标签：#sso

Originally published at woitzik.dev Disclosure: This post contains Amazon affiliate links (marked with *). If you buy through them, I earn a small commission at no extra cost to you. I only link gear I actually own and use daily. Every internal service in my homelab goes through the same authentication gate: Authelia. Proxmox, PBS, Grafana, ArgoCD, Headscale, ArgoCD, Uptime Kuma, Paperless, Nextcloud — 25+ web services, one login, one session, one set of access rules. The OIDC provider, the Postgres backend, the session store, and the secrets are all running inside k3s, backed by CNPG, Redis, and Vault. This article is the full implementation: how the pieces fit together, why certain design decisions were made, and the specific bugs that bit me along the way. View the complete homelab infrastructure source on GitHub 🐙 The Architecture Authelia runs as a Kubernetes Deployment in the apps namespace, protected by the same default-deny NetworkPolicy that applies to everything else. It has three dependencies: PostgreSQL — CNPG-managed postgres-authelia cluster in the database namespace Redis — session store, ephemeral (no persistence needed) Vault — hmac_secret, OIDC private keys, JWT secrets, session secrets The Traefik ForwardAuth middleware sits in front of every service. When a request hits Traefik, the middleware sends a verification request to Authelia's /api/verify endpoint. Authelia checks the session cookie, validates the OIDC token if applicable, and returns a 200 (allowed) or 401 (redirect to login). # kubernetes/apps/authelia/middleware.yml apiVersion : traefik.io/v1alpha1 kind : Middleware metadata : name : authelia namespace : apps spec : forwardAuth : address : " http://authelia.apps.svc.cluster.local:9999/api/verify" trustForwardHeader : true authResponseHeaders : - Remote-User - Remote-Groups - Remote-Email Every IngressRoute that needs protection adds middlewares: [{name: authelia}] . Services that need API-level protection (not browser-based) use OIDC

A USB-C port presents a lot of options for data transfer and connecting to accessories. Let's talk about some of the most useful ways to employ your USB-C port.

There's two things you should know about me, your intrepid reviewer: I hate the feature creep associated with modern power banks, and I love shaving grams off the gear I carry when backpacking, bikepacking, and trail running. So imagine my delight when Nitecore released a new generation of its ultralight NB10000 battery. After a few […]

USB drives have outlasted a lot of other tech through the years. Is it time for the industry to move on?

Why our deputy editor Nate Ingraham loves the new Twelve South tiny charging pad in spite of its price.

Apple Pencils differ in terms of features, charging methods and iPad compatibility.

Corsair's latest accessories have some handy features and don't cost too much.

MagSafe accessories make your phone feel uniquely yours. These are our favorites, including Android-friendly Qi2 picks.

CMF announces its first pair of open-ear earbuds for under $100.

From wired to wireless to ultralight, we've tested dozens of gaming mice to find the best for work, your next MMO, and everything in between.

Before you go spend money on new headphones, try these adjustments. You can probably improve the sound on the ones you have.

The feature is a must-have, but some modern headphones and earbuds still don't offer it.

A hands-on guide to being your own Identity Provider — with Laravel 12 and Passport v13. You will build a Central Portal that acts as an OAuth 2.0 Authorization Server, then wire up child sites ( Site A , Site B , Site C ) so a user logs in once and gets access to all of them. No Google. No Auth0. No Keycloak. No "Sign in with…" anything. You own the users table, you issue the codes and tokens, you hold the signing keys. The only dependency is laravel/passport , which implements the OAuth 2.0 protocol machinery — every identity decision is yours to make, and this guide walks through each one. The scope is deliberately narrow: authentication only. How a user proves who they are at a central server, and how a child site learns that identity. Everything else (admin CRUD screens, audit logging, UI theming) is left out. Everything here is buildable on a fresh Laravel install. No prior context needed. Table of Contents What We Are Building OAuth 2.0 Foundations System Architecture Authentication Workflows Part A — Building the Central Portal Part B — Building a Child Site Registering a Child Site End-to-End Testing Gotchas & Security Notes Reference Tables Appendix A — Extending to Multiple User Types Appendix B — Mental Model in One Page 1. What We Are Building The Problem You operate several web applications. Each has its own users table, its own login form, its own password reset flow. When a staff member joins, someone creates four accounts. When they leave, someone must remember to disable four accounts. Passwords drift out of sync. There is no single place to answer "who has access to what?" The Solution One central server owns identity. Every child site delegates login to it. ┌─────────────────────────────┐ │ Central Portal │ │ ┌───────────────────────┐ │ │ │ admin.portal.test │ │ Management UI │ │ │ │ — create users │ └───────────────────────┘ │ — grant per-site access │ ┌───────────────────────┐ │ │ │ sso.portal.test │ │ OAuth 2.0 endpoints │ │ (authorization ser

As USB-C becomes the standard across most devices, it's time to go through that drawer full of USB adapters and toss those you no longer need.

The company is promising the first in-depth look at the $2,195 glasses.

When it's less about the product and more about the FCC.

Should you splurge on the new Series 11, or will the SE 3 do? Let us help you figure out which version to get (and which to avoid).

The Smart LED Monitor Stand is currently available for $169.99.

Your battery is continually losing charge.

Tech companies love to sell us expensive gadgets to solve all of life's little problems. Sleepbuds sold by the likes of Anker and Ozlo are a good example. These miniature marvels of engineering sit flush in the ear, and allow side-sleepers to doze off listening to podcasts, audiobooks, music, or white noise without annoying their […]