I’ve got 2 hosts. A slightly more powerful sff tower running my media stuff and arr services. VPN gateway that the arr’s route through etc. I have a raspberry pi that’s running my Adblocker, reverse proxy, Wireguard some stuff for a small business I run… So a website platform and invoice/time logging system.
Anyway these various services are mostly secured by password. Only the website is accessible externally. Any other service is only accessible internally or via Wireguard VPN.
Just at that stage asking myself “where do I draw the line?”
Would be nice to centrally manage logins but I suspect the mismash of services I run wont all support SSO.
I think In today it must be near 25-30 services / containers.
Authentik looks good. But wondering whether it’s just going to be something I only use a fraction of and “a bit overkill” for my needs?
You must log in or register to comment.
I do run Authentik and even for applications I don’t expose to the internet, for the sole reason of multiple accounts. I have friends who use my server so it’s not just a single user environment. Thus, complete control of authentication is a must for me. Might be worth considering if this might apply to you too!
I use Authentik exclusively for Immich and I have no regrets. The application is wonderful and I can use for other things if needed.
Immich is the only service that I host and expose that contains important data, so having the SSO (which I also have 2FA) already adds a lot of comfort to my mind.
The whole point of a homelab is traditionally overkill, so I don’t think there is such a line :)
I think it depends on your use case.
If you live alone, or maybe with one other person, the people staying at your house don’t change, then why bother with SSO?
If you’re like me, have 4 people living in the house, 2 are lodgers, sometimes people come and stay for a while and need home assistant access, different people need different privileges, you need to provision wireguard for everyone, etc.
Too much for a home lab?
Is this a challenge? People here have better equipment at home than my isp does. Don’t challenge this sub lol
I was actually looking at Keycloak myself due to needing something more “professional looking” and something more “enterprise-y” which translates to our security guy hearing more about keycloak than authentik. They all should work somewhat the same though, and have the same end functionality.
I’m not sure of the technical stuff, but I believe you could use something like Oauth2 Proxy in front of your services, but that may or may not be more trouble than it’s worth, assuming it works the way I think it does. I could be wrong.