One for all?

Hello,

been using Authentik for couple of months now, mostly for my internal homelab.

I have some services that are available publicly, including Vaultwarden (without VPN or anything like that). On some external services I have already configured Authentik, Vaultwarden I see came with official implementation of OIDC recently (I know it was unofficial for a while).

But... the more I am implementing into Authentik, the more I have this strange feeling of "if it gets compromised, everything gets compromised". VW is definitely the most sensitive part of the whole.

I am now on the verge of putting Vaultwarden under Authentik, and am having thoughts.

Don't get me wrong, I am running Vaultwarden via reverse proxy, I would say quite securely, lots of protection in front of it like ip restrictions and rate limiting on the proxy, crowdsec and GeoIP filtering, NGFW, and of course strong password and 2FA. I am feeling quite secure.

I am also trying to build a notification system, which will in real time notify me if there are attempts to log in. Already have some ideas via Zabbix and Discord. Will see how that goes.

Authentik would offer the same thing basically, with strong password and 2FA. Not sure if it would work on the phone though, since it's a separate app, would have to try.

What are your thoughts when it comes to Vaultwarden and Authentik?