Authelia Config GUI

First of all, I'm not a coder at all. This project was totally done with vibe coding. If you have any suggestions you are welcome. I will be glad to take it in consideration, but don't start any kind of flames about that!

Version: v0.2.1

A simple web interface for uploading, editing and generating Authelia’s configuration files (configuration.yml and users_database.yml), which can then be copied to the server.

A single container: a FastAPI (Python) backend that serves both the APIs and the static frontend (vanilla HTML/CSS/JS, no build step). Password hashing (argon2id, Authelia’s default parameters) is performed on the server side.

Getting started

docker compose up --build

Then open http://localhost:8089 (the host port is defined in compose.yml).

Without Docker (for development):

pip install -r backend/requirements.txt
uvicorn backend.app:app --reload --port 8080

How to use it

1. At the top, choose which file to edit: configuration.yml or users_database.yml.
2. Upload the existing file from your hard drive (or use Upload example / New).
3. Edit the fields in the forms (basic mode).
4. Tick Advanced configuration to open the raw YAML editor and edit any details not covered by the forms. Apply to forms re-reads the base values from the YAML.
5. Generate file → check the result → Download or Copy and upload it to the Authelia server.

Long configurations stay readable: every section is a collapsible card, and each access control rule, OIDC client and user is a collapsed row showing a one-line digest (domain and policy, client id, username). Click a row to work on it alone; Expand all / Collapse all act on a whole list.

Reading the files from a bind mount

If the folder holding configuration.yml and users_database.yml is mounted at /app/config, the GUI can read them directly — no upload needed:

volumes:
  - /path/to/authelia:/app/config:ro

A Load from server button then appears for whichever file is found, along with a line stating the path and its last modification time. Nothing is loaded automatically: it always takes a click, so a mounted file never silently replaces what you are editing.

Recognised names are configuration.yml / configuration.yaml and users_database.yml / users_database.yaml. The mount point can be moved with the CONFIG_DIR environment variable.

Writing back (off by default)

Writing to the mounted folder is disabled unless you ask for it:

volumes:
  - /path/to/authelia:/app/config      # note: no :ro
environment:
  CONFIG_WRITE: "true"

A Save to server button then appears. It writes the generated file (press Generate file first), asks for three confirmations, copies the previous content to <name>.bak and replaces the file atomically. Invalid YAML is rejected before anything is touched. The previous file's permissions (and, where allowed, its owner) are carried over to the new one.

Until CONFIG_WRITE is set there is no Save button at all — the line under the buttons says so, so it is not mistaken for a bug.

Keep in mind the GUI has no authentication: with CONFIG_WRITE enabled, anyone who can reach it can rewrite your Authelia configuration.

Running as Authelia's uid/gid

By default the container runs as uid 10001, which usually cannot write into a folder owned by Authelia — and files it did manage to write would carry the wrong owner. Rather than changing the ownership of your Authelia files (which breaks Authelia), run the container as that same user:

user: "1000:1000"   # the uid:gid Authelia runs as

That is plain Docker, no image rebuild and no extra environment variables; the container still never runs as root.

User passwords

In the user form, enter the password in plain text in the New password field: upon generation, it is saved as an argon2id hash. If you leave the field blank, the existing hash remains unchanged.

Languages (i18n)

The interface is multilingual. By default: Italian and English. The language is selected from the menu in the top right-hand corner; the choice is saved in the browser and, on startup, is detected based on the browser’s language (fallback: English).

Adding a language

Translations are key → text JSON files in frontend/locales/. To add a language:

1. Copy frontend/locales/en.json to frontend/locales/<code>.json (e.g. de.json, fr.json, es.json).
2. Set the _name field to the name of the language (e.g. ‘Deutsch’) and translate all the values. Do not change the keys.
3. Restart (or reload): the backend scans the folder (GET /api/locales) and the new language automatically appears in the menu. No code changes required.

Use en.json as a reference file: it must contain all the keys. If a key is missing from a translation, the key itself is displayed.

Philosophy: surgical changes

Only the fields managed by the forms are modified in the uploaded file; comments and untouched sections (storage, notifier, authentication_backend, etc.) remain intact thanks to ruamel.yaml.

Security notes

The GUI has no authentication of its own and talks to its backend over plain HTTP: configuration content and secrets pass through it. Run it on a trusted network only (localhost, LAN, VPN/tailnet) — do not expose it to the internet, or put it behind a reverse proxy with TLS and authentication (e.g. behind Authelia itself).

Built-in hardening:

• responses carry security headers (CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy); API responses are no-store;
• request size limits (2 MB YAML, 1 KB passwords) prevent trivial DoS via the argon2 hashing endpoint;
• the container runs as an unprivileged user and includes a healthcheck;
• nothing is persisted server-side: files live only in your browser session.

Known limitations (v1)

• Basic editing of access_control rules regenerates the list of supported fields (domain, policy, subject, resources, networks). For advanced rule keys (methods, query, complex resources, nested OR/AND subjects), use Advanced Configuration (raw YAML).
• Basic forms are based on the Authelia v4.38+ schema (server.address, session.cookies, session.remember_me). Older configurations are fine for reading; for legacy fields, use advanced mode.
• The tool does not validate the entire configuration against the Authelia schema: before deployment, check it using authelia validate-config.