Identity and access, checked 2026-10-17
Authelia: Docker configuration reference
Self-hosted forward-auth server adding single sign-on and two-factor authentication in front of a reverse proxy.
At a glance
- Image:
docker.io/authelia/authelia - Tags:
4.39,4.39.28,4.39.27,4.39.26,4.39.25 - Licence: Apache-2.0
- Source: https://github.com/authelia/authelia
- Docs: https://www.authelia.com/overview/prologue/introduction/
Ports
| Port | What listens | Source |
|---|---|---|
9091 | HTTP listener serving the login portal and the /api/authz endpoints the proxy calls for forward auth. | source for port 9091 |
Environment variables
| Variable | Required | What it does | Example | Source |
|---|---|---|---|---|
AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET | Yes | Signs the password reset identity verification JWT. Replaces the jwt_secret key deprecated in 4.38. Set via the _FILE variant with a Docker secret rather than inline. | openssl rand -hex 64 | source for AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET |
AUTHELIA_SESSION_SECRET | Yes | Encrypts session data in Redis when a Redis session store is configured. | openssl rand -hex 64 | source for AUTHELIA_SESSION_SECRET |
AUTHELIA_STORAGE_ENCRYPTION_KEY | Yes | Encrypts sensitive values at rest in the configured storage backend (SQLite, PostgreSQL or MySQL). | openssl rand -hex 64 | source for AUTHELIA_STORAGE_ENCRYPTION_KEY |
TZ | No | Container timezone. The bundled compose example sets it explicitly rather than relying on the image default. | Australia/Melbourne | source for TZ |
Volumes that must persist
| Path | What is in it | Source |
|---|---|---|
/config | configuration.yml plus the SQLite database when no external database is configured. This is the state to back up. | source for /config |
Behind a reverse proxy
- The proxy calls Authelia's forward-auth endpoint on every request, e.g. http://authelia:9091/api/authz/forward-auth for the ForwardAuth implementation named in server.endpoints.authz. source for this reverse-proxy note
- Authelia ships four authz endpoint implementations: ForwardAuth, ExtAuthz, AuthRequest and Legacy. Traefik uses ForwardAuth, Envoy uses ExtAuthz, nginx typically uses AuthRequest. source for this reverse-proxy note
- The proxy must forward the authentication response headers back to the upstream app, commonly Remote-User, Remote-Groups, Remote-Name and Remote-Email. source for this reverse-proxy note
- trustForwardHeader must be enabled on the proxy's forward-auth middleware so client IPs are read correctly rather than the proxy's own address. source for this reverse-proxy note
What it needs alongside it
| Dependency | Why | Source |
|---|---|---|
| SQLite (default), PostgreSQL or MySQL | Storage backend for users' second-factor devices, sessions metadata and regulation history. | source for SQLite (default), PostgreSQL or MySQL |
Release timeline
| Version | Date | Breaking | What changed | Source |
|---|---|---|---|---|
v4.39.28 | 2026-09-17 | No | Maintenance release made up of dependency and CI updates, with no user-facing fixes listed. | source for release v4.39.28 |
v4.39.27 | 2026-09-15 | No | Fixes the status code for consent redirects, the query missing from the Envoy authz path, and a pre-configured OIDC consent saved twice. | source for release v4.39.27 |
v4.39.26 | 2026-09-12 | No | Bug fix: allows a conformant alg none JARM response. | source for release v4.39.26 |
v4.39.22 | 2026-09-03 | No | Bug fix: storage access token JWT upgrade. | source for release v4.39.22 |
v4.39.20 | 2026-05-26 | Yes | Security release fixing an access control rule domain match bypass from missing canonicalization; upgrade is not optional. | source for release v4.39.20 |
v4.39.19 | 2026-04-12 | No | Fixes inconsistent OAuth2 error messages and an issuer domain suffix check. | source for release v4.39.19 |
v4.39.18 | 2026-04-10 | No | Removes an incorrect response code check that broke successful Duo API calls. | source for release v4.39.18 |
v4.39.16 | 2026-03-14 | Yes | Security release, see advisory GHSA-gmfg-3v4q-9qr4, plus a fix for an overly strict discovery check. | source for release v4.39.16 |
If it is not coming up
- 502 Bad Gateway (Traefik)
- ECONNREFUSED / ENOTFOUND / connection to server at "postgres" port 5432 failed
- Gate a self-hosted app with Cloudflare Access
Read from the upstream documentation, repository and container registry by Keita Emsden on 2026-10-17. Every row links the page it came from. Upstream changes without telling anyone, so check the source link before you rely on a value.