Why
Homelabbers commonly centralize auth through Authelia, Authentik, Keycloak, or Tailscale Auth rather than managing per-app passwords. But Hestia's current auth model (CLAUDE.md) is deliberately one system: a single household email/password account for remote login, with per-profile PINs gating restricted actions — not two parallel auth systems.
This needs a decision, not an implementation, first
- Does OIDC replace the household email/password login, or sit alongside it as an alternate way in?
- How does an OIDC-authenticated login map to "pick your avatar" — does it still land on the profile picker, or does OIDC map 1:1 to a specific profile?
- Does this pull in a new dependency (an OIDC client library) — worth weighing against the "keep the image light, avoid x86-only deps" constraint, though OIDC libraries are typically pure JS/no native binaries
Depends on
None.
Acceptance criteria
Why
Homelabbers commonly centralize auth through Authelia, Authentik, Keycloak, or Tailscale Auth rather than managing per-app passwords. But Hestia's current auth model (CLAUDE.md) is deliberately one system: a single household email/password account for remote login, with per-profile PINs gating restricted actions — not two parallel auth systems.
This needs a decision, not an implementation, first
Depends on
None.
Acceptance criteria