{"id":1924,"date":"2026-09-05T10:23:17","date_gmt":"2026-09-05T04:53:17","guid":{"rendered":"https:\/\/cpanelfree.com\/blog\/how-to-setup-authelia-two-factor-sso-reverse-proxy-vps\/"},"modified":"2026-09-05T13:00:11","modified_gmt":"2026-09-05T07:30:11","slug":"how-to-setup-authelia-two-factor-sso-reverse-proxy-vps","status":"publish","type":"post","link":"https:\/\/cpanelfree.com\/blog\/how-to-setup-authelia-two-factor-sso-reverse-proxy-vps\/","title":{"rendered":"How to Set Up Authelia Single Sign-On (SSO) and 2FA with Nginx on Ubuntu VPS"},"content":{"rendered":"

Why Self-Hosted Web Portals Need Centralized Zero-Trust 2FA<\/h2>\n

As you self-host multiple internal web applications on your Linux VPS (such as Uptime Kuma, Glances, Portainer, MinIO Console, Traefik Dashboard, or phpMyAdmin), each platform features its own separate authentication mechanism\u2014or worse, lacks native Two-Factor Authentication (2FA) support. Managing fragmented passwords across dozens of admin dashboards creates immense security vulnerability.<\/p>\n

Authelia<\/strong> is an open-source, lightweight authentication and authorization server that integrates seamlessly with Nginx using the auth_request<\/code> forward-authentication module. Authelia acts as a fortress gatekeeper in front of all your subdomains: unauthenticated visitors are automatically redirected to a sleek Single Sign-On (SSO) portal requiring a primary password and secondary 2FA (TOTP authenticator app, WebAuthn YubiKey, or Duo push) before Nginx permits traffic through.<\/p>\n

In this cybersecurity tutorial, we will configure Authelia on Ubuntu 24.04\/22.04 LTS using Docker Compose, secure private subdomains via Nginx auth_request<\/code>, and configure TOTP Two-Factor Authentication.<\/p>\n

