# Deploy Authelia with Easypanel

URL: /templates/authelia

Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for your applications via a web portal. It acts as a companion to reverse proxies such as Traefik, Nginx, or Caddy to control whether requests should pass through. Authelia is also an OpenID Connect 1.0 certified identity provider, enabling modern authentication flows for applications that support it. Key features include multi-factor authentication via TOTP, WebAuthn, or Duo; fine-grained access control rules; session management with configurable timeouts; LDAP and file-based user backends; and SQLite, PostgreSQL, or MariaDB storage.

## Installation notes

After deployment, open the Authelia URL you configured. Log in with username "admin" and the password you set during setup. On first login you will be prompted to register a TOTP authenticator app. The "Authelia URL" field must exactly match the full HTTPS URL you use to reach Authelia (e.g. https://auth.yourdomain.com) — a mismatch causes the "issue retrieving user state" error. Password reset notifications are written to /data/notification.txt inside the container; view them via the Easypanel console if no SMTP is configured.

## Benefits

### Multi-Factor Authentication

Add TOTP, WebAuthn (passkeys and hardware keys), and Duo push notifications on top of any password-based login, without modifying the protected application.

### Single Sign-On

One login session covers all protected apps. Users authenticate once and are silently passed through to every service on your domain without re-entering credentials.

### OpenID Connect Identity Provider

Act as an OIDC provider for any application that supports it, enabling centralised identity management and delegated login flows across your entire infrastructure.

## Features

### Reverse Proxy Integration

Works natively with Traefik, Nginx, Caddy, HAProxy, and more via forward authentication headers — no agents or sidecar containers required.

### Fine-Grained Access Control

Define rules by domain, path, method, user, group, and network to allow, bypass, or require one- or two-factor authentication per resource.

### File and LDAP User Backends

Manage users with a simple YAML file for small deployments or connect to an LDAP or Active Directory server for enterprise-scale user management.

### SQLite Storage

Stores all persistent state — TOTP secrets, WebAuthn credentials, session records — in a local SQLite database with no external DB required.

### Regulation and Brute-Force Protection

Automatically bans accounts and IPs after configurable failed-attempt thresholds, protecting against credential-stuffing and brute-force attacks.

## Configuration

- `appServiceName` (App Service Name, required): authelia

- `appServiceImage` (App Service Image, required): authelia/authelia:4.39.20

- `adminPassword` (Admin Password, required): Set during installation — Password for the initial "admin" user account.

## Services

- authelia: app (authelia/authelia:4.39.20)

## Resources

- [Website](https://www.authelia.com)

- [Documentation](https://www.authelia.com/configuration/prologue/introduction/)

- [GitHub](https://github.com/authelia/authelia)

- [Template source](https://github.com/easypanel-io/templates/tree/main/templates/authelia)