diff --git a/lang/sk.json b/lang/sk.json
index 333b8e36..080cf8a4 100644
--- a/lang/sk.json
+++ b/lang/sk.json
@@ -616,6 +616,9 @@
   "Authorize this key on the server": "Autorizovať tento kľúč na serveri",
   "Authorize via 'pct exec' (Borg server is an LXC on a PVE host I can SSH into)": "Autorizovať cez 'pct exec' (Borg server je LXC na PVE hostovi, kam sa viem pripojiť cez SSH)",
   "Authorized": "Autorizované",
+  "Authelia administrator": "Správca Authelia",
+  "Authelia session cookie domain for this portal (for example example.com)": "Doména súboru cookie relácie Authelia pre tento portál (napríklad example.com)",
+  "Authelia Web UI": "Webové rozhranie Authelia",
   "Auto-detected firewall backend (nftables/iptables)": "Automaticky zistený firewall backend (nftables/iptables)",
   "Auto-discover servers on network": "Automaticky nájsť servery v sieti",
   "Auto-importing ZFS data pools from backup...": "Automaticky importujem ZFS dátové pooly zo zálohy...",
@@ -5404,6 +5407,7 @@
   "Public UDP port peers connect to": "Verejný port UDP na pripojenie účastníkov",
   "Public URL of phpMyAdmin when it is served behind a reverse proxy": "Verejné URL phpMyAdmin, keď sa podáva za reverzným proxy",
   "Public URL used to access Baserow (for example https://baserow.example.com)": "Verejná adresa URL na prístup k Baserow (napríklad https://baserow.example.com)",
+  "Public HTTPS URL used to open this Authelia portal (for example https://auth.example.com)": "Verejná adresa HTTPS na otvorenie tohto portálu Authelia (napríklad https://auth.example.com)",
   "Public address clients connect to (vpn.example.com or a public IP)": "Verejná adresa na pripojenie klientov (vpn.example.com alebo verejná IP adresa)",
   "Public address peers connect to, or auto to detect it (vpn.example.com)": "Verejná adresa, ku ktorej sa pripájajú účastníci, alebo auto na jej zistenie (vpn.example.com)",
   "Publish each directory from Resources: open it, switch on SMB, NFS or both, and save.": "Zverejnite každý adresár zo zdrojov: otvorte ho, zapnite SMB, NFS alebo oboje a uložte.",
@@ -6461,6 +6465,7 @@
   "Single-node log storage and query UI.": "Úložisko logov a vyhľadávacie rozhranie pre jeden uzol.",
   "Single-node observability database for metrics, logs and traces.": "Databáza na jednom uzle na ukladanie metrík, logov a záznamov o priebehu požiadaviek.",
   "Single-server website CMS and visual editor with SQLite-backed content, media uploads, forms, and publishing.": "Webový CMS a vizuálny editor pre jeden server s obsahom uloženým v SQLite, nahrávaním médií, formulármi a publikovaním.",
+  "Single sign-on and multi-factor authentication": "Jednotné prihlásenie a viacfaktorové overovanie",
   "Size": "Veľkosť",
   "Size in GB of": "Veľkosť v GB pre",
   "Size of each consume/export volume in GB": "Veľkosť každého dátového zväzku pre consume a export v GB",
diff --git a/oci/catalog/apps/authelia.json b/oci/catalog/apps/authelia.json
new file mode 100644
index 00000000..adcb37c6
--- /dev/null
+++ b/oci/catalog/apps/authelia.json
@@ -0,0 +1,453 @@
+{
+  "schema_version": "0.4.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-authelia",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "Authelia",
+      "es_ES": "Authelia"
+    },
+    "tagline": {
+      "en_US": "Single sign-on and multi-factor authentication",
+      "es_ES": "Inicio de sesión único y autenticación multifactor"
+    },
+    "description": {
+      "en_US": "An open-source authentication and authorization server for protecting web applications. This single-image profile provides a local SQLite database and file notifications; configure your domain, reverse proxy and access rules before protecting other services.",
+      "es_ES": "Servidor de autenticación y autorización de código abierto para proteger aplicaciones web. Este perfil de una sola imagen incluye una base de datos SQLite local y notificaciones en archivo; configura el dominio, el proxy inverso y las reglas de acceso antes de proteger otros servicios."
