I manage a pretty modest homelab. A couple of boxes, some daily-driver services, a bunch of Docker-y OSS on VPSes, and the whole thing exists partly because I like owning the data and partly because I do not want to keep paying for convenience forever.
So when I started thinking about central login for the homelab, it was never going to be a giant enterprise identity project. I already had enough moving parts.
This is the follow-up to the setup note here: How to configure Pocket ID passkey login for Proxmox VE with OIDC groups.
What I was seeing
I have three homelab machines running 24/7 and they cover a fair bit of home stuff plus my own workflow. One of them is basically the control-plane box, and it already has enough on its plate:
- Home Assistant
- AdGuard / DNS stuff
- MQTT
- Zigbee2MQTT
- Nginx Proxy Manager
- a handful of supporting LXCs and VMs
So when I dropped in Pocket ID and Authentik side by side, I immediately had that very familiar feeling of: yep, one of these is gonna be the “nice idea” and one of these is gonna be the “my tiny micro box is grumbling now” thing.
That box is a Dell OptiPlex Micro. It is a lovely little workhorse, but it is not some giant auth appliance. It is already doing real work. I am truly thankful for the stability it provides. It was literally not shut down for 388 days (and counting) - only did some hot restarts due to updates.
What I actually wanted
The list was pretty small:
- passkey login
- OIDC
- separate users
- basic group-based access
- family accounts
- Proxmox VE support
- something that would not become a weekend project just to keep alive
That is it. No grand identity architecture. No “let me design a whole policy universe while I’m here.”
Pocket ID fits that shape nicely.
It is passkey-first, OIDC-first, and it does not make me drag passwords back into the middle of the story just because that is what older systems are used to.
Users authenticate with passkeys, apps get OIDC, done. Clean enough.
Why Authentik felt heavier
Authentik is actually great software. I mean that.
But it is also a much bigger piece of machinery.
Think of Authentik as a semi truck compared to the Pocket ID as the Japanese Kei mini trucks.
The first thing that jumped out at me was the PostgreSQL dependency and the general shape of the stack. Authentik is built to handle a lot of different problems: SaaS-ish stuff, legacy integration, more complex access logic, proxying for apps that do not speak OIDC, all of that.
That is useful. Just not for this.
When I checked it on my little Proxmox box, the idle footprint was noticeable. RAM was sitting around the 4 GB range, CPU was still hanging around even when nothing interesting was happening, and it was immediately obvious that this was going to be a bit much for a service I mainly wanted to keep boring.
Pocket ID, on the other hand, was sitting there on 1 CPU and 512 MB RAM like it had better things to do with its life. Idle CPU basically nothing, memory tiny. That distinction mattered a lot.
I do not need auth to be dramatic. I need it to work.
Why I did not just say “sure, Authentik does more”
Because I don’t need “more” right now.
If I wanted:
- SAML
- LDAP
- RADIUS
- more complex policy flows
- multiple upstream identity sources
- built-in forward auth for a pile of legacy apps
- heavier enterprise-style lifecycle stuff
then yeah, Authentik starts looking a lot more sensible.
And to be fair, it can do a lot. A lot.
But the question is not “can it do a lot?”
The question is whether I actually need that extra surface area for a smaller homelab login path.
At the moment, no.
The family side still works
I also wanted something that did not assume this was just me logging into everything.
Pocket ID works fine with separate users and per-group access, so I can keep the admin stuff locked to homelab-admins and still expose selected stuff to family or media-users or whatever else makes sense.
That matters. I do not want one shared login blob. That gets messy fast and then nobody knows who broke what.
The setup shape also pushed the answer
The reverse-proxy side is already in place, so I was not looking to redesign the front door just to get auth working.
The path is already basically:
Client → DNS → reverse proxy → application
Pocket ID fits into that without making a mess.
For OIDC-aware apps, that is enough. For apps that do not speak OIDC, I can leave them local-only, LAN-only, or bolt on something like oauth2-proxy only where it actually earns its keep.
That felt way better than running a full identity platform all the time just because one or two apps might someday need something fancier.
So yeah, that was the call
Pocket ID was the smaller tool that matched the actual problem.
Authentik would be a better answer if I had a more complicated identity world, more legacy apps, or a real need for forward auth and the rest of the baggage.
But I did not. I just wanted passkeys, OIDC, Proxmox, family accounts, and something that would stay out of the way.
So I picked the small thing.
So to summarize all that
Pocket ID won because it was enough:
- passkey-first
- OIDC-friendly
- works with Proxmox VE
- tiny footprint
- simple to keep running
- less likely to become one more service I have to babysit
Authentik is still on the table for later if I ever need the broader feature set. But for this homelab setup, that would have been me solving a problem I do not actually have yet.
And that is usually how you end up with more maintenance than value.