Auth stack troubleshooting
How Cloudflare Access, Authentik, Vaultwarden, and YubiKeys fit together — and what breaks when each layer fails.
Stack diagram
flowchart TB
USER[Browser / app]
CF[Cloudflare Access edge]
AUTH[Authentik auth.saxobroko.com]
APP[Homelab app or Pages]
VAULT[Vaultwarden vault.saxobroko.com]
YUBI[YubiKey WebAuthn]
USER --> CF
CF -->|docs only OIDC| AUTH
CF -->|some apps| APP
AUTH --> APP
USER --> VAULT
USER --> YUBI
YUBI --> CF
YUBI --> VAULT| Layer | URL | Stores passwords? | FAQ |
|---|---|---|---|
| Cloudflare Access | Per-app at edge | No | CFL-*, AUTH-* |
| Authentik | auth.saxobroko.com | User accounts for SSO | AUTH-* |
| Vaultwarden | vault.saxobroko.com | All login secrets | VLT-* |
| YubiKey | Physical | WebAuthn keys | YUB-* |
Full setup doc: Authentik · Authentik app patterns · Bitwarden
Symptom → layer
| What happens | Failed layer | First fix |
|---|---|---|
| docs asks for Access → Authentik → error | Authentik OIDC or CF IdP | AUTH-* · authentik.md |
| Infinite redirect between CF and Authentik | Callback URL / client secret mismatch | AUTH-* |
| "User email was not returned" | Authentik scopes / claims | authentik.md |
| dash/stream loop login | Authentik provider for that app | AUTH-* · authentik-app-providers |
| Can't open Vaultwarden at all | Vault container or tunnel | VLT-* — fix this before resetting other passwords |
| YubiKey blinks, CF still fails | Wrong key slot or browser | YUB-* |
| Works in Chrome, not Safari | WebAuthn / passkey | YUB-* |
docs.saxobroko.com path (special case)
SaxDocs uses Cloudflare Pages (not tunnel) + Access + Authentik OIDC:
- Browser → Cloudflare Access challenge
- Redirect to Authentik authorize URL (
/application/o/authorize/) - Login at Authentik
- Callback to Cloudflare → static docs load
Bot Fight Mode previously broke OIDC — must stay off zone-wide. See authentik.md.
FAQ: DOC-* · Guide: open-docs-site
Homelab app path (tunnel + Authentik)
Most apps: *.saxobroko.com → tunnel → NPM or direct → Authentik forward auth (where configured) → app.
| App | Auth pattern | Doc |
|---|---|---|
| Homepage | Authentik in front | homepage |
| Jellyfin | App login (+ optional SSO) | Jellyfin |
| Vaultwarden | Server URL + master password | Bitwarden |
Recovery order (locked out)
- Physical access — home LAN
- Vaultwarden — master password from emergency kit (not in SaxDocs)
- Authentik — admin via TrueNAS app or break-glass account in Vaultwarden
- Cloudflare — account in Vaultwarden; last resort disable Access temporarily
- YubiKey — use portable key; desk key stays for CF dashboard
FAQ: VLT-* · YUB-* · LIF-* for Ryan
Adding a family member
- Authentik user + group → external-authentik-add-user
- Cloudflare Access policy (if needed for docs)
- Vaultwarden — share items via org/collection, never paste passwords in chat