@SpikeyGG I am using a few tutorials myself to have the Cloudflare setup with NGINX & Authelia running on my Unraid server. I am running home assistant on another machine (proxmox) however, one day I will switch it over to Unraid as well. For reference, my HA install is on 192.168.1.10 and Unraid/Authelia 192.168.1.100.
Before I start, I must give credit to Sycotix at IBRACORP as I wouldn’t have been here without the tutorial videos. I have forgotten which ones exactly contributed to this particular part of my setup, but, these 3 are worth watching:
In Cloudflare, I have set up the CNAME domain auth.YOURDOMAIN.com for Authelia and homeassistant.YOURDOMAIN.com for Home Assistant.
So that will point through to Nginx proxy manager and then that subsequently is set up for Authelia authentication.
Below is how I have configured NGINX:
Here is the code in the advanced tab:
location /authelia {
internal;
set $upstream_authelia http://192.168.1.100:9091/api/verify;
proxy_pass_request_body off;
proxy_pass $upstream_authelia;
proxy_set_header Content-Length "";
# Timeout if the real server is dead
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
client_body_buffer_size 128k;
proxy_set_header Host $host;
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_redirect http:// $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 4 32k;
send_timeout 5m;
proxy_read_timeout 240;
proxy_send_timeout 240;
proxy_connect_timeout 240;
}
location / {
set $upstream_homeassistant http://192.168.1.10:8123;
proxy_pass $upstream_homeassistant;
auth_request /authelia;
auth_request_set $target_url https://$http_host$request_uri;
auth_request_set $user $upstream_http_remote_user;
auth_request_set $groups $upstream_http_remote_groups;
proxy_set_header Remote-User $user;
proxy_set_header Remote-Groups $groups;
error_page 401 =302 https://auth.YOURDOMAIN.com/?rd=$target_url;
client_body_buffer_size 128k;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
send_timeout 5m;
proxy_read_timeout 360;
proxy_send_timeout 360;
proxy_connect_timeout 360;
proxy_set_header Host $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection upgrade;
proxy_set_header Accept-Encoding gzip;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_redirect http:// $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 64 256k;
set_real_ip_from 172.17.0.0/16;
set_real_ip_from 172.18.0.0/16;
set_real_ip_from 172.19.0.0/16;
set_real_ip_from 192.168.1.0/24;
set_real_ip_from 192.168.122.0/24;
real_ip_header CF-Connecting-IP;
real_ip_recursive on;
}
Within Authelia yml config I have this rule for home assistant:
rules:
- domain: "homeassistant.YOURDOMAIN.com"
subject:
- "group:admins"
policy: two_factor
Edit 21 July. Since 2021.7 you do need some of the http settings within the configuration.yaml: within Home Assistant :
http:
use_x_forwarded_for: true
trusted_proxies:
- 192.168.1.0/24
That way the nginx can use home assistant without https but it is still using https externally via Cloudflare. So far this is working for web internal & external and app internal & external.
This is pretty long and hopefully it mostly makes sense. Good luck 
I’ve got a reverse proxy enabled and working already so I’m just trying to augment that with this authentication package for HA.
