Authelia

# MISSION: Scaffold "Authelia" Production Architecture
You are an expert Senior Staff Software Architect and Full-Stack Engineer. Your mission is to scaffold and implement a production-grade, highly reliable, and modular codebase following the proven architecture of **Authelia**.
---
## 1. PROJECT SPECIFICATIONS & BENCHMARK
- **Reference Architecture**: Authelia
- **What It Does**: Authelia is an open-source single sign-on and multi-factor authentication portal that sits in front of web applications, adding LDAP or file-based login, OpenID Connect, WebAuthn passkeys, TOTP and Duo push MFA behind a reverse proxy.
- **Domain & Category**: Authentication & SSO Proxy Companion
- **Production Scale**: 6-20 People
- **Development Mode**: CLASSIC
- **Architectural Rationale**: A single fasthttp-based Go binary keeps the authentication portal, OIDC provider, and MFA logic in one process with pluggable SQLite/MySQL/PostgreSQL storage, so it can run as a zero-dependency single instance or scale out with a shared database.
- **Live Website Reference**: https://www.authelia.com
- **Source Repository**: https://github.com/authelia/authelia
---
## 2. PRODUCTION TECH STACK
- **Full Stack Array**: Go, React, TypeScript, Vite, PostgreSQL, MySQL, SQLite, LDAP, WebAuthn, Redis
- **Primary Language(s)**: Go, TypeScript
- **License of the reference repo**: Apache-2.0
- **Frontend**: React — Builds the login/consent/registration portal served by the Go binary (web/package.json, React 19).; Vite — Dev server and production bundler for the web portal.; @simplewebauthn/browser — Client-side WebAuthn/passkey ceremonies in the portal.; i18next — Portal translations, loaded via i18next-http-backend and browser language detection.
- **Backend & APIs**: Go — The single authelia binary (cmd/authelia) implements the portal API, OIDC provider, LDAP/file authentication, and MFA.; fasthttp — HTTP server and router (fasthttp/router, valyala/fasthttp) instead of net/http.; authelia.com/provider/oauth2 — Authelia's own OAuth2/OpenID Connect provider implementation backing internal/oidc.; go-webauthn/webauthn — Server-side WebAuthn/passkey registration and assertion verification.; go-ldap/ldap — LDAP client used by the LDAP authentication backend (internal/authentication).
- **Data & persistence**: PostgreSQL — One of three first-class storage backends, via the jackc/pgx driver (internal/storage).; MySQL — MySQL/MariaDB storage backend via go-sql-driver/mysql.; SQLite — Default embedded storage backend for single-instance deployments, via mattn/go-sqlite3.; Redis — Session/notification cache backend; go-redis and redis/go-redis clients are present in the dependency graph.
- **Infrastructure & deploy**: Docker — Official image plus a coverage-instrumented and a dev variant (Dockerfile, Dockerfile.coverage, Dockerfile.dev).; Buildkite — Primary CI pipeline (build, integration/e2e suites) defined outside GitHub Actions.
- **Tooling, testing & ops**: GitHub Actions — CodeQL, OpenSSF Scorecard, SLSA provenance, and contributor-stats workflows.; Vitest — Portal unit tests with coverage instrumentation (VITE_COVERAGE env, vite-plugin-istanbul).; lefthook — Git hook runner installed via the portal package.json `prepare` script.
---
## 3. KEY ARCHITECTURAL DECISIONS (audited from https://github.com/authelia/authelia @ 8da42b2)
1. **One Go binary is the full authentication portal, OIDC provider, and MFA server**: cmd/authelia is the single entrypoint; internal/authentication, internal/authorization, internal/oidc, internal/webauthn, internal/totp, internal/duo, and internal/session all compile into one binary rather than separate services, so a deployment is one process plus its chosen storage/session backend.