+    },
+    "category": "security",
+    "category_label": "Authentication & Security",
+    "author": "Authelia",
+    "developer": "Authelia",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/authelia.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 9091,
+      "path": "/"
+    },
+    "website": "https://www.authelia.com/",
+    "documentation": "https://www.authelia.com/integration/deployment/docker/",
+    "repository": "https://github.com/authelia/authelia",
+    "tips": [
+      "The installer creates a unique admin password and stores only its Argon2id hash in /config/users_database.yml. The password is shown in the installation result.",
+      "Authelia requires an HTTPS portal URL and a cookie domain matching that hostname. If you use Nginx Proxy Manager, follow the official integration guide and configure trusted proxies and forward-auth separately.",
+      "The default notifier writes messages to /config/notification.txt. Configure SMTP in /config/configuration.yml if you want email delivery.",
+      "The initial access-control policy is one_factor. Add explicit access-control rules before attaching Authelia to protected proxy hosts."
+    ],
+    "mini_changelog": [],
+    "display_version": "4.39.28",
+    "updated_at": "2026-09-17"
+  },
+  "source": {
+    "provider": "authelia",
+    "repository": "https://github.com/authelia/authelia",
+    "default_branch": "master",
+    "revision": "8da42b2348b0351c6284a2940a9c5eec3d4cd3fd",
+    "readme_raw_url": "https://raw.githubusercontent.com/authelia/authelia/v4.39.28/examples/compose/lite/compose.yml",
+    "readme_pushed_at": "2026-09-17T12:13:30Z",
+    "compose_sha256": "848ce0f70e502981a050ac200d9d1882978a6c3b0f9f0dfcc6d52ce66ca37fb5",
+    "generated_at": "2026-11-03T09:10:57+00:00",
+    "image_repository_url": "https://hub.docker.com/r/authelia/authelia"
+  },
+  "container_contract": {
+    "service_name": "authelia",
+    "container_name": "authelia",
+    "image": {
+      "reference": "docker.io/authelia/authelia:4.39.28",
+      "registry": "docker.io",
+      "repository": "docker.io/authelia/authelia",
+      "tag": "4.39.28",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "PROXMENUX_ADMIN_PASSWORD",
+        "example": "",
+        "required": true,
+        "sensitive": true,
+        "source": "proxmenux-first-start"
+      },
+      {
+        "name": "AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET",
+        "example": "",
+        "required": true,
+        "sensitive": true,
+        "source": "proxmenux-generated"
+      },
+      {
+        "name": "AUTHELIA_SESSION_SECRET",
+        "example": "",
+        "required": true,
+        "sensitive": true,
+        "source": "proxmenux-generated"
+      },
+      {
+        "name": "AUTHELIA_STORAGE_ENCRYPTION_KEY",
+        "example": "",
+        "required": true,
+        "sensitive": true,
+        "source": "proxmenux-generated"
+      },
+      {
+        "name": "X_AUTHELIA_CONFIG_FILTERS",
+        "example": "template",
+        "required": true,
+        "sensitive": false,
+        "source": "authelia-container"
+      },
+      {
+        "name": "PROXMENUX_AUTHELIA_COOKIE_DOMAIN",
+        "example": "",
+        "prompt": "Authelia session cookie domain for this portal (for example example.com)",
+        "required": true,
+        "sensitive": false,
+        "source": "administrator"
+      },
+      {
+        "name": "PROXMENUX_AUTHELIA_URL",
+        "example": "",
+        "prompt": "Public HTTPS URL used to open this Authelia portal (for example https://auth.example.com)",
+        "required": true,
+        "sensitive": false,
+        "source": "administrator"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "config",
+        "container_path": "/config",
+        "compose_source_example": "./authelia",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 4
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 9091,
