Authelia

Authelia sits behind nginx, Traefik or Caddy and adds a login portal, two-factor authentication and per-path access rules to services that have weak or no auth of their own. Configuration is a YAML file, resource use is tiny, and it now speaks OIDC as a provider too.

It is leaner than Authentik by design: fewer features, fewer moving parts, and a config-file-first philosophy that suits infrastructure-as-code setups. User management is basic (a YAML backend or LDAP).

The right shape for protecting a stack of homelab apps behind one portal without running a full IdP platform.