Another Victim of the SSO Tax: How r/selfhosted is Dodging the Paywall

It happened again. You spin up a fresh Docker container for a sleek new open-source app, everything works perfectly, and you go to hook it up to your central auth system. Suddenly, you hit a popup. Single Sign-On is an “Enterprise” feature. That will be $5 per user per month, please.

Welcome to the SSO tax.

It’s the most infuriating trend in self-hosting. Companies build massive user bases by giving away the core product open-source, then hold basic identity management features hostage behind absurd corporate paywalls. Charging an extra $10 a month just to connect Authentik or Authelia to your own media server? Give me a break. I love this tool, but it has one fatal flaw, and the community is finally drawing a line.

The Frustration is Real #

A recent rant on r/selfhosted blew up because a user realized they couldn’t secure their home lab without shelling out for a corporate plan. The pricing walls are getting ridiculous. Vaultwarden costs exactly $0 to run and handles your passwords. But God forbid you want to use Okta or Keycloak to log into your helpdesk app without upgrading to the $240/month tier.

Reddit user u/homelab_cassandra hit the nail on the head:

“It’s straight-up extortion. They open-source the core app knowing individuals will self-host, test, and debug it for them. Then they lock SAML and OIDC behind a paywall because they know businesses willing to deploy it will just write the check.”

She’s completely right. The entire business model relies on you providing free QA.

Reverse Proxies to the Rescue #

So what do you do when you refuse to pay the SSO tax? You hack around it at the proxy layer.

The community is strongly divided on the best proxy stack, but the current winner for brute-forcing auth into apps that refuse to support it natively is Authelia running behind a reverse proxy. The setup isn’t simple, but it gets the job done. Another heavy-hitter is OAuth2 Proxy. You route your traffic, intercept the incoming request, and force an authentication check before it ever touches the containerized app.

u/proxy_ninja offered this gem in the thread:

“If the app supports basic auth, you can put Authelia in front and use the headers plugin. It’s a brutal hack and it completely breaks mobile apps that don’t respect browser redirects, but it’s the only way I got BookStack and Arr stack to play nice without paying Nextcloud prices.”

I haven’t tested this on ARM architecture yet, mainly because my personal grudge against proxypaloozas has kept me from deploying it across my entire stack, but your mileage may vary.

The community is also split between Traefik and Nginx Proxy Manager (NPM) for this exact setup. NPM is easier for beginners—wrapping your head around NPM’s SSL certificate management takes maybe 10 minutes—while Traefik’s dynamic config is arguably faster once you understand the YAML labels. But if your Docker overhead is already pushing 2GB of RAM on a low-spec VPS, running a heavy proxy stack just to fake an SSO layer is overkill for most people. You’re burning compute to fix a UI bug in a paywall.

Just Abandon Ship #

Honestly, the best solution is to abandon the offending software entirely.

If an open-source project treats SSO as a premium luxury, drop it. We have perfectly good alternatives. Running an Azure AD alternative? JumpCloud gives you 10 users and 10 devices for free. As for the apps holding features hostage, deprecate them. There are purely community-driven projects out there actively rejecting this bait-and-switch model. They don’t have “Enterprise” tiers because they actually want you to secure your homelab.

At the end of the day, self-hosting is about total control. Don’t let a corporate paywall living inside an open-source repo trick you. Fork the repo, patch the feature, or just move on to something that respects users.