TPTito Pinardo Gutiérrez
← Back to the rack
Español
1U · SSO + 2FACaddy · Authelia · LAN and VPN only In production

Slot 3 of 25 in the rack · In production

1U unit · Access to the panels

Caddy + Authelia · the internal door

Two-factor by default

Traefik is the door to the internet; this is the one inside. Caddy receives requests to the homelab panels and, before letting any through, asks Authelia whether there's a valid session with two-factor auth.

Why two doors
Public traffic and administration shouldn't share an entrance. If someone finds a flaw in the public door, the panels aren't behind it.
How it decides
Caddy makes an authorisation request to Authelia for every request. Authelia decides; the content doesn't go through it.
The golden rule
A protected panel must not be reachable on its direct port: if it is, the protection is decorative.
  • 2FAdefault policy for everything protected
  • 0internal panels with a public name
  • 302what you get if you arrive without a session
  • 5 minto roll back every access change

Inside the internal door

Internal panels aren't published: you reach them from home or the VPN, and always through here. Pick a flow.

Flows Pick one and follow the packet.

Where you come from Internal proxy · Docker container Caddy + Authelia Internal proxy Authentication Protected panels Rules that make it real My laptop Phone outside VPN Home DNS Internet Caddy Internal TLS Forward auth Headers Authelia Password 2FA code Session Gestor stacks Library DNS panel Monitoring Localhost only LAN · VPN only Policy Reload
Hermesvisiting the unit

Click a part or pick a flow. If you came from a skill, the parts where I use it are already lit.

      I open a panel for the first time
      1. My laptop, at home — From home, I open the container manager by its internal name.
      2. Home DNS — The home DNS resolves the name to the internal proxy.
      3. Caddy — Caddy gets the request, encrypted with its internal certificate.
      4. Authorisation request — Before anything else, it asks Authelia whether I can go through.
      5. Authelia — No session: Authelia takes me to its login page.
      6. First factor — First factor: username and password.
      7. Second factor — Second factor: the one-time code on my phone.
      8. Session — Authelia creates the session.
      9. Authorisation request — Caddy asks again and now the answer is yes.
      10. Container manager — It passes the request to the panel, which still asks for its own login.
      11. Caddy — The response comes back through Caddy.
      12. My laptop, at home — And I see the panel.
      I open another panel later
      1. My laptop, at home — A while later I open a different panel.
      2. Caddy — Caddy gets the request.
      3. Authorisation request — It asks Authelia.
      4. Session — The session is still valid: no need to log in again.
      5. Authorisation request — Answer: yes.
      6. Library panels — The request reaches the library panel.
      7. My laptop, at home — I see it straight away. One login for everything.
      I check it from outside
      1. My phone, away from home — I'm away from home and want to see monitoring.
      2. WireGuard VPN — I turn on the VPN: the phone is now inside the network.
      3. Home DNS — Now the internal name does resolve.
      4. Caddy — Caddy gets the request.
      5. Authorisation request — It asks Authelia.
      6. Authelia — New session on this device: login and code.
      7. Second factor — With the second factor, go ahead.
      8. Monitoring panels — The request reaches the panel.
      9. My phone, away from home — I check it on my phone.
      Someone tries to skip the door
      1. My laptop, at home — A device on the network tries to go straight to the container manager's port, without Caddy.
      2. Container manager — The panel only listens inside its own container.
      3. Ports on localhost only — The connection is refused: from the network there's nothing on that port.
      4. My laptop, at home — All that's left is the real door.
      5. Caddy — Caddy gets the request.
      6. Authorisation request — It asks Authelia.
      7. Authelia — And without a two-factor session, it doesn't get through.
      Someone tries from the internet
      1. Internet — Someone on the internet looks for the internal panels.
      2. Home network and VPN only — Their names don't exist outside home and the firewall doesn't let anyone in.
      3. Access policy — There's nothing to attack: the policy isn't even evaluated.

      1. My laptop, at home

        From the home network I open the panels by their internal name.

      2. My phone, away from home

        From outside, you only get in with the VPN.

      3. WireGuard VPN

        Puts the phone inside the network as if it were home.

        • WireGuard

      4. Home DNS

        Internal names only exist here: outside home they don't resolve.

        • Technitium DNS

      5. Internet

        Where the internal panels can't be reached from.

      6. Caddy

        The internal proxy. It gets the request and, before touching the panel, asks Authelia for permission.

        • Docker

      7. Internal TLS

        Caddy signs its own certificates for internal names: everything is encrypted inside the house too.

        • Docker

      8. Authorisation request

        For every request, Caddy asks Authelia «can this session see this?». If not, it redirects to the login.

        • Docker
        • Linux / SSH hardening

      9. Identity headers

        When Authelia says yes, Caddy tells the panel who the user is and which groups they belong to.

        • Docker

      10. Authelia

        The single sign-on server: one login for every panel, with its access policy.

