Integrating Nginx Proxy Manager with Authentik

As more organisations adopt self-hosted infrastructure, it has become increasingly common for both small and medium-sized businesses and homelab operators to run their own internal services. Modern virtualisation platforms, container environments, and affordable server hardware make it possible to deploy powerful applications without relying entirely on cloud services.

However, while deploying new services has become significantly easier, security often receives far less attention than it should.

Many self-hosted applications either include only basic authentication or provide no authentication mechanism at all. Within a private internal network this may not appear to be a serious issue. However, once these services are made accessible remotely—for example to support remote staff, external partners, or mobile access—they can quickly become a potential security risk.

A highly effective solution is to place these services behind a secure authentication gateway. By combining Nginx Proxy Manager with Authentik, organisations can implement a powerful and flexible identity layer that protects internal applications from unauthorised access.

Together, these tools create a secure access gateway in front of your services. Users must authenticate before reaching an application, and this protection can be applied even when the application itself has no built-in authentication system.

This guide explains how these tools work together and how businesses and homelab operators can use Authentik to secure internal services through a modern authentication proxy.

Understanding Nginx Proxy Manager

Nginx Proxy Manager is a web-based management interface for the widely used Nginx reverse proxy server. In traditional deployments, configuring Nginx involves editing configuration files manually, which can be complex and time-consuming.

While this approach offers a high degree of flexibility, it can also introduce configuration errors and slow down deployment, particularly in smaller IT environments where administrators may be managing multiple responsibilities.

Nginx Proxy Manager simplifies this process by providing a graphical interface that allows administrators to configure reverse proxies, manage SSL certificates, and route domain traffic in a matter of minutes. Through its dashboard, administrators can quickly create proxy hosts, enable HTTPS certificates using Let’s Encrypt, and manage traffic routing without needing to edit configuration files directly.

For many small businesses and homelabs, Nginx Proxy Manager sits at the edge of the network and acts as the primary entry point for external traffic. When a user attempts to access a service through a domain name, the request first reaches NPM, which then determines which internal service should receive the request.

For example, one domain may route to an internal monitoring dashboard, while another directs users to a documentation platform or a customer management system. Because NPM sits between the internet and the internal infrastructure, it is the ideal location to introduce an authentication layer.

Instead of forwarding traffic directly to internal applications, NPM can send those requests to an identity provider such as Authentik. This ensures that users must authenticate before they are granted access to internal systems.

Understanding Authentik

Authentik is an open-source identity and access management platform designed to provide modern authentication and authorisation capabilities for self-hosted environments.

At its core, Authentik acts as a central identity provider that verifies user identities and determines which applications those users are allowed to access.

In larger enterprises, similar roles are typically performed by identity platforms such as Microsoft Entra ID, Okta, or Google Workspace Identity. Authentik provides many of the same capabilities while remaining fully self-hosted and open source, making it particularly attractive for organisations that want full control over their infrastructure.

Authentik supports a range of modern authentication protocols including OAuth2, OpenID Connect, LDAP, and SAML, enabling it to integrate with a wide variety of applications and services.

One of its most valuable features for small businesses and homelabs is the Proxy Provider. This feature allows Authentik to sit directly in front of an application and act as an authentication gateway.

Instead of the application managing its own login system, Authentik performs authentication first and only forwards requests after verifying the user’s identity. This design allows administrators to centralise authentication while also enforcing additional security controls such as multi-factor authentication, group-based access policies, and conditional access rules.

How Nginx Proxy Manager and Authentik Work Together

When Nginx Proxy Manager and Authentik are deployed together, they create a layered security architecture designed to protect internal services while maintaining easy access for authorised users.

In this architecture, Nginx Proxy Manager acts as the public-facing reverse proxy responsible for handling incoming internet traffic. Authentik sits behind NPM and provides authentication and access control.

When a user attempts to access an application, their request first reaches NPM. Instead of forwarding the request directly to the internal application, NPM sends the request to Authentik. Authentik then checks whether the user has already authenticated and verifies that they are authorised to access the requested service.

Only after this authentication check has been completed successfully will the request be forwarded to the internal application.

