Vaultwarden
A self-hosted Vaultwarden deployment — a lightweight, Bitwarden-compatible password manager server, reachable from anywhere by design so official Bitwarden mobile/browser-extension/desktop clients keep working. Login is gated by the master password, with Authelia wired up as a genuine optional SSO login on top, not a network-level gate (a reverse-proxy SSO wall would break every official client, since they talk to the server’s REST API directly and can’t complete a browser redirect).