+        "published_example": 9091,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "services:\n  authelia:\n    entrypoint:\n    - /bin/sh\n    - /usr/local/bin/proxmenux-authelia-bootstrap\n    environment:\n      AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET: ${GENERATED_RESET_PASSWORD_JWT_SECRET}\n      AUTHELIA_SESSION_SECRET: ${GENERATED_SESSION_SECRET}\n      AUTHELIA_STORAGE_ENCRYPTION_KEY: ${GENERATED_STORAGE_ENCRYPTION_KEY}\n      PROXMENUX_ADMIN_PASSWORD: ${GENERATED_ADMIN_PASSWORD}\n      PROXMENUX_AUTHELIA_COOKIE_DOMAIN: ${AUTHELIA_COOKIE_DOMAIN}\n      PROXMENUX_AUTHELIA_URL: ${AUTHELIA_URL}\n      X_AUTHELIA_CONFIG_FILTERS: template\n    image: docker.io/authelia/authelia:4.39.28\n    ports:\n    - 9091:9091\n    restart: unless-stopped\n    volumes:\n    - ./authelia:/config\n"
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "Authelia Web UI",
+        "scheme": "http",
+        "port": 9091,
+        "path": "/",
+        "source": "official-image"
+      }
+    ],
+    "credentials": [
+      {
+        "label": "Authelia administrator",
+        "type": "configured-or-installer-generated",
+        "username": "admin",
+        "password": null,
+        "password_environment": "PROXMENUX_ADMIN_PASSWORD",
+        "change_required": false,
+        "source": "Generated on first start and stored as an Argon2id hash in the persistent users file."
+      }
+    ]
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 512,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 60
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "installer_profile": {
+      "runtime": {
+        "compose_entrypoint": [
+          "/bin/sh",
+          "/usr/local/bin/proxmenux-authelia-bootstrap"
+        ]
+      },
+      "generated_sensitive_environment": {
+        "PROXMENUX_ADMIN_PASSWORD": {
+          "strategy": "token-hex",
+          "bytes": 24,
+          "prompt": false
+        },
+        "AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET": {
+          "strategy": "token-hex",
+          "bytes": 32,
+          "prompt": false
+        },
+        "AUTHELIA_SESSION_SECRET": {
+          "strategy": "token-hex",
+          "bytes": 32,
+          "prompt": false
+        },
+        "AUTHELIA_STORAGE_ENCRYPTION_KEY": {
+          "strategy": "token-hex",
+          "bytes": 32,
+          "prompt": false
+        }
+      },
+      "minimum_secret_length": {
+        "PROXMENUX_ADMIN_PASSWORD": 24,
+        "AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET": 32,
+        "AUTHELIA_SESSION_SECRET": 32,
+        "AUTHELIA_STORAGE_ENCRYPTION_KEY": 32
+      },
+      "generated_files": [
+        {
+          "container_path": "/config/configuration.yml",
+          "mode": "0600",
+          "owner": "mapped-root",
+          "only_if_missing": true,
+          "content": "---\nserver:\n  address: 'tcp://:9091'\n\nlog:\n  level: 'info'\n\ntotp:\n  issuer: 'Authelia'\n\nidentity_validation:\n  reset_password:\n    jwt_secret: 'configured-by-environment'\n\nauthentication_backend:\n  file:\n    path: '/config/users_database.yml'\n    watch: true\n\naccess_control:\n  default_policy: 'one_factor'\n\nsession:\n  secret: 'configured-by-environment'\n  cookies:\n    - name: 'authelia_session'\n      domain: '{{ env \"PROXMENUX_AUTHELIA_COOKIE_DOMAIN\" }}'\n      authelia_url: '{{ env \"PROXMENUX_AUTHELIA_URL\" }}'\n      expiration: '1 hour'\n      inactivity: '5 minutes'\n\nstorage:\n  encryption_key: 'configured-by-environment'\n  local:\n    path: '/config/db.sqlite3'\n\nnotifier:\n  filesystem:\n    filename: '/config/notification.txt'\n"
+        },
+        {
+          "container_path": "/usr/local/bin/proxmenux-authelia-bootstrap",
+          "mode": "0700",
+          "owner": "mapped-root",
+          "only_if_missing": false,
