Should Authentik sit in front of every homelab app, or only the ones guests open?

Only the ones a guest’s browser can open, plus any app whose own login is a shared password you are tired of trusting. Authentik should not sit in front of every container. Vaultwarden, Home Assistant’s mobile app, Jellyfin’s TV clients, and anything you reach only over Tailscale already have a door. A second door in front of all of them means those apps die when Authentik dies, and several of them cannot complete the extra login anyway.

Authentik is a login wall you add at the proxy: Caddy or Traefik forward-auth, an outpost, a redirect to Authentik, then back to the app. That is a browser flow. Guests have browsers. Phone apps, set-top boxes, and password-manager extensions often do not. Put the wall where the guest is. Leave the rest on the tailnet with the login the app already has.

What the wall is actually for

A guest on your Wi-Fi, or a sibling who should see photos and not Portainer, is the user Authentik is good at. The app behind it might be Immich’s public-ish share, a file drop, Grafana, a wiki, Paperless for the household, or Homepage itself if you insisted on publishing it. Those are browsers, they survive a redirect, and they often ship with one password everyone knows. Authentik replaces that shared password with a user you can revoke when the visit is over. That is the whole product for a flat.

Forward-auth does not make the app safer against the person who already has a shell on the server. It does not replace Tailscale ACLs. If the app is bound to the tailnet and has no public port, a stranger on the internet cannot open it, Authentik or not. The people who can open it are the people on the tailnet. If that list is you and one partner, a second login is ceremony. Ceremony is fine until Authentik’s database breaks and you cannot reach the app you were trying to fix.

The apps with no login at all are the other yes. A stats page, an old download client, a dashboard someone published on a hostname because the tutorial said to. Those should not be on a public hostname at all. If they must be reachable from a browser that is not yours, Authentik is the least-bad bolt-on. If they are tailnet-only, closing the public hostname is the fix, and Authentik is optional polish.

What breaks when everything is behind it

Home Assistant’s companion app wants its own login and a websocket that stays up. An auth redirect in the middle drops the websocket, breaks notifications, and produces a login loop the app cannot show you. Jellyfin on a TV, a Roku, or a phone app authenticates to Jellyfin, not to your proxy. The app never sees the Authentik page. It just fails. Vaultwarden is the one I would refuse outright. The browser extension and the phone app talk to the server with their own token. A forward-auth wall in front of the vault means you can lock yourself out of the passwords, including the password for Authentik. The vault stays on the tailnet, with Vaultwarden’s own login, and it does not sit behind a second one.

MQTT, a Zigbee coordinator’s web UI on a non-standard port, Syncthing, and a backup job’s endpoint are not browsers. Proxy auth does not apply cleanly, and forcing them through Caddy so Authentik can “cover everything” is how a sensor network depends on an identity provider. Leave them on localhost or on the tailnet. Identity for a broker is a username on the broker.

Single sign-on is also a single point of failure. If every app redirects to Authentik and Authentik is down, the apps can be healthy and still unreachable. That includes the proxy admin if you were clever enough to put the proxy admin behind the same wall. Keep one path that does not depend on it: SSH on the tailnet, or the app’s own local login on a hostname Authentik does not guard. Test that path before you need it. The test is stopping the Authentik container at lunch, not reading the docs.

Guests, and the apps that are actually for them

List the hostnames a guest has ever opened. That list is the Authentik list. In this flat it is usually short: photos, a movie app in a browser, maybe the printer, maybe a shared notes page. The movie app is the awkward one, because the TV client will not do the redirect and the browser will. Split them. Browser hostname behind Authentik. TV client on the tailnet, or a Jellyfin user that is not an admin, with no proxy wall. Two doors for one app is allowed. One door for every app is the mistake.

Revocation is the feature you are buying. A guest account you can disable on Sunday night is worth more than a perfect policy. If you cannot name the guest, you do not need the wall yet. Tailscale’s ability to remove a device is the revocation for people who were given a tailnet login. Authentik is the revocation for people who were only ever given a link. Do not give guests a tailnet login “so you can skip Authentik” unless you want them on the same network as Portainer. A link plus Authentik is the smaller gift.

Embedded auth still matters behind the wall. Authentik in front of an app that has no login means anyone who bypasses the proxy, from another container on the docker network, is in. Forward-auth is not a firewall between containers. Leave the app’s own login on if it has one, even when Authentik is in front, unless that double prompt makes the guest give up. For a wiki, the double prompt is annoying and I still keep it. For a one-weekend file drop, Authentik alone is the point, and the drop goes away on Monday.

Who should skip it

Skip Authentik if you are the only user, every app is on Tailscale, and each one has a login you are willing to type. You would be operating an identity provider for an audience of one, and you would be adding an outage mode you do not have today. Skip it for the vault, the home-automation app, and the TV apps even if you install it for other things. Skip it as a badge of a serious homelab. Serious is being able to get in when the badge is down.

Install it when a guest needs a browser link and the app’s own password would otherwise be your password. Put only those hostnames behind the outpost. Write down the one URL that still opens when Authentik is stopped. If you cannot, you have already put it in front of too much, and the next update will be the evening you prove it.