authelia Docker & Self-Hosted Deployment

GitHub

The Single Sign-On Multi-Factor portal for web apps, now OpenID Certified™

28,547 stars Go Go 1 file · ~34,077 tokens #2fa#authentication#docker#golang#kubernetes#ldap#mfa#multifactor
RAW Compose
1. Pull Image (DOCKERHUB) docker pull authelia/authelia
2. Docker Run (1-Click Launch) docker run -d --name authelia -p 80:80 --restart always authelia/authelia
3. Podman Run podman run -d --name authelia -p 80:80 --restart always authelia/authelia
4. Skopeo Inspect (Zero-Pull Manifest) skopeo inspect docker://docker.io/authelia/authelia:latest
5. ORAS Pull (OCI Artifact) oras pull authelia/authelia
6. Compose Deployment docker compose up -d
examples/compose/production/compose.yml
Download .yml 
# SPDX-FileCopyrightText: 2026 Authelia
#
# SPDX-License-Identifier: Apache-2.0

---
networks:
  net:
    driver: 'bridge'

services:
  authelia:
    image: 'authelia/authelia'
    container_name: 'authelia'
    volumes:
      - './authelia:/config'
    networks:
      net: {}
    labels:
      traefik.enable: 'true'
      traefik.http.routers.authelia.rule: 'Host(`authelia.example.com`)'
      traefik.http.routers.authelia.entrypoints: 'https'
      traefik.http.routers.authelia.tls: 'true'
      traefik.http.routers.authelia.tls.options: 'default'
      traefik.http.middlewares.authelia.forwardAuth.address: 'http://authelia:9091/api/authz/forward-auth'  # yamllint disable-line rule:line-length
      traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader: 'true'
      traefik.http.middlewares.authelia.forwardAuth.maxResponseBodySize: '8192'
      traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders: 'Remote-User,Remote-Groups,Remote-Name,Remote-Email'  # yamllint disable-line rule:line-length
    restart: 'unless-stopped'
    healthcheck:
      ## In production the healthcheck section should be commented.
      disable: true
    environment:
      TZ: 'Australia/Melbourne'

  traefik:
    image: 'traefik:v3.6.13'
    container_name: 'traefik'
    volumes:
      - './traefik:/etc/traefik'
      - '/var/run/docker.sock:/var/run/docker.sock'
    networks:
      net: {}
    labels:
      traefik.enable: 'true'
      traefik.http.routers.api.rule: 'Host(`traefik.example.com`)'
      traefik.http.routers.api.entrypoints: 'https'
      traefik.http.routers.api.service: 'api@internal'
      traefik.http.routers.api.tls: 'true'
      traefik.http.routers.api.tls.options: 'default'
      traefik.http.routers.api.middlewares: 'authelia@docker'
    ports:
      - '80:80'
      - '443:443'
    command:
      - '--api'
      - '--providers.docker=true'
      - '--providers.docker.exposedByDefault=false'
      - '--providers.file.filename=/etc/traefik/certificates.yml'
      - '--entrypoints.http=true'
      - '--entrypoints.http.address=:80'
      - '--entrypoints.http.http.redirections.entrypoint.to=https'
      - '--entrypoints.http.http.redirections.entrypoint.scheme=https'
      - '--entrypoints.https=true'
      - '--entrypoints.https.address=:443'
      - '--log=true'
      - '--log.level=DEBUG'

  secure:
    image: 'traefik/whoami'
    container_name: 'secure'
    networks:
      net: {}
    labels:
      traefik.enable: 'true'
      traefik.http.routers.secure.rule: 'Host(`secure.example.com`)'
      traefik.http.routers.secure.entrypoints: 'https'
      traefik.http.routers.secure.tls: 'true'
      traefik.http.routers.secure.tls.options: 'default'
      traefik.http.routers.secure.middlewares: 'authelia@docker'
    restart: 'unless-stopped'

  public:
    image: 'traefik/whoami'
    container_name: 'public'
    networks:
      net: {}
    labels:
      traefik.enable: 'true'
      traefik.http.routers.public.rule: 'Host(`public.example.com`)'
      traefik.http.routers.public.entrypoints: 'https'
      traefik.http.routers.public.tls: 'true'
      traefik.http.routers.public.tls.options: 'default'
      traefik.http.routers.public.middlewares: 'authelia@docker'
    restart: 'unless-stopped'
...