Quick answer: Authentik is your self-hosted SSO/identity provider – one login for many apps (OIDC/OAuth2), central 2FA.
Related
Self-host on VPS: Order VPS · NexoraHost · nexorahost.com (Frankfurt · GDPR · NVMe)
Frequently asked questions (FAQ)
Authentik or Keycloak?
Keycloak: enterprise-heavy. Authentik: modern UI, often easier for homelab/SMB. Both speak OIDC/OAuth2.
Which apps support SSO?
Many: Grafana, Immich, Nextcloud, Portainer, GitLab… connect via OIDC provider.
Need SMTP?
Recommended for invites/resets. Otherwise create admin users manually.
Resources?
Plan 1–2 GB RAM for Authentik + Postgres. Don't squeeze onto a busy 1 GB VPS.
Central 2FA?
Yes – TOTP/WebAuthn in Authentik; apps trust the IdP.