services:
authelia:
image: docker.io/authelia/authelia:latest
restart: unless-stopped
environment:
AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE: /secrets/JWT_SECRET
AUTHELIA_SESSION_SECRET_FILE: /secrets/SESSION_SECRET
AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE: /secrets/STORAGE_PASSWORD
AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: /secrets/STORAGE_ENCRYPTION_KEY
volumes:
- ./data/authelia/config:/config
- ./data/authelia/secrets:/secrets:ro
# Adapt the official example to your reverse-proxy network and pin a release tag.
Resource use depends on authentication traffic and the selected storage and session backends; validate capacity in the deployment environment.
DEPENDENCIES
Requires a supported reverse proxy. Configure a file or LDAP user backend, a notifier, and SQLite, MySQL, or PostgreSQL storage; Redis is optional for persistent or distributed sessions.
AUTHENTICATION
Provides password authentication, TOTP and WebAuthn second factors, access-control policies, forward-auth integrations, and an OpenID Connect 1.0 provider.
BACKUP NOTES
Back up configuration, file-backed secrets—especially the storage encryption key—and the selected storage database together. Include Redis only when session continuity must survive recovery.
LIMITATIONS
Designed for applications behind a supported reverse proxy or applications using its OpenID Connect provider; deployment requires careful domain, cookie, secret, storage, and notifier configuration.
TRADE-OFFS
Centralized access control and MFA add a dedicated identity component, several critical secrets, and recovery-sensitive configuration.