        • Linux / SSH hardening
        • Docker

      11. First factor

        Username and password, with attempt limiting.

        • Linux / SSH hardening

      12. Second factor

        A one-time code from the phone. The default policy requires it for everything protected.

        • Linux / SSH hardening

      13. Session

        Once in, a session cookie works for every panel for a while: no repeating the login on each one.

        • Linux / SSH hardening

      14. Container manager

        The most powerful panel: it manages the Docker stacks. Two-factor and then its own login.

        • Docker

      15. Library panels

        The services that keep the media library tidy.

        • Docker

      16. DNS panel

        Home DNS administration, only behind this door.

        • Technitium DNS

      17. Monitoring panels

        Metrics and security, to check from anywhere with the VPN.

      18. Ports on localhost only

        Protected panels publish their port only inside their own container: the only way in is Caddy.

        • Docker
        • Linux / SSH hardening

      19. Home network and VPN only

        Internal names don't exist on the internet and the firewall doesn't let anyone in from outside.

        • Linux / SSH hardening

      20. Access policy

        Two-factor by default. Exceptions are explicit and few.

        • Linux / SSH hardening

      21. Seamless reload

        Configuration changes are validated and reloaded without dropping the proxy.

        • Docker

      What I use from my skill tree

      Pick a skill: the parts where I use it light up on the map and I tell you what for.

      Docker
      Caddy, Authelia and the panels run as containers; protected ones publish their port on localhost only.
      Linux (Debian, Alpine, Arch)
      A Linux container with Docker that groups the internal proxy and the library panels.
      WireGuard
      From outside home, the panels can only be reached through the VPN.
      Technitium DNS
      Internal names only resolve on the home DNS, and its admin panel is behind this door.
      Linux / SSH hardening
      Single sign-on with two-factor by default, no panel with a public name and no shortcut through a direct port.

      Incident log

      Real failures. Read the symptom, pick the cause you think it was and see how it was fixed.

      1. #1

        A door with two-factor… and another without

        06-09-2026 · audit

        The container manager already asked for a login and two-factor through the internal door. Still, I flagged it in the audit.

        What do you think was going on?

        Show the fix
        Cause
        The container published its port on every interface. Anyone on the network could go straight to the port and skip Caddy and Authelia. For a panel with Docker access, that's admin access.
        Fix
        Publish the port on localhost only, and check it: without a session the door returns a 302 to the login; the direct port is refused from the PC. With automatic rollback after 5 minutes in case I locked myself out.
        Lesson
        Authentication in front only works if there's no other way round. You have to test the shortcut, not just the door.

      2. #2

        Internal panels with public names

        26-09-2026 · surface

        Reviewing everything visible from the internet, several admin panels had their own public name and a route on the internet door.

        What do you think was going on?

        Show the fix
        Cause
        Each panel had been published at some point so I could see it from outside. None was serious on its own; together they were too much surface.
        Fix
        Take their routes and DNS records off the internet on the same day. They're still in use, but behind this door: from home or the VPN, with two-factor.
        Lesson
        Convenience publishes things one at a time; security reviews them all together.

      How it was built

      1. Summer 2026

        Caddy for internal names

        • An internal proxy with its own certificates for home names.
        • Authelia in front of the library panels.

      2. 06-09-2026

        Access audit

        • Two-factor as the default policy.
        • The container manager behind the door, with its port on localhost only.
        • Every change with a 5-minute rollback timer.

      3. 26-09-2026

        Everything internal, through here

        • Panels that were visible from the internet move to this door.
        • The new DNS panel too, with its backend accepting only Caddy.

      4. 15 to 18-10-2026

        One sign-on

        • The Git server, the hypervisor, the backup server and the secrets manager log in through Authelia over OIDC, requiring the admins group.
        • One account, one second factor and one place to revoke access.
        • Their internal certificates, signed by the home authority.

      Decisions (and why)

      • Where you authenticate

        Once, in Authelia, for every panel

        Every panel with its own weak login is a soft spot. With single sign-on, two-factor protects all of them at once.

      • What about the panels' own logins

        Kept behind the SSO

        For the most sensitive panel, Authelia's two-factor doesn't replace its login: it comes first. Two different keys.

      • How an access change is applied

        With automatic rollback

        A mistake in the door locks you out of the door. Every change had a timer that undid everything after 5 minutes unless I cancelled it after testing.

      What I learned

      • Keep the public entrance apart from the admin one.
      • Test the shortcut: a two-factor door is useless with an open window next to it.
      • Access changes always with an automatic way back.

      What's next

      • Bring more panels in through OIDC so they no longer need their own local account.
      • Move the Caddy configuration into the infrastructure repo, like the Traefik routes.

      Shall we talk?

      I can walk through any of these decisions in detail in an interview.

      Download CV Get in touch ← Back to the rack

      Rebuilt from my documentation: no internal names, addresses or users.