Authentik
Authentik
Authentik is the single sign-on provider for OMEGA Core's frontend layer — one login, one identity, across every chat interface and the management platform behind them, instead of each app managing its own separate credentials.
Chosen over Authelia and Keycloak — Authelia was close, but Authentik's admin dashboard and session visibility won out; Keycloak was ruled out as too heavy for the number of applications actually being protected.
Infrastructure
Host
Proxmox LXC — CT 111
Debian 13, sized to Authentik's own stated minimum — not the oversized community-script default
Stack
Docker Compose — server + worker + PostgreSQL
Self-installed from Authentik's own compose file, not a Proxmox helper script
Protocols
OIDC + forward-auth
Native OpenID Connect where an app supports it; header-based forward-auth at the proxy where it doesn't
Role in OMEGA Core
Every app in OMEGA Core's frontend layer sits behind Authentik. Open WebUI, LibreChat and the omega-ui management platformauthenticate via native OIDC. SillyTavern, which has no OIDC support of its own, sits behind forward-auth at the reverse-proxy layer instead — Authentik authenticates the request before it ever reaches the app, and the app trusts a signed identity header rather than handling login itself.
The result is one place to manage who can reach OMEGA Core's frontends, one session model, and one point of revocation — rather than N apps each with their own user table and their own login page.
Gitea, Wiki.js, Proxmox VE (the hypervisor underneath all of this), Technitium DNS, Grafana andHome Assistant also support signing in via Authentik, but on different terms deliberately: each is an optional additional login path, kept alongside the existing local account rather than replacing it — for Gitea that means account-linking to the existing admin user, for the others a fresh Authentik-linked account sits alongside the local one. All six keep their own local login fully available — unlike the frontends above, where Authentik is the only way in. Home Assistant's OIDC support is a third-party community component (hass-oidc-auth), not a built-in feature — see the Home Assistant page for why that distinction matters.
Not Behind Authentik
Not every internal service uses SSO — some manage their own login. Listed here for the same reason the rest of this site tries to be evidence-based rather than aspirational: an accurate account of what's actually integrated matters more than implying everything is.
Own Local Login Only
InfluxDB and npmplus itself still use only their own built-in authentication — not yet evaluated for Authentik integration.
Security
Centralised Auth
A single identity provider means a single place to enforce policy and revoke access, instead of trusting every frontend's own auth code equally.
No Unauthenticated Frontends
Nothing in the frontend layer is reachable without an Authentik session — including the management platform that can start and stop the others.
Forward-Auth, Verified
For apps without native OIDC, identity headers are checked against the app's own trusted-source configuration — not assumed safe just because they arrived from the proxy.