+          "content": "#!/bin/sh\nset -eu\numask 077\n\nusers_file=/config/users_database.yml\nif [ ! -s \"$users_file\" ]; then\n  : \"${PROXMENUX_ADMIN_PASSWORD:?ProxMenux did not provide an initial administrator password}\"\n  mkdir -p /config\n  hash_output=$(authelia crypto hash generate argon2 --password \"$PROXMENUX_ADMIN_PASSWORD\" --no-confirm)\n  password_hash=$(printf '%s\\n' \"$hash_output\" | sed -n 's/^Digest: //p')\n  case \"$password_hash\" in\n    '$argon2id$'*) ;;\n    *) printf '%s\\n' 'Authelia did not return an Argon2id password hash' >&2; exit 1 ;;\n  esac\n  temporary_file=\"${users_file}.tmp.$$\"\n  cat >\"$temporary_file\" <<EOF\nusers:\n  admin:\n    disabled: false\n    displayname: 'Authelia Administrator'\n    password: \"$password_hash\"\n    groups:\n      - 'admins'\nEOF\n  chmod 0600 \"$temporary_file\"\n  mv -f \"$temporary_file\" \"$users_file\"\nfi\nunset PROXMENUX_ADMIN_PASSWORD\nexec /app/entrypoint.sh \"$@\"\n"
+        }
+      ],
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 9091,
+        "path": "/api/health",
+        "timeout_seconds": 240,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      }
+    },
+    "adaptations": [
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "The application listens on the same container ports at its dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Users open the LXC address instead of the Proxmox host address.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-environment-overlay",
+        "upstream_behavior": "Compose environment values override OCI image environment values.",
+        "native_lxc_behavior": "ProxMenux merges the same values into lxc.environment.runtime while the CT is stopped.",
+        "reason": "PVE imports image Env automatically; Compose values still need to override it.",
+        "behavioral_impact": "None expected.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "stop-grace-period",
+        "upstream_behavior": "Docker waits for Compose stop_grace_period before forcing termination.",
+        "native_lxc_behavior": "ProxMenux records the same timeout for its pct shutdown lifecycle operations.",
+        "reason": "Proxmox has no equivalent per-CT persistent restart-policy field; startup.down is not a shutdown timeout.",
+        "behavioral_impact": "Normal Proxmox node shutdown remains governed by the node-wide shutdown policy.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ]
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "stop_signal",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "A single-image profile for the Authelia authentication portal. ProxMenux creates a unique initial administrator account; the local notifier and SQLite storage are kept in /config. Reverse-proxy trust and explicit access-control rules remain administrator settings."
+  },
+  "validation": {
+    "schema": "pending-local-validation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "replace-rootfs-from-new-oci-image-preserve-managed-volumes",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}
diff --git a/oci/catalog/curated/authelia.json b/oci/catalog/curated/authelia.json
new file mode 100644
index 00000000..adcb37c6
--- /dev/null
+++ b/oci/catalog/curated/authelia.json
@@ -0,0 +1,453 @@
+{
+  "schema_version": "0.4.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-authelia",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "Authelia",
+      "es_ES": "Authelia"
+    },
+    "tagline": {
+      "en_US": "Single sign-on and multi-factor authentication",
+      "es_ES": "Inicio de sesión único y autenticación multifactor"
+    },
+    "description": {
+      "en_US": "An open-source authentication and authorization server for protecting web applications. This single-image profile provides a local SQLite database and file notifications; configure your domain, reverse proxy and access rules before protecting other services.",
+      "es_ES": "Servidor de autenticación y autorización de código abierto para proteger aplicaciones web. Este perfil de una sola imagen incluye una base de datos SQLite local y notificaciones en archivo; configura el dominio, el proxy inverso y las reglas de acceso antes de proteger otros servicios."
