Base
Hardened build
minimal ports, security patches applied at build time
Traefik with Authelia SSO on Ubuntu 24.04 LTS
Azure
Security
edge reverse proxy that puts single sign-on in front of any service
Overview
Traefik with Authelia SSO is an edge appliance that terminates inbound HTTPS traffic, routes it to your backend services, and requires every visitor to sign in first. Traefik handles routing, load balancing and TLS; Authelia is the authentication and authorization server behind it, providing a login portal, brute-force protection, optional two-factor authentication and a single session shared across every service you publish. Traefik holds each request at the edge and asks Authelia whether the caller has a valid session before the backend is ever reached. Callers without one are redirected to the portal carrying their original destination; callers with one are proxied through and their identity travels upstream in the Remote-User, Remote-Groups, Remote-Name and Remote-Email headers. One login, one session, every service.
Why the cloudimg image
The cloudimg image ships the forward-auth loop already wired and proven, not two packages left for you to integrate: the middleware is attached to the routers, the session cookie is scoped correctly, and Traefik's own dashboard is published behind the same gate so it cannot be opened without signing in. Authelia runs on local SQLite with in-memory sessions, so there is no database or Redis to deploy, and two dedicated data disks keep the user database and issued certificates independent of the OS disk. No credential ships in the image: the administrator password, the JWT, session and storage encryption secrets and the default TLS certificate are all minted on your instance's first boot, and a start-up guard refuses to run on a placeholder or any published example secret. Security patching and 24/7 support are included.
Common uses
- Put single sign-on in front of an internal tool that has no authentication of its own
- Give one login and one session to every service behind a single entry point
- Add two-factor authentication and per-group access rules without touching the application
See it running
Real screenshots taken while testing this image against its deployment guide.
More in Security
2F
2FAuth on Ubuntu 24.04 LTS
Security
2FAuth is a free, open source, self hosted web app for managing your two factor authentication accounts.
Ad
acme-dns on Ubuntu 24.04 LTS
Security
The image installs acme-dns 2.0.2 from the official upstream release (github.com/acme-dns/acme-dns, the project formerly...
addy.io on Ubuntu 24.04
Security
Mail sent to an alias is forwarded to your real inbox, and you can reply from the alias so the other side never learns w...
AliasVault on Ubuntu 24.04
Security
AliasVault is an open source, end to end encrypted password manager combined with a private email alias service that you...
Apache SpamAssassin
Security
This image runs Apache SpamAssassin, the long established open source anti spam platform, fully configured and security ...
Apache Syncope on Ubuntu 24.04
Security
Apache Syncope is an open source identity management and identity governance platform.