this post was submitted on 07 Jul 2026
56 points (93.8% liked)

Selfhosted

60589 readers
1413 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
56
How to Setup Authelia in Docker with SWAG Reverse Proxy (2026) (corelab.tech)
submitted 4 days ago by CoreLabJoe@piefed.ca to c/selfhosted@lemmy.world
13 comments fedilink hide all child comments
 

SbTEwwlrjN5y7jq.webp

How Authelia Performs Multi-Factor Authentication

Authelia sits between your reverse proxy and the apps behind it, intercepting requests and performing auth checks before forwarding traffic, giving you true MFA that can be integrated with something like Google Authenticator, or Yubikey/Titan key, etc...

Stop exposing unsecured apps. Learn how to deploy Authelia in Docker with a KeyDB backend and SWAG to enforce centralized Multi-Factor Authentication.

Setting up Authelia can be a bit intensive at first, but very worth the payoff / time and effort!

Disclaimers: I'm the author & run this exact setup, in production for myself. It's a "battle tested" setup, which has been in use for a few years now. Written & verified by a human! The header image is a composite of my Authelia MFA token page & AI generated infographic. NO ADS or affiliate marketing on page!

Happy to chat in the comments!

all 14 comments
sorted by: hot top controversial new old
[–] motruck@lemmy.zip 1 points 1 day ago (1 children)

SWAG. SWAG. SWAG.

Apparently it is just a customized nginx set up.

[–] CoreLabJoe@piefed.ca 1 points 1 day ago

If you knew what was under the hood you would not say it's "just" customized nginx... It's more like customised, optimized and simplified.

It has many enhancements builtin like automatic certificate generation and renewal, fail2ban, prebuilt optimized configs, and easily enhanced security with crowdsec and even geofencing.

But made way easier than doing that separately with raw NGINX.

It's much more friendly to pickup and run with then raw NGINX.

[–] gajahmada@awful.systems 2 points 3 days ago* (last edited 3 days ago) (1 children)

Oh, you're actually that corelab. I use your Vaulwarden guide as reference when I rebuild a while ago. Thanks for the write up !

Though, I wish you have something for Traefik and I know you wrote about why you chose SWAG but mine's all docker anyway that's why I go with Traefik.

There's not many articles talking about TF with multiple host without going full Kubernetes. Looking up forward auth (for something without native OIDC) is confusing af.

[–] CoreLabJoe@piefed.ca 2 points 2 days ago* (last edited 2 days ago)

Well hello there!

Yes, the one and only Core Lab Joe, in the digital flesh (packets, tcp-stream!). Thanks for reading and I'm glad it helped you!

I'm picky when writing tech guides and generally will only write (and recommend!) what I run, and what I have experience with, so that would not be traefik.

My entire system/setup is all dockerized as well. I run 50+ dockers, and anything publicly exposed goes through my SWAG instance. It doesn't matter what reverse proxy you use, or even if the apps are containers or not really, it's all networking.

That said I've got a good Traefik resource for you, FoxxMD Blog and his migrating from SWAG to Traefik post!

One of the things I need to tackle fully myself, understand, break, troubleshoot and then fix is OIDC for myself, so I can write a good guide on it. A lot of apps do natively do it now, but from what I understand for those that do not, you can use Authelia and the like to slap that authentication into (over top) of it.

[–] KairuByte@lemmy.dbzer0.com 1 points 3 days ago

Honestly, the one major thing I want from Authelia is the ability to add to it without deauthenticating the entire userbase.

Well, that and an easier way to organize than everything in one single file…

[–] irmadlad@lemmy.world 5 points 4 days ago (1 children)

Very nice site set up man. Looks like a lot of good info and a lot of work involved. I too use Authelia as an added security step. I have your site bookmarked and will peruse it's contents in a bit. Thanks for sharing.

[–] CoreLabJoe@piefed.ca 3 points 4 days ago (1 children)

Thank you for taking a peek!

Let me know if there's something you're looking for. The search function isn't to bad but sometimes the posts can get buried a bit ;)

[–] irmadlad@lemmy.world 1 points 4 days ago

You bet. So far, it's an enjoyable read.

[–] altphoto@lemmy.today 1 points 3 days ago (1 children)

Is rayfish compatible with Authelia or Yggdrasil?

[–] CoreLabJoe@piefed.ca 2 points 3 days ago

Never heard of Rayfish but just googled, it's a mesh VPN so probably wouldn't want to push that through a reverse proxy to authelia, it would just slow it down....

I personally use wireguard as my VPN, not tailscale or headscale or any of that but I do understand some people need something that can get around CGNAT or other issues.