+    },
+    "category": "security",
+    "category_label": "Authentication & Security",
+    "author": "Authelia",
+    "developer": "Authelia",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/authelia.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 9091,
+      "path": "/"
+    },
+    "website": "https://www.authelia.com/",
+    "documentation": "https://www.authelia.com/integration/deployment/docker/",
+    "repository": "https://github.com/authelia/authelia",
+    "tips": [
+      "The installer creates a unique admin password and stores only its Argon2id hash in /config/users_database.yml. The password is shown in the installation result.",
+      "Authelia requires an HTTPS portal URL and a cookie domain matching that hostname. If you use Nginx Proxy Manager, follow the official integration guide and configure trusted proxies and forward-auth separately.",
+      "The default notifier writes messages to /config/notification.txt. Configure SMTP in /config/configuration.yml if you want email delivery.",
+      "The initial access-control policy is one_factor. Add explicit access-control rules before attaching Authelia to protected proxy hosts."
+    ],
+    "mini_changelog": [],
+    "display_version": "4.39.28",
+    "updated_at": "2026-09-17"
+  },
+  "source": {
+    "provider": "authelia",
+    "repository": "https://github.com/authelia/authelia",
+    "default_branch": "master",
+    "revision": "8da42b2348b0351c6284a2940a9c5eec3d4cd3fd",
+    "readme_raw_url": "https://raw.githubusercontent.com/authelia/authelia/v4.39.28/examples/compose/lite/compose.yml",
+    "readme_pushed_at": "2026-09-17T12:13:30Z",
+    "compose_sha256": "848ce0f70e502981a050ac200d9d1882978a6c3b0f9f0dfcc6d52ce66ca37fb5",
+    "generated_at": "2026-11-03T09:10:57+00:00",
+    "image_repository_url": "https://hub.docker.com/r/authelia/authelia"
+  },
+  "container_contract": {
+    "service_name": "authelia",
+    "container_name": "authelia",
+    "image": {
+      "reference": "docker.io/authelia/authelia:4.39.28",
+      "registry": "docker.io",
+      "repository": "docker.io/authelia/authelia",
+      "tag": "4.39.28",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "PROXMENUX_ADMIN_PASSWORD",
+        "example": "",
+        "required": true,
+        "sensitive": true,
+        "source": "proxmenux-first-start"
+      },
+      {
+        "name": "AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET",
+        "example": "",
+        "required": true,
+        "sensitive": true,
+        "source": "proxmenux-generated"
+      },
+      {
+        "name": "AUTHELIA_SESSION_SECRET",
+        "example": "",
+        "required": true,
+        "sensitive": true,
+        "source": "proxmenux-generated"
+      },
+      {
+        "name": "AUTHELIA_STORAGE_ENCRYPTION_KEY",
+        "example": "",
+        "required": true,
+        "sensitive": true,
+        "source": "proxmenux-generated"
+      },
+      {
+        "name": "X_AUTHELIA_CONFIG_FILTERS",
+        "example": "template",
+        "required": true,
+        "sensitive": false,
+        "source": "authelia-container"
+      },
+      {
+        "name": "PROXMENUX_AUTHELIA_COOKIE_DOMAIN",
+        "example": "",
+        "prompt": "Authelia session cookie domain for this portal (for example example.com)",
+        "required": true,
+        "sensitive": false,
+        "source": "administrator"
+      },
+      {
+        "name": "PROXMENUX_AUTHELIA_URL",
+        "example": "",
+        "prompt": "Public HTTPS URL used to open this Authelia portal (for example https://auth.example.com)",
+        "required": true,
+        "sensitive": false,
+        "source": "administrator"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "config",
+        "container_path": "/config",
+        "compose_source_example": "./authelia",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 4
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 9091,
