gagootron

I personally run authelia. I prefer the config file over a gui where i have to click together all the config. For the actual user storage i got lldap.

But my requirements a pro possibly different to yours, my main focus was no docker and no javascript backend.

Keycloak is definetly overkill for a homelab. Both in effort to get it to run, and maintaining it.

The benfit of tang is that you don’t store the secret on a shared server.

The server has a single keypair that it reuses for every client, and each client has thier own keypair.

The encryption key can only be recovered when the client and server perform thier handshake. And only the client gets the key, the server cannot see it.