I use my Nextcloud instance as a OIDC provider for all my other apps.

I use Stratum on android and GNOME Authenticator on Linux desktop

I used authentik first as it was suggested by a friend with whom we are sharing the vps, and so I kept using that also for another personal vps.

It is a good combination of robustness and flexibility for me, plus we needed a user dashboard or at least a list of apps. Custom workflows, blueprints and stuff were a bit of a pain to understand, so I just copy them between the two install I have because I keep forgetting how everything works. It’s also quite resource-heavy, so I might try something different in the future.

I personally run authelia. I prefer the config file over a gui where i have to click together all the config. For the actual user storage i got lldap.

But my requirements a pro possibly different to yours, my main focus was no docker and no javascript backend.

Keycloak is definetly overkill for a homelab. Both in effort to get it to run, and maintaining it.

I tried authelia when it was new and could get it to work right, so switched to keycloak.

Its really stange seeing kanidm basically never mentioned in these types of threads dispite how perfect it is for selfhosting: great documentation, incredibly easy to get setup, easy to make a custom themed/setup auth page, lets users name themselves how they prefer instead of requiring “firstname lastname” (why does every service need a lastname when it never gets used?)

Authelia and authentik are cool but are way more complex then you need for authenticating a couple services and for me at least feel “bloated” for my usecase

Aegis

The one built in to Caddy for anything that doesn’t really have authentication. Everything else uses its own and i only have a couple services accessible outside the home.

Most everything is only accessible within my home and my guest wifi is on its own vLAN. Even then I’m the only person who actually uses most things that I setup.

Authentik is great, super versatile, if not a bit of effort to get it set up initially

I love authentik

Now it needs no middleware. Just authentik and postgres

The ui is great, features are great, great api. Super easy to self host and manage

Open source, small dedicated team. Can’t ask for more

There is no “overall best”, just one that works best for you. I like to keep mine on a managed encrypted server so I use Ente Auth. I think Proton has one as well.

Openbao -> keycloak with a TOTP on new devices

Developer of VoidAuth here; if you decide to give it a try let me know if you run into any issues during setup, or have any feedback!

I use Authentik - works well - but I’m prepping to switch to Authelia for the config-based setup.

I updated Authentik across 2 versions (they did 2 month-long supported tags, missed one; now they do 3 month-long supported tags) and it destroyed itself. Had to recover the DB from a backup (and then step through the version I tried to skip), and while I was doing that I was like “wait why does this have only a DB? Should just be a config file cause that’s all the depth I do with it” and lo that’s what Authelia is.

Authentik is audited and Authelia has not been. Initially while I chose Authentik. But config-file robustness in the face of Authentik’s GUI-setup DB imploding swayed me not to care, it’d take so long and be so tedious to redo all my proxies and auths through the GUI. Plus I always forget what to click in the GUI when I come back to add some new program in 4 months.

I like Ente, and according to their docs you can spin up your own host.