+        "published_example": 9091,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "services:\n  authelia:\n    entrypoint:\n    - /bin/sh\n    - /usr/local/bin/proxmenux-authelia-bootstrap\n    environment:\n      AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET: ${GENERATED_RESET_PASSWORD_JWT_SECRET}\n      AUTHELIA_SESSION_SECRET: ${GENERATED_SESSION_SECRET}\n      AUTHELIA_STORAGE_ENCRYPTION_KEY: ${GENERATED_STORAGE_ENCRYPTION_KEY}\n      PROXMENUX_ADMIN_PASSWORD: ${GENERATED_ADMIN_PASSWORD}\n      PROXMENUX_AUTHELIA_COOKIE_DOMAIN: ${AUTHELIA_COOKIE_DOMAIN}\n      PROXMENUX_AUTHELIA_URL: ${AUTHELIA_URL}\n      X_AUTHELIA_CONFIG_FILTERS: template\n    image: docker.io/authelia/authelia:4.39.28\n    ports:\n    - 9091:9091\n    restart: unless-stopped\n    volumes:\n    - ./authelia:/config\n"
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "Authelia Web UI",
+        "scheme": "http",
+        "port": 9091,
+        "path": "/",
+        "source": "official-image"
+      }
+    ],
+    "credentials": [
+      {
+        "label": "Authelia administrator",
+        "type": "configured-or-installer-generated",
+        "username": "admin",
+        "password": null,
+        "password_environment": "PROXMENUX_ADMIN_PASSWORD",
+        "change_required": false,
+        "source": "Generated on first start and stored as an Argon2id hash in the persistent users file."
+      }
+    ]
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 512,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 60
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "installer_profile": {
+      "runtime": {
+        "compose_entrypoint": [
+          "/bin/sh",
+          "/usr/local/bin/proxmenux-authelia-bootstrap"
+        ]
+      },
+      "generated_sensitive_environment": {
+        "PROXMENUX_ADMIN_PASSWORD": {
+          "strategy": "token-hex",
+          "bytes": 24,
+          "prompt": false
+        },
+        "AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET": {
+          "strategy": "token-hex",
+          "bytes": 32,
+          "prompt": false
+        },
+        "AUTHELIA_SESSION_SECRET": {
+          "strategy": "token-hex",
+          "bytes": 32,
+          "prompt": false
+        },
+        "AUTHELIA_STORAGE_ENCRYPTION_KEY": {
+          "strategy": "token-hex",
+          "bytes": 32,
+          "prompt": false
+        }
+      },
+      "minimum_secret_length": {
+        "PROXMENUX_ADMIN_PASSWORD": 24,
+        "AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET": 32,
+        "AUTHELIA_SESSION_SECRET": 32,
+        "AUTHELIA_STORAGE_ENCRYPTION_KEY": 32
+      },
+      "generated_files": [
+        {
+          "container_path": "/config/configuration.yml",
+          "mode": "0600",
+          "owner": "mapped-root",
+          "only_if_missing": true,
+          "content": "---\nserver:\n  address: 'tcp://:9091'\n\nlog:\n  level: 'info'\n\ntotp:\n  issuer: 'Authelia'\n\nidentity_validation:\n  reset_password:\n    jwt_secret: 'configured-by-environment'\n\nauthentication_backend:\n  file:\n    path: '/config/users_database.yml'\n    watch: true\n\naccess_control:\n  default_policy: 'one_factor'\n\nsession:\n  secret: 'configured-by-environment'\n  cookies:\n    - name: 'authelia_session'\n      domain: '{{ env \"PROXMENUX_AUTHELIA_COOKIE_DOMAIN\" }}'\n      authelia_url: '{{ env \"PROXMENUX_AUTHELIA_URL\" }}'\n      expiration: '1 hour'\n      inactivity: '5 minutes'\n\nstorage:\n  encryption_key: 'configured-by-environment'\n  local:\n    path: '/config/db.sqlite3'\n\nnotifier:\n  filesystem:\n    filename: '/config/notification.txt'\n"
+        },
+        {
+          "container_path": "/usr/local/bin/proxmenux-authelia-bootstrap",
+          "mode": "0700",
+          "owner": "mapped-root",
+          "only_if_missing": false,
+          "content": "#!/bin/sh\nset -eu\numask 077\n\nusers_file=/config/users_database.yml\nif [ ! -s \"$users_file\" ]; then\n  : \"${PROXMENUX_ADMIN_PASSWORD:?ProxMenux did not provide an initial administrator password}\"\n  mkdir -p /config\n  hash_output=$(authelia crypto hash generate argon2 --password \"$PROXMENUX_ADMIN_PASSWORD\" --no-confirm)\n  password_hash=$(printf '%s\\n' \"$hash_output\" | sed -n 's/^Digest: //p')\n  case \"$password_hash\" in\n    '$argon2id$'*) ;;\n    *) printf '%s\\n' 'Authelia did not return an Argon2id password hash' >&2; exit 1 ;;\n  esac\n  temporary_file=\"${users_file}.tmp.$$\"\n  cat >\"$temporary_file\" <<EOF\nusers:\n  admin:\n    disabled: false\n    displayname: 'Authelia Administrator'\n    password: \"$password_hash\"\n    groups:\n      - 'admins'\nEOF\n  chmod 0600 \"$temporary_file\"\n  mv -f \"$temporary_file\" \"$users_file\"\nfi\nunset PROXMENUX_ADMIN_PASSWORD\nexec /app/entrypoint.sh \"$@\"\n"
