Authelia on prod — optimization + deployment design (2026-10-18)

Young: "how to optimise and use — Authelia covers the gate for all tenants, not just sites (Docs, Pulse)."

Verified foundation

• Authelia github.com/authelia/authelia — ★29,294, Apache-2.0, pushed today (2026-10-18). The SSO/MFA portal for web apps, reverse-proxy forward-auth. Active, licences clean.
• Better Auth — ★30,344 MIT, pushed 2026-10-17 (EVE templates already carry it — L3 free).
• Our gate TODAY: nginx basic-auth on docs.youngle.au (single shared password, no second factor, no audit — Echo's find).

The optimization: one Authelia, every gate, SS0 across the whole estate

Deploy ONE Authelia instance on prod (loopback-bind, nginx forward-auth) protecting:

Per-tenancy extension (the product layer): Authelia supports multiple access-control domains + user databases — so each TENANT's private areas (KB staging, admin preview) become policy entries under the same Authelia; new tenant = new policy block, not a new auth server.

What Medusa covers native (don't double-build)

• Tenant admin/staff 2FA = Medusa v2 core MFA (TOTP + recovery codes, one env knob AUTH_MFA_ENCRYPTION_KEY) — verified in the study.
• EVE chat users = Better Auth 2FA plugin (already in template). So three layers, no duplication:
• L1 platform gate = Authelia (self-hosted vhost world)
• L2 commerce identity = Medusa core MFA
• L3 agent identity = Better Auth (EVE)

Deployment shape on prod (our Docker design's first resident!)

Authelia becomes tenant-in-a-container #0 — the platform's own infrastructure as a compose unit, proving the tenancy pattern on ourselves first:

• compose project cib-authelia on prod, loopback bind :9091, nginx forward-auth (authelia.conf include).
• config: /etc/authelia/configuration.yml (root 0600) + user db (YAML or SQLite backend).
• TOTP + recovery codes from day 1; basic-auth retired after cut-over (htpasswd entries migrated to Authelia users).
• migration of certs/domains: unchanged (nginx still TLS-terminates; Authelia only authorizes).

Build order (small, sequenced)

1. Compose file + config (Ace's lane; 30-min job) → deploy on prod (Docker ready today).
2. nginx include for docs.youngle.au forward-auth → verify 401-with-Authelia-challenge + TOTP login.
3. Migrate htpasswd users → set TOTP → cut-over → retire basic-auth.
4. Template the tenant policy block (the sellable "private KB with 2FA" feature) → pricing line for Mira (adds perceived value at A$0 licence).

What we get (business terms, Mira-ready)

• "Every gated surface has real accounts + TOTP 2FA" — a security posture Shopify/Appsadmins don't give you at this price tier.
• SSO across Docs + tenant private areas = one password + one authenticator — like infrastructure staff, done in an afternoon.
• $0 licence, ~1 day build labour, runs in ~50 MB RAM (negligible on 24 GB node).

Open for Sol/ruling

• User DB backend: YAML file (simplest) vs SQLite vs L2-cache-style — my rec: YAML at this fleet size (5 users), migrate to backend when tenant count >3.
• Do we put sol.youngle.au behind Authelia too, or keep its separate htpasswd (separate policy domain)? Rec: same portal, separate policy.

🎯 Tam's Read: Authelia is the right L1 — Apache-2.0, active, proxy-level (zero app changes for static Docus), gives real accounts + TOTP + audit across every gated vhost we have or will have; deploy it as tenant-container #0 (self-hosting the tenancy pattern before selling it) at $0 licence and ~50 MB RAM; Medusa keeps commerce MFA and Better Auth keeps EVE — three layers, no overlap, no double-build.