High-Level Architecture

Internet
│
│ HTTPS Request
▼
+---------------------------+
| Nginx Proxy Manager |
| (Reverse Proxy + SSL) |
+---------------------------+
│
▼
+---------------------------+
| Authentik |
| Identity & Access Layer |
+---------------------------+
│
▼
+---------------------------+
| Internal Application |
| (Dashboard / Service) |
+---------------------------+

This layered approach ensures that internal services are never exposed directly to the internet. Instead, all access requests must pass through both the reverse proxy and the authentication layer before reaching the application.

Why This Architecture Works Well for SMB Environments

Small and medium-sized businesses frequently operate with limited IT resources while still needing to support a growing number of internal tools and services. These may include monitoring dashboards, documentation platforms, management interfaces, and internal business applications.

While many of these tools are extremely useful, they often lack advanced security capabilities such as centralised authentication, role-based access control, or multi-factor authentication.

By placing Authentik in front of these services, organisations can introduce a consistent authentication framework across all internal applications. Instead of managing separate user accounts for each service, authentication is handled centrally through Authentik.

This approach simplifies user management while also improving overall security. Once a user has authenticated through Authentik, they can access other authorised services without needing to log in again.

For SMB environments, this provides many of the benefits of enterprise identity platforms without requiring expensive cloud-based identity solutions.

Securing Applications Without Built-In Authentication

A common challenge in both small business environments and homelabs is that many useful tools were originally designed for internal use and therefore include little or no authentication functionality.

These tools often assume they are operating within trusted networks. However, when organisations begin enabling remote access for employees or external partners, these assumptions can introduce security risks.

Authentik’s proxy provider solves this problem by placing a secure authentication gateway in front of the application.

When users attempt to access the application, Authentik first checks whether they have an active authenticated session. If they are not logged in, they are redirected to the Authentik login page.

After successful authentication, Authentik forwards the request to the application. From the application’s perspective, the request simply appears as a normal authenticated user request.

This allows administrators to secure legacy tools, internal dashboards, and management interfaces without modifying the underlying software.

Example: Protecting an Internal Dashboard

Consider a monitoring dashboard running on an internal server at the following address:

http://192.168.1.20:8080

The application does not include any login functionality. Anyone with network access to the server could view the dashboard.

To make the service securely accessible externally, users instead access it through a public domain such as:

https://dashboard.example.com

This domain is configured in Nginx Proxy Manager and routed through Authentik before reaching the internal application.

The administrator first creates a Proxy Provider within Authentik that defines both the external domain and the internal service address. Next, an Authentik application is created and linked to the provider. Access policies can then be applied to control which users or groups are allowed to access the dashboard.

Finally, Nginx Proxy Manager is configured to forward traffic for the dashboard domain to Authentik rather than directly to the internal server.

Authentication Flow

When the configuration is complete, the authentication process follows a predictable sequence.

If a user attempts to access the application without being logged in, Authentik intercepts the request and redirects the user to the login page. After the user successfully authenticates, Authentik forwards the request to the internal service.

If the user is already authenticated, Authentik simply validates the existing session and forwards the request immediately.

This process enables single sign-on, allowing users to authenticate once and then access multiple internal services without repeated login prompts.

Single Sign-On Across Multiple Applications

Once Authentik is deployed, it can be used to protect multiple services simultaneously.

Internet
│
▼
Nginx Proxy Manager
│
▼
Authentik
│
├── Monitoring Dashboard
├── Grafana
└── Documentation Wiki

Users authenticate once through Authentik and can then access any authorised application without needing to log in again.

Security Best Practices

While this architecture provides strong security benefits, several best practices should still be followed.

Internal applications should remain on private networks wherever possible to minimise their exposure to external threats. Multi-factor authentication should also be enabled to provide an additional layer of protection beyond simple passwords.

Administrators should organise users into groups and apply permissions at the group level rather than assigning access individually. This simplifies access management as environments grow.

Regularly reviewing authentication logs within Authentik is also recommended, as these logs can provide valuable insight into login activity and potential security issues.

Final Thoughts

Integrating Nginx Proxy Manager with Authentik provides small and medium-sized businesses and homelab operators with a powerful authentication gateway for protecting internal services.

This architecture introduces centralised identity management, single sign-on, and modern security controls without requiring complex enterprise infrastructure.

Most importantly, it allows organisations to secure applications that were never originally designed with authentication in mind. By placing Authentik between users and internal services, every request must be authenticated before reaching the application.

For SMB environments seeking to strengthen their infrastructure security while maintaining flexibility and control, this approach offers a practical and highly effective solution.