One login that knows every app
Authentik is the homelab’s central identity. Apps integrate in two ways: OIDC when they speak it natively, or ForwardAuth when the reverse proxy should gate them. High-value apps use both.
OIDC (Pattern A)
The app speaks OpenID Connect directly to Authentik: login redirect, token exchange, done. Includes user and group sync — roles can be derived from Authentik groups.
ForwardAuth (Pattern B)
For apps with weak or no native login, Traefik checks with Authentik before every request. Only a valid session gets forwarded — otherwise a redirect to the login.
Both combined (Pattern C)
Defense in depth: ForwardAuth as the outer perimeter plus native OIDC for clean identity inside the app. An existing session passes through both — login feels like one click.
Passwordless with passkeys
Sign-in needs no password: a passkey, unlocked by fingerprint or face recognition on your own device. A passkey is bound to the genuine login page — a cloned phishing page cannot capture it, and there is no password to steal or reuse. A reputation rule additionally slows down suspicious sign-in attempts.
Groups instead of per-app rights
Who may access what is decided by group membership in Authentik — one source of truth, no per-app user sprawl.