol and second-factor method is in the one build. lldap and Mailpit are likewise free. On Railway you pay only for the compute, memory and storage the five services use, a few dollars a month for a small team.

Authelia vs Authentik vs Keycloak

Pick Authelia for SSO and strong 2FA without running an identity platform; pick Authentik or Keycloak when SAML or complex enrolment flows are non-negotiable.

FAQ

What is Authelia? An open-source authentication and authorization server providing single sign-on, two-factor authentication and an OpenID Connect provider for self-hosted applications.

Why does the template include PostgreSQL and Redis? Authelia's documentation treats file storage as suitable only for lightweight installs. PostgreSQL holds encrypted second-factor secrets, OAuth 2.0 grants and the audit log; Redis keeps sessions outside the container, so a redeploy does not log everyone out.

How do I add users to self-hosted Authelia? Open the lldap service URL, sign in as admin, and create users there. Authelia reads the directory over LDAP, so new accounts sign in straight away, and groups become groups claims in OpenID Connect tokens.

How do I connect an application to Authelia with OpenID Connect? Set OIDC_CLIENT_ID, OIDC_CLIENT_SECRET and OIDC_CLIENT_REDIRECT_URIS on the Authelia service, then point the application at https:///.well-known/openid-configuration. Authelia hashes the secret itself, so supply the plaintext value the application will send.

Can I use Authelia's forward auth with Railway domains? Forward auth needs the portal and the protected app to share one registrable domain, so attach a custom domain — auth.example.com in front of app.example.com — and set SESSION_COOKIE_DOMAIN and PROTECTED_DOMAINS. OpenID Connect needs none of that and works across separate domains.

How do I send real email instead of using Mailpit? Point SMTP_HOST, SMTP_PORT, SMTP_USERNAME and SMTP_PASSWORD at your provider and set SMTP_SENDER to an address it accepts. Email matters here: registering a second factor requires a one-time code.