Authelia

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Authelia. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of t3.small or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet. Create or select a security group that opens port 22 from your management network and ports 80 and 443 for the portal. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialisation takes a few seconds after the instance state becomes Running and the status checks pass.

The following command launches an instance from the SecureAnyCloud Authelia Marketplace AMI into an existing subnet and security group.

Replace <ami-id> with the AMI ID shown on the Marketplace listing and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID and <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.small \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=authelia}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name. You can find both in the EC2 console or with aws ec2 describe-instances.

Connect over SSH with your key pair. The login user for the Ubuntu 24.04 variant is ubuntu.

ssh -i <key-name>.pem ubuntu@<public-ip>

The Authelia administrator password is unique to your instance and was generated on first boot. Read it as root:

sudo cat /root/authelia-credentials.txt

The file lists the portal URL, the demo application URL, the admin user (admin) and the generated password. It also includes the one line to add to your workstation hosts file to reach the demo. Keep the password somewhere safe.

Over SSH, confirm that the Authelia server and the nginx proxy are active:

sudo systemctl is-active authelia nginx

Both services report active:

active active

Authelia binds to loopback only, so its health endpoint is reachable only from the instance, over plain HTTP on port 9091:

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1:9091/api/health

HTTP 200

Check the installed version:

authelia --version

authelia version v4.39.20

The appliance uses the self-contained demo domain authelia.local, so you must point the demo names at the instance from your own machine.

Add the following line to your workstation hosts file, for example /etc/hosts on Linux or macOS, or C:\Windows\System32\drivers\etc\hosts on Windows. Replace <instance-public-ip> with your instance's public IP address:

<instance-public-ip> authelia.local secure.authelia.local

Browse to the Authelia portal:

https://authelia.local/

The demo certificate is self-signed, so your browser shows a certificate warning the first time. This is expected for the demo. Accept the warning to continue. You replace the certificate with a real one for production in Step 10.

The Authelia sign-in portal opens. Sign in as admin with the password from the credentials file.

The image ships a demo protected application at https://secure.authelia.local/secure. Authelia guards it through the standard nginx forward-authentication integration.

When nginx receives a request for the protected resource, it issues an internal subrequest to Authelia's /api/authz/auth-request endpoint. If you are not authenticated, Authelia returns a redirect, and nginx sends your browser to the portal with the original URL preserved as the rd= return target. Once you have signed in, the same subrequest is approved and nginx serves the page.

Browse to the protected application:

https://secure.authelia.local/secure

If you are not yet signed in, you are redirected to the Authelia portal. After you sign in with the admin credentials, you are returned to the protected page. This confirms that Authelia authenticated and authorized the request.

Users live in the file authentication backend at /etc/authelia/users_database.yml, with argon2id-hashed passwords. Generate a hash for a new user's password with the Authelia CLI:

authelia crypto hash generate argon2 --password 'choose-a-strong-password'

Copy the printed Digest: value. Add a new entry under users: in /etc/authelia/users_database.yml, for example:

users: alice: disabled: false displayname: 'Alice Smith' password: '<paste-the-argon2id-digest-here>' email: 'alice@example.com' groups: - 'users'

Authelia watches the user database and picks up changes automatically. To be sure, you can also restart the service:

sudo systemctl restart authelia

To bring your own application under single sign-on, add it as a reverse-proxied site in nginx with the same auth_request block the demo uses (see /etc/nginx/sites-available/authelia).

Then add an access control rule for it in /etc/authelia/configuration.yml under access_control.rules. Each rule sets a policy of bypass, one_factor or two_factor per domain or path, for example:

access_control: default_policy: 'deny' rules: - domain: 'app.example.com' policy: 'one_factor'

After editing, reload nginx and restart Authelia:

sudo systemctl reload nginx
sudo systemctl restart authelia

For production, replace the demo domain and the self-signed certificate. Edit /etc/authelia/configuration.yml and set your own domain under session.cookies: the domain, authelia_url and default_redirection_url, all using https://. Add access_control rules for your applications.

Authelia requires the session URLs to use HTTPS, so you must serve the portal over TLS with a certificate for your domain.

The image generates a self-signed certificate at /etc/nginx/tls/authelia-selfsigned.crt and /etc/nginx/tls/authelia-selfsigned.key, and the nginx site references it. The bundled certificate covers the demo names:

sudo openssl x509 -in /etc/nginx/tls/authelia-selfsigned.crt -noout -subject -ext subjectAltName

subject=CN = authelia.local X509v3 Subject Alternative Name: DNS:authelia.local, DNS:secure.authelia.local

Replace it with a real certificate for your domain. The simplest approach is to obtain a certificate with Certbot for the public name you point at the instance. Then update the ssl_certificate and ssl_certificate_key paths in /etc/nginx/sites-available/authelia and reload nginx.

Alternatively, terminate TLS on an Application Load Balancer in front of the instance with an ACM certificate, and forward to nginx.

Restrict the security group so that ports 80 and 443 are reachable only from the networks that need the portal.

Authelia's identity state lives on a dedicated EBS volume mounted at /var/lib/authelia. It holds the SQLite storage database (db.sqlite3), the filesystem notifier output (notification.txt) and the per-instance generated secrets.

This keeps identity state off the operating system disk and lets you resize or snapshot it independently. Confirm the mount:

df -h /var/lib/authelia

Filesystem Size Used Avail Use% Mounted on /dev/nvme1n1 9.8G 312K 9.3G 1% /var/lib/authelia

To grow the store, expand the EBS volume in the AWS console. Then grow the filesystem on the instance with sudo resize2fs on the underlying device.

Back up Authelia's identity state by snapshotting the /var/lib/authelia EBS volume. The snapshot captures the user database state, the SQLite store and the secrets.

Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade, and reboot when a new kernel is installed. Authelia and nginx start automatically on boot.