Is OAUTH possible without a public domain?

[Njitram2000]

I run a bunch of services on my homelab server that I want SSO on. After multiple attempts with the main options out there, I came to the conclusion that other than basic auth, all of them require a public domain. I have local domains for all my services (foo.myserver.home) which is served on the network by pihole DNS but they are not public and I don't want them to be.
Additionally, I'm intentionally using .home as LTD (which is not a valid public TLD) to avoid issues with potential DNS conflicts.

Then I discovered Tinyauth and it solved my problem. But I'm still limited to creating a USERS environment variable with the encoded password which is a long way removed from decent user management. But I was happy that I had something at last that works!

Now I see that V5 has OAUTH (eg via google) added. I suspected I would run into the same issue but I tried it anyway and got to this part:

So: does Tinyauth now have any options that allow user management that is a bit more flexible than hardcoded in an ENV file but works with non-public DNS?

[dosubot[bot]]

Hi @Njitram2000! I'm Dosu and I'm helping the Tinyauth team.

You're correct that OAuth with public providers (Google, GitHub, etc.) won't work with local-only domains like .home — that's a restriction imposed by the providers themselves (they require publicly accessible or localhost redirect URIs), not by Tinyauth [1].

However, Tinyauth does offer several user management options beyond the USERS env var that work perfectly on private networks [2]:

LDAP Integration — If you run OpenLDAP, FreeIPA, or Active Directory in your homelab, this gives you full directory-based user management with no public domain needed [3]. It supports group membership, TLS, and custom search filters.

Tailscale Authentication — If you're already using Tailscale for your homelab networking, Tinyauth can authenticate users based on their Tailscale identity [4]. Just set TINYAUTH_TAILSCALE_ENABLED=true with your API token and tailnet name [5].

Users File — A small improvement over the env var: you can point TINYAUTH_AUTH_USERSFILE to a file containing your users in username:hashed_password[:totp_secret] format [6] [7]. This at least makes editing easier and supports optional TOTP 2FA.

For a homelab without a public domain, LDAP is probably the most flexible "real" user management solution, and Tailscale is the easiest if you're already on that network.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[steveiliop56]

@Njitram2000 keep in mind that not all providers impose such limits in the redirect URI. For example, GitHub does allow .home domains. But if you need user management then I would recommend LLDP. Super lightweight and simple LDAP server that works amazingly well with Tinyauth.

Tailscale authentication is not yet released, it's in the current RC version.

[Njitram2000]

Thanks. Your response and the bot have given me some options to explore