+        }
+      ],
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 9091,
+        "path": "/api/health",
+        "timeout_seconds": 240,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      }
+    },
+    "adaptations": [
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "The application listens on the same container ports at its dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Users open the LXC address instead of the Proxmox host address.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-environment-overlay",
+        "upstream_behavior": "Compose environment values override OCI image environment values.",
+        "native_lxc_behavior": "ProxMenux merges the same values into lxc.environment.runtime while the CT is stopped.",
+        "reason": "PVE imports image Env automatically; Compose values still need to override it.",
+        "behavioral_impact": "None expected.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "stop-grace-period",
+        "upstream_behavior": "Docker waits for Compose stop_grace_period before forcing termination.",
+        "native_lxc_behavior": "ProxMenux records the same timeout for its pct shutdown lifecycle operations.",
+        "reason": "Proxmox has no equivalent per-CT persistent restart-policy field; startup.down is not a shutdown timeout.",
+        "behavioral_impact": "Normal Proxmox node shutdown remains governed by the node-wide shutdown policy.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ]
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "stop_signal",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "A single-image profile for the Authelia authentication portal. ProxMenux creates a unique initial administrator account; the local notifier and SQLite storage are kept in /config. Reverse-proxy trust and explicit access-control rules remain administrator settings."
+  },
+  "validation": {
+    "schema": "pending-local-validation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "replace-rootfs-from-new-oci-image-preserve-managed-volumes",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}
diff --git a/oci/catalog/index.json b/oci/catalog/index.json
index 56933833..badb63c6 100644
--- a/oci/catalog/index.json
+++ b/oci/catalog/index.json
@@ -18766,6 +18766,38 @@
       "requires_security_confirmation": false,
       "hidden": true,
       "template_id": "image-ztnet"
+    },
+    {
+      "id": "authelia",
+      "provider": "authelia",
+      "template_family": "curated-profile",
+      "title": "Authelia",
+      "repository": "https://github.com/authelia/authelia",
+      "description": "An open-source authentication and authorization server for protecting web applications. This single-image profile provides a local SQLite database and file notifications; configure your domain, reverse proxy and access rules before protecting other services.",
+      "website": "https://www.authelia.com/",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/authelia.webp",
+      "architectures": [
+        "amd64",
+        "arm64"
+      ],
+      "updated_at": "2026-09-17",
+      "main_image": "docker.io/authelia/authelia:4.39.28",
+      "category": "security",
+      "category_label": "Authentication & Security",
+      "replaces_discovered_ids": [],
+      "curated_path": "catalog/curated/authelia.json",
+      "template": "apps/authelia.json",
+      "template_status": "generated-unvalidated",
+      "automatic_install_candidate": true,
+      "untranslated_blockers": [],
+      "requires_privileged_lxc": false,
+      "optional_privileged_lxc": false,
+      "requires_host_pid_namespace": false,
+      "requires_relaxed_confinement": false,
+      "optional_relaxed_confinement": false,
+      "requires_security_confirmation": false,
+      "hidden": false,
+      "template_id": "image-authelia"
     }
   ],
   "discovery": {
diff --git a/oci/tests/test_authelia_recipe.py b/oci/tests/test_authelia_recipe.py
new file mode 100644
index 00000000..a061cce3
--- /dev/null
+++ b/oci/tests/test_authelia_recipe.py
@@ -0,0 +1,99 @@
+"""The Authelia profile bootstraps a usable single-image authentication portal."""
