---
title: "Deploy Authelia"
description: "Authelia SSO and 2FA portal with lldap directory, PostgreSQL & Redis"
category: "Authentication"
url: https://railway.com/deploy/authelia-sso
---

# Deploy Authelia

Authelia SSO and 2FA portal with lldap directory, PostgreSQL & Redis

**[Deploy Authelia on Railway](https://railway.com/template/authelia-sso)**

- **Creator:** A3A
- **Category:** Authentication
- **Total deploys:** 1

## Template content

### Redis https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/redis.svg

- **Image:** redis:8.2
- **Start command:** `/bin/sh -c "rm -rf $RAILWAY_VOLUME_MOUNT_PATH/lost+found/ && exec docker-entrypoint.sh redis-server --requirepass $REDIS_PASSWORD --save 60 1 --dir $RAILWAY_VOLUME_MOUNT_PATH"`

### Postgres https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/postgresql.svg

- **Image:** ghcr.io/railwayapp-templates/postgres-ssl:18

### mailpit https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/mailpit.svg

- **Image:** axllent/mailpit:latest
- **Public domain:** Yes

### lldap https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/lldap.svg

- **Image:** lldap/lldap:stable
- **Public domain:** Yes

### authelia https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/authelia.svg

- **Source:** https://github.com/gridalpha/authelia-railway
- **Public domain:** Yes

## Documentation

![Authelia logo](https://repository-images.githubusercontent.com/75785240/724ca480-396f-11ea-874f-d39c6900e14d)

# Deploy and Host Authelia on Railway

Authelia is an open-source authentication and authorization server that puts a single sign-on portal, two-factor authentication and an OpenID Connect 1.0 provider in front of the apps you already run. It is a single Go binary, used by homelabs and engineering teams who want one login and one place to enforce 2FA without paying per seat — the answer to five internal tools with five separate user lists.

Deploy Authelia on Railway and you get the whole identity stack, not a lone container: the portal, an **lldap** directory with a web UI for users and groups, **PostgreSQL** for two-factor secrets and OAuth 2.0 state, **Redis** as the session store, and **Mailpit** to catch the one-time codes Authelia emails during credential registration. Sign-ins hit the portal, which binds to lldap over the private network to check the password, records the second factor in Postgres and keeps the session in Redis — every piece wired together on first boot.

![Diagram of the Authelia, lldap, Mailpit, Postgres and Redis services](https://res.cloudinary.com/rroe4rtk/image/upload/v1787749934/authelia-architecture.png)

## Getting Started with Authelia on Railway

Set an admin password when you deploy — the one value the template asks for, and the first directory account. Open the Authelia service URL and sign in as `admin` with it. Authelia then asks you to register a second factor and emails a one-time code, which lands in the Mailpit inbox published by the `mailpit` service (sign in there as `admin` with the Mailpit password). Paste the code, scan the QR with any authenticator app, confirm the six digits, and the account is protected. Next open the lldap service URL, sign in with the same credentials, and create the accounts your team will use — every user added there can sign in to Authelia at once. To check the deployment end to end, request `/.well-known/openid-configuration` on the Authelia domain: a JSON document naming the authorization and token endpoints means it is live.

![Authelia consent screen listing the permissions an application requested](https://res.cloudinary.com/rroe4rtk/image/upload/v1787749938/authelia-consent-request.png)
![Authelia settings showing a registered one-time password device](https://res.cloudinary.com/rroe4rtk/image/upload/v1787749942/authelia-two-factor-devices.png)
![lldap user directory listing two accounts with their email addresses](https://res.cloudinary.com/rroe4rtk/image/upload/v1787749946/authelia-lldap-directory.png)
![Mailpit inbox holding two Authelia account notification emails](https://res.cloudinary.com/rroe4rtk/image/upload/v1787749950/authelia-mailpit-inbox.png)

## About Hosting Authelia

Authelia solves the problem of every self-hosted tool having its own login form. It answers one question — is this person allowed in, and have they proved it twice — then hands the answer over through OpenID Connect or a reverse proxy's forward-auth hook. Self-host it when you want SSO you control, or when per-user pricing is out of proportion to a small team.

- One sign-in portal with password policy enforcement and brute-force regulation
- Second factors: TOTP apps, WebAuthn security keys and passkeys, Duo push
- A full OpenID Connect 1.0 provider with consent screens, refresh tokens and group claims
- Forward-auth endpoints for NGINX, Traefik, Caddy, HAProxy and Envoy
- Access rules by domain, path, user, group and network, and email-verified password reset

The Railway architecture splits those responsibilities across small services. Authelia keeps only its OpenID Connect signing key on a volume. lldap is the directory — LDAP on the private network, an admin UI for you. PostgreSQL holds encrypted TOTP secrets, WebAuthn credentials, OAuth 2.0 grants and the audit log. Redis holds sessions so they survive deployments. Mailpit captures outbound mail; repoint the SMTP variables at a real provider when you go live.

## Why Deploy Authelia on Railway

Railway removes the setup work around a self-hosted identity provider.

