Authentik: one login for everything
A single Authentik core with a lightweight outpost on every host: forward-auth for apps that can’t do auth, OIDC for apps that can, config as code where the product allows, and four pitfalls ranked by how down production went.