Traefik+immich+Authelia here, works good. You can use the traefik bypass secret header to let Immich through authelia.

Probably possible in some fashion with authentik too, haven’t tried it yet.