- Private networking between portal, directory, database and cache
- Managed PostgreSQL and Redis, no tuning required
- HTTPS and certificates for every service domain
- Volumes so signing keys and accounts survive redeploys
- One-click redeploys when a new Authelia release ships

## Common Use Cases

- A single sign-on portal in front of internal dashboards, wikis and admin panels
- OpenID Connect login for Grafana, Proxmox, Nextcloud, Portainer or your own app
- Mandatory two-factor authentication on everything a small team touches
- A private user directory for staff and contractors, with no cloud provider

## Dependencies for Authelia

- **Authelia** — the `gridalpha/authelia-railway` repository, built on `authelia/authelia:latest`
- **lldap** — `lldap/lldap:stable`, the LDAP directory and its admin UI
- **PostgreSQL** and **Redis** — Railway managed: two-factor and OAuth 2.0 state, and the session store
- **Mailpit** — `axllent/mailpit:latest`, SMTP sink for codes and notifications

### Environment Variables Reference

| Variable | Service | Purpose |
|---|---|---|
| `LLDAP_LDAP_USER_PASS` | lldap | Admin password, and the first Authelia login |
| `SESSION_SECRET` | authelia | Encrypts session data held in Redis |
| `STORAGE_ENCRYPTION_KEY` | authelia | Encrypts secrets at rest; never change it |
| `SESSION_COOKIE_DOMAIN` | authelia | Your registrable domain, for forward auth |
| `OIDC_CLIENT_ID` | authelia | Setting it registers an OpenID Connect client |
| `SMTP_HOST` | authelia | Mail host; use a real relay in production |

### Deployment Dependencies

- [Authelia documentation](https://www.authelia.com/) and [source](https://github.com/authelia/authelia)
- [authelia/authelia on Docker Hub](https://hub.docker.com/r/authelia/authelia)
- [lldap on GitHub](https://github.com/lldap/lldap)

## Hardware Requirements for Self-Hosting Authelia

| Resource | Minimum | Recommended |
|---|---|---|
| CPU | 0.5 vCPU | 1 vCPU |
| RAM | 256 MB across all services | 1 GB |
| Storage | 1 GB | 5 GB |
| Runtime | Docker, one Go binary | Docker, PostgreSQL and Redis |

Authelia idles at roughly 30 MB of RAM, which is why it is chosen over heavier identity providers; PostgreSQL and Redis are most of the footprint.

## Self-Hosting Authelia with Docker

Outside Railway, Authelia reads a YAML configuration file. A minimal run mounts a config directory and publishes the portal port:

```
docker run -d --name authelia \
  -v $(pwd)/config:/config \
  -p 9091:9091 \
  authelia/authelia:latest
```

Two values in that file cannot be typed by hand. Generate the signing key and hash a client secret with Authelia's own CLI first:

```
docker run --rm -v $(pwd)/config:/config authelia/authelia:latest \
  authelia crypto pair rsa generate --directory /config/oidc
docker run --rm authelia/authelia:latest \
  authelia crypto hash generate pbkdf2 --variant sha512 --password 'your-client-secret'
```

The Railway template does both on first boot and keeps the key on a volume, so issued tokens stay valid across redeploys.

## How Much Does Authelia Cost to Self-Host?

Authelia is free and open source under the Apache 2.0 licence: no paid tier, no seat limits, no enterprise edition holding features back — every protocol and second-factor method is in the one build. lldap and Mailpit are likewise free. On Railway you pay only for the compute, memory and storage the five services use, a few dollars a month for a small team.

## Authelia vs Authentik vs Keycloak

| | Authelia | Authentik | Keycloak |
|---|---|---|---|
| Footprint | ~30 MB RAM | ~300 MB RAM | 400 MB–2 GB |
| Config | YAML and env vars | Admin UI, visual flows | Admin UI, heavy |
| Protocols | OIDC, forward auth | OIDC, SAML, LDAP | OIDC, SAML |
| Best for | Lightweight SSO and 2FA | A full identity provider | Enterprise |

Pick Authelia for SSO and strong 2FA without running an identity platform; pick Authentik or Keycloak when SAML or complex enrolment flows are non-negotiable.

## FAQ

**What is Authelia?**
An open-source authentication and authorization server providing single sign-on, two-factor authentication and an OpenID Connect provider for self-hosted applications.

**Why does the template include PostgreSQL and Redis?**
Authelia's documentation treats file storage as suitable only for lightweight installs. PostgreSQL holds encrypted second-factor secrets, OAuth 2.0 grants and the audit log; Redis keeps sessions outside the container, so a redeploy does not log everyone out.

**How do I add users to self-hosted Authelia?**
Open the lldap service URL, sign in as admin, and create users there. Authelia reads the directory over LDAP, so new accounts sign in straight away, and groups become `groups` claims in OpenID Connect tokens.

**How do I connect an application to Authelia with OpenID Connect?**
Set `OIDC_CLIENT_ID`, `OIDC_CLIENT_SECRET` and `OIDC_CLIENT_REDIRECT_URIS` on the Authelia service, then point the application at `https:///.well-known/openid-configuration`. Authelia hashes the secret itself, so supply the plaintext value the application will send.

**Can I use Authelia's forward auth with Railway domains?**
Forward auth needs the portal and the protected app to share one registrable domain, so attach a custom domain — `auth.example.com` in front of `app.example.com` — and set `SESSION_COOKIE_DOMAIN` and `PROTECTED_DOMAINS`. OpenID Connect needs none of that and works across separate domains.

**How do I send real email instead of using Mailpit?**
Point `SMTP_HOST`, `SMTP_PORT`, `SMTP_USERNAME` and `SMTP_PASSWORD` at your provider and set `SMTP_SENDER` to an address it accepts. Email matters here: registering a second factor requires a one-time code.


## Similar templates

- [Keycloak](https://railway.com/deploy/mSwigX) — Keycloak template with keywind theme + apple and discord providers
- [lua-protector](https://railway.com/deploy/lua-protector) — Test deployed my project first
- [bknd](https://railway.com/deploy/p4nTYL) — Feature-rich yet lightweight backend

Open this page in a browser: https://railway.com/deploy/authelia-sso