Connect Emby or Jellyfin

This example runs Authelia in Docker with your reverse proxy installed directly on the same computer. Emby or Jellyfin can keep running where it already does. If you already run Authelia, update that installation instead.

name: media-auth

services:
  authelia:
    # Version used for the Poster Tools integration tests.
    # Choose a supported release for your deployment.
    image: authelia/authelia:4.39.28
    restart: unless-stopped
    ports:
      # Reachable by a proxy running on this computer.
      - "127.0.0.1:9091:9091"
    volumes:
      # Authelia configuration and persistent data.
      - ./authelia:/config

Files you need

Save compose.yml in a new folder. Inside it, create an authelia folder containing your configuration.yml and any user, key or secret files referenced by that configuration. Keep database and notification file paths under /config when using local file storage.

The Compose file starts the container; it does not create users or a complete Authelia configuration. Set up your authentication backend, session domain and secrets, storage, notifications, access rules and OIDC signing keys using the official Docker guide. Then merge the generated Poster Tools client settings below into configuration.yml.

Validate and start

docker compose config --quiet
docker compose run --rm authelia authelia validate-config --config /config/configuration.yml
docker compose up -d
docker compose logs --tail 50 authelia

Run these commands from the folder containing compose.yml. Start the service only after validation succeeds. After editing the configuration later, validate it again and run docker compose restart authelia.

Connect it to your proxy

For a proxy installed on this computer, use 127.0.0.1:9091 as the Authelia upstream. Give the login portal its own HTTPS address, such as https://auth.example.com, forwarding to that upstream. The protected media hostname still forwards to Emby or Jellyfin after the Authelia check.

If your proxy also runs in Docker, attach both services to the same Docker network and use authelia:9091 as the upstream. Inside a container, 127.0.0.1 points to that container. The loopback port mapping above is for a proxy running on the host.

For the Compose example, save this as authelia/configuration.yml. It shows a single-instance test setup using a local user file and SQLite. Replace the example domains and every REPLACE_... value before validating or starting it. For an existing installation, merge the Poster Tools settings below into your current file.

server:
  address: 'tcp://:9091/'
  # Add the authz endpoint settings generated below for your proxy.

log:
  level: 'info'

totp:
  issuer: 'My Media Server'

authentication_backend:
  file:
    path: '/config/users_database.yml'

access_control:
  default_policy: 'deny'
  rules:
    - domain: 'media.example.com'
      policy: 'two_factor'

session:
  secret: 'REPLACE_WITH_UNIQUE_RANDOM_SESSION_SECRET'
  cookies:
    - domain: 'example.com'
      authelia_url: 'https://auth.example.com'
      default_redirection_url: 'https://media.example.com'

storage:
  encryption_key: 'REPLACE_WITH_UNIQUE_RANDOM_STORAGE_KEY'
  local:
    path: '/config/db.sqlite3'

# For testing: enrollment messages are written to this private file.
# Configure SMTP for normal email delivery.
notifier:
  filesystem:
    filename: '/config/notification.txt'

identity_providers:
  oidc:
    hmac_secret: 'REPLACE_WITH_UNIQUE_RANDOM_OIDC_SECRET'
    jwks:
      - key_id: 'media-signing-key'
        algorithm: 'RS256'
        use: 'sig'
        key: |
          REPLACE_WITH_YOUR_GENERATED_RSA_PRIVATE_KEY_PEM
    # Merge the generated cors and clients settings here,
    # at the same indentation as hmac_secret and jwks.

Complete the example

1. Replace example.com with the parent domain shared by your portal and media host. Set their full HTTPS addresses, including any custom ports. Access-control rules use the media hostname without a scheme or port.
2. Generate separate random secrets for the session, storage and OIDC settings. Follow Authelia’s secret generation guidance. Keep the storage encryption key when restarting or upgrading.
3. Create authelia/users_database.yml with your user and a generated password hash using the file authentication instructions. Register a second factor for the two-factor policy.
4. Generate an RSA signing key using the OIDC provider instructions. Replace the key placeholder with the complete PEM text, keeping every line indented beneath key: |.
5. Generate your Poster Tools settings using the addresses above. Merge cors and clients into identity_providers.oidc. For Caddy, merge the generated endpoints into server. Keep one copy of each YAML section.
6. Validate using the commands in the Compose example, then start Authelia. Your proxy must also serve the portal over HTTPS and enforce authorization on the media host.

The callback address belongs in the client’s redirect_uris. The Poster Tools site origin belongs in cors.allowed_origins. The generator fills both from the address where you opened this guide, so generate from the live site for live use, or your local site for local testing.