2. **Storage is pluggable across SQLite, MySQL, and PostgreSQL by design**: go.mod directly requires mattn/go-sqlite3, go-sql-driver/mysql, and jackc/pgx/v5 together, and internal/storage implements a common interface over all three, so the same binary supports a zero-dependency single-instance setup (SQLite) or a shared database for multi-replica deployments (MySQL/PostgreSQL).
3. **fasthttp instead of the Go standard library net/http**: go.mod requires github.com/fasthttp/router and github.com/valyala/fasthttp as core dependencies for internal/server, trading some stdlib-idiomatic ergonomics for the lower allocation overhead fasthttp is designed for, which matters because Authelia sits in front of every request to the protected applications.
4. **Authelia built its own OAuth2/OIDC provider instead of adopting an off-the-shelf library**: go.mod requires authelia.com/provider/oauth2, a fork/derivative maintained under the Authelia org, which internal/oidc builds on to implement the OpenID Certified provider described in the README, giving the project direct control over spec compliance and the post-quantum-cryptography-ready claims.
5. **The web portal is a separate pnpm project embedded in the same repository**: web/package.json is its own pnpm workspace (pnpm 12, Node >=22.22) built with Vite and React 19; internal/server serves its production build as static assets, keeping the Go binary self-contained without a separate frontend deployment.
---
## 4. NON-NEGOTIABLE ARCHITECTURAL GUARDRAILS
1. **Monorepo & Modular Separation**:
   - Structure as a Turborepo monorepo with strict package boundaries:
     - `apps/web`: Application UI, routing, layouts, and server endpoints.
     - `packages/ui`: Shared design tokens, CSS variables, and Radix UI primitive components.
     - `packages/db`: Database schemas, client singleton, declarative migrations, and seed scripts.
     - `packages/config`: Shared TypeScript, ESLint, and build configurations.
2. **Strict Type Safety & Zero `any` Policy**:
   - Enable `strict: true`, `noImplicitAny: true`, and `strictNullChecks: true`.
   - Validate ALL external inputs, API request bodies, and query parameters with **Zod** schemas before execution.
3. **Frontend & Rendering Guidelines**:
   - Utilize Vite 6 with TanStack Router for fully type-safe routing. Manage server state and caching via TanStack Query v5 with optimistic UI updates.
4. **Design System & Aesthetics**:
   - Keep every color, radius, shadow and font in a single token file (CSS variables) and consume tokens everywhere; never hardcode hex values in components.
   - Prefer crisp 1px borders and one subtle shadow scale over blurry default shadows. Pair one sans-serif for body/headings with one monospace for tags, badges, metrics, and code.
5. **Data Layer & Reliability**:
   - Write declarative schema definitions with foreign keys, composite indexes on queried filters, and automated timestamp triggers.
   - Use connection pooling and prepared statements for serverless database execution.
---
## 5. STEP-BY-STEP SCAFFOLDING ROADMAP
- **Phase 1: Workspace & Root Config**: Initialize package manager, monorepo configuration (`turbo.json`, `tsconfig.base.json`, `package.json`).
- **Phase 2: Database Schema & Client**: Set up the data layer (PostgreSQL, MySQL, SQLite, Redis): client, connection pool, models, and migration scripts.
- **Phase 3: Design Tokens & UI Primitives**: Build accessible `Button`, `Input`, `Card`, `Badge`, and layout wrappers inside `packages/ui`.
- **Phase 4: Core Application Routes & Handlers**: Implement primary authentication, user session handling, and application routes.
- **Phase 5: Quality Assurance & Build Verification**: Run `tsc --noEmit`, ESLint, Prettier, and smoke test suites to ensure zero compilation or runtime errors.
---
## 6. EXECUTION INSTRUCTIONS
1. Review all specifications, architectural guardrails, and stack choices above.
2. Present the full monorepo directory tree structure.
3. Systematically generate the complete, production-ready codebase according to the 5-phase roadmap above — starting with the root workspace setup, followed by the database schema, UI design system package, and full-stack application routes until the repository is fully scaffolded and ready to run.