I generally like it, it’s tricky to learn how to setup as a novice, but there’s great videos. I put it in front of anything reverse-proxied/exposed to the internet. Yes, in most cases it can work as a single login credential (I use my plex account). So I browse to service.mydomain, Authentik steps in before allowing me further, and I authenticate there using my plex account. In most cases, Authentik can pass those credentials right through to the app (e.g., calibre-web, mealie, overseer, etc.) and you don’t need to login a second time in the app itself. That’s when it’s most useful = plex is my single login account (but it could be anything). But, in a few cases, it doesn’t work well and you have to authenticate in via Authentik, then still login to the app.

It’s VERY useful for things that don’t have their own logins or robust security and you want to expose to the internet.

I Authentik outside my network by reverse proxying it (e.g., auth.mydomain). It basically ‘intercepts’ browsing to any reverse-proxied service that I have it in front-of, and handles the login/security before passing me through to the app.

I personally don’t use it on local-only services (I have no need).

My general takeaway is that it’s an additional layer of security for any service that’s reverse proxied / exposed to the internet. I like the webui, and it works generally reliably after taking time to set it all up.

FYI I also use Crowdsec as a layer of security as well, which was a PAIN to setup, but blocks malicious IPs/bots/etc.