Step 1: Installing Docker and Creating Project Directory<\/h2>\n
# Install Docker and prerequisite utilities\nsudo apt update && sudo apt install -y curl nginx certbot python3-certbot-nginx\ncurl -fsSL https:\/\/get.docker.com | sudo sh\nsudo systemctl enable --now docker\n\n# Create project directory\nsudo mkdir -p \/var\/www\/authelia\nsudo chown -R $USER:$USER \/var\/www\/authelia\ncd \/var\/www\/authelia<\/code><\/pre>\n
Step 2: Writing Production Authelia Configuration<\/h2>\n
Create configuration directory and file \/var\/www\/authelia\/configuration.yml<\/code>:<\/p>\n
server:\n  host: 0.0.0.0\n  port: 9091\n\nlog:\n  level: info\n\njwt_secret: \"YourUltraSecureJwtSecretKeyAtLeast32Chars!\"\ndefault_redirection_url: \"https:\/\/auth.example.com\"\n\ntotp:\n  issuer: \"CpanelFree Cloud\"\n\nauthentication_backend:\n  file:\n    path: \/config\/users_database.yml\n\naccess_control:\n  default_policy: deny\n  rules:\n    # Require Two-Factor Authentication for all internal dashboards\n    - domain: \"*.example.com\"\n      policy: two_factor\n\nsession:\n  name: authelia_session\n  domain: example.com\n  secret: \"AnotherUltraSecureSessionSecretKey32Chars!\"\n  expiration: 3600 # 1 hour\n\nstorage:\n  local:\n    path: \/config\/db.sqlite3\n\nnotifier:\n  filesystem:\n    filename: \/config\/notification.txt<\/code><\/pre>\n
Step 3: Creating Users Database with Password Hashes<\/h2>\n
Generate a secure Argon2id password hash using Docker:<\/p>\n
# Generate Argon2 password hash\ndocker run authelia\/authelia:latest authelia crypto hash generate argon2 --password \"StrongUserPassword2026!\"<\/code><\/pre>\n
Create \/var\/www\/authelia\/users_database.yml<\/code>:<\/p>\n
users:\n  admin:\n    displayname: \"Administrator\"\n    password: \"$argon2id$v=19$m=65536,t=3,p=4$...\"\n    email: \"admin@example.com\"\n    groups:\n      - admins<\/code><\/pre>\n
Step 4: Launching Authelia Container Stack<\/h2>\n
Create \/var\/www\/authelia\/docker-compose.yml<\/code>:<\/p>\n
services:\n  authelia:\n    image: authelia\/authelia:latest\n    container_name: authelia_sso\n    restart: always\n    ports:\n      - \"127.0.0.1:9091:9091\"\n    volumes:\n      - .\/:\/config\n    deploy:\n      resources:\n        limits:\n          memory: 256M<\/code><\/pre>\n
Launch the container: docker compose up -d<\/code>.<\/p>\n
Step 5: Nginx Forward-Auth Integration & Subdomain Protection<\/h2>\n
Create the universal Authelia forward-auth snippet at \/etc\/nginx\/snippets\/authelia.conf<\/code>:<\/p>\n
location \/authelia {\n    internal;\n    proxy_pass http:\/\/127.0.0.1:9091\/api\/verify;\n    proxy_pass_request_body off;\n    proxy_set_header Content-Length \"\";\n    proxy_set_header X-Original-URL $scheme:\/\/$http_host$request_uri;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n}<\/code><\/pre>\n
Now, protect ANY internal subdomain (e.g. status.example.com<\/code> or monitor.example.com<\/code>) by adding two lines:<\/p>\n
server {\n    listen 80;\n    server_name status.example.com;\n\n    # Include Authelia 2FA gatekeeper\n    include snippets\/authelia.conf;\n    auth_request \/authelia;\n\n    error_page 401 =302 https:\/\/auth.example.com\/?rd=$scheme:\/\/$http_host$request_uri;\n\n    location \/ {\n        proxy_pass http:\/\/127.0.0.1:3001;\n    }\n}<\/code><\/pre>\n
Integrating Duo Push & WebAuthn YubiKey Hardware Keys<\/h2>\n
Authelia natively supports FIDO2 WebAuthn cryptographic hardware security keys (YubiKey, Google Titan) and Duo mobile push notifications for enterprise Two-Factor Authentication. Users can register their biometric TouchID, Windows Hello, or YubiKey directly within the Authelia self-service security portal.<\/p>\n
Enforcing Granular Access Control Policies by User Group<\/h2>\n
Define role-based access rules in \/var\/www\/authelia\/configuration.yml<\/code> so that only members of the admins<\/code> group can access critical monitoring and database dashboards, while standard users access general internal tools with single-factor authentication:<\/p>\n
access_control:\n  default_policy: deny\n  rules:\n    # Restrict server monitoring dashboards to admins group only\n    - domain: \"monitor.example.com\"\n      subject: \"group:admins\"\n      policy: two_factor\n\n    # Allow general staff to access status portals with single-factor\n    - domain: \"status.example.com\"\n      subject: \"group:staff\"\n      policy: one_factor<\/code><\/pre>\n
Enforcing OpenID Connect (OIDC) Identity Provider (IdP)<\/h2>\n
Authelia can function as a full OpenID Connect (OIDC) Identity Provider, allowing third-party applications (such as Grafana, Nextcloud, Forgejo, or Portainer) to delegate authentication to Authelia using OAuth2 tokens:<\/p>\n
# Enable OpenID Connect in \/var\/www\/authelia\/configuration.yml\nidentity_providers:\n  oidc:\n    hmac_secret: \"YourUltraSecureOidcHmacSecretKey32Chars!\"\n    issuer_private_key: |\n      -----BEGIN RSA PRIVATE KEY-----\n      ...\n      -----END RSA PRIVATE KEY-----\n    clients:\n      - client_id: \"grafana\"\n        client_name: \"Grafana Monitoring Dashboard\"\n        client_secret: \"$argon2id$v=19$m=65536,t=3,p=4$...\"\n        public: false\n        authorization_policy: \"two_factor\"\n        redirect_uris:\n          - \"https:\/\/monitor.example.com\/login\/generic_oauth\"\n        scopes:\n          - \"openid\"\n          - \"profile\"\n          - \"email\"\n          - \"groups\"<\/code><\/pre>\n
Authelia Security Hardening Checklist<\/h2>\n