tinyauth
The tiniest authentication and authorization server you have ever seen.
A lightweight self-hosted login server that protects your apps by sitting in front of Traefik, Nginx, or Caddy and requiring visitors to authenticate before they can reach anything you run behind it.
Tinyauth is a small, self-hosted server that handles authentication and access control for your other services. It is written in Go and is designed to sit in front of your apps as a middleware layer, meaning visitors have to log in before they can reach whatever you have running behind it.
It works with the three most popular self-hosting proxy tools: Traefik, Nginx, and Caddy. When someone tries to reach one of your apps, the proxy checks with Tinyauth first to confirm the person is allowed in. Tinyauth supports several login methods, including OAuth (which lets users sign in via an existing provider like Google or GitHub), LDAP (used by organizations with a centralized directory of users), and local username-and-password accounts. Access controls let you restrict which users can reach which apps.
Tinyauth can also run as a standalone authentication server independent of a proxy. A Docker Compose example file in the repository shows a working setup with Traefik, a test app called Whoami, and Tinyauth together, which you can use to see how the pieces connect before building your own configuration.
The project is under active development and the README warns that configuration options may change between releases. Documentation and setup guides live at tinyauth.app. A demo is available at demo.tinyauth.app where you can test the login interface with a default username and password. The project has a Discord server for questions and conversation, and a Crowdin page for anyone who wants to help translate the interface into other languages. Tinyauth is licensed under the GNU General Public License v3.0, which requires that any modifications to the code also be released under the same license.
Where it fits
- Put a login screen in front of all your self-hosted apps so strangers on the internet cannot access them without credentials.
- Let users sign in to your home server apps using their existing Google or GitHub account via OAuth, with no separate password to manage.
- Restrict access so only specific users in your LDAP directory can reach certain apps while others are blocked.
- Try the included Docker Compose example with Traefik and a test app to understand how the proxy and auth server connect before building your own setup.