Putting Authelia in front of my whole homelab: what worked, what didn't, and the £0 lesson that nearly undid all of it

Every service I self-host sits behind one front door: Authelia, doing single sign-on and 2FA for the lot — the dashboard, the password vault, the VPN control plane, a couple of internal tools, the monitoring. One login, one place to enforce a policy, one place to revoke access. When people say "security first" about a homelab, this is usually the...