+
+import json
+from pathlib import Path
+import sys
+import unittest
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "src"))
+
+from proxmenux_oci.catalog import Catalog
+
+
+class AutheliaRecipeTests(unittest.TestCase):
+    def setUp(self):
+        self.path = ROOT / "catalog/curated/authelia.json"
+        self.recipe = json.loads(self.path.read_text(encoding="utf-8"))
+        self.index_copy = json.loads(
+            (ROOT / "catalog/apps/authelia.json").read_text(encoding="utf-8")
+        )
+        self.profile = self.recipe["proxmox"]["installer_profile"]
+        self.generated = {
+            item["container_path"]: item
+            for item in self.profile["generated_files"]
+        }
+
+    def test_local_catalog_lists_and_loads_the_curated_recipe(self):
+        catalog = Catalog(ROOT)
+        item = catalog.find_item("authelia")
+        self.assertEqual(item["template_family"], "curated-profile")
+        self.assertEqual(catalog.compose("authelia")["id"], "image-authelia")
+        self.assertEqual(self.recipe, self.index_copy)
+
+    def test_official_image_tag_icon_and_supported_architectures_are_declared(self):
+        self.assertEqual(
+            self.recipe["container_contract"]["image"]["reference"],
+            "docker.io/authelia/authelia:4.39.28",
+        )
+        self.assertEqual(self.recipe["catalog_ui"]["architectures"], ["amd64", "arm64"])
+        self.assertEqual(
+            self.recipe["catalog_ui"]["icon"],
+            "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/authelia.webp",
+        )
+
+    def test_sensitive_secrets_are_generated_and_domain_settings_are_prompted(self):
+        environment = {
+            item["name"]: item
+            for item in self.recipe["container_contract"]["environment"]
+        }
+        for name in (
+            "PROXMENUX_ADMIN_PASSWORD",
+            "AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET",
+            "AUTHELIA_SESSION_SECRET",
+            "AUTHELIA_STORAGE_ENCRYPTION_KEY",
+        ):
+            self.assertTrue(environment[name]["sensitive"])
+            self.assertEqual(self.profile["generated_sensitive_environment"][name]["strategy"], "token-hex")
+        self.assertTrue(environment["PROXMENUX_AUTHELIA_COOKIE_DOMAIN"]["required"])
+        self.assertTrue(environment["PROXMENUX_AUTHELIA_URL"]["required"])
+        self.assertIn("cookie domain", environment["PROXMENUX_AUTHELIA_COOKIE_DOMAIN"]["prompt"])
+        self.assertIn("HTTPS URL", environment["PROXMENUX_AUTHELIA_URL"]["prompt"])
+        self.assertEqual(environment["PROXMENUX_AUTHELIA_COOKIE_DOMAIN"]["example"], "")
+        self.assertEqual(environment["PROXMENUX_AUTHELIA_URL"]["example"], "")
+        self.assertEqual(environment["X_AUTHELIA_CONFIG_FILTERS"]["example"], "template")
+
+    def test_config_is_persistent_and_has_a_working_initial_policy(self):
+        config = self.generated["/config/configuration.yml"]["content"]
+        self.assertIn("path: '/config/users_database.yml'", config)
+        self.assertIn("path: '/config/db.sqlite3'", config)
+        self.assertIn("filename: '/config/notification.txt'", config)
+        self.assertIn("default_policy: 'one_factor'", config)
+        self.assertIn('{{ env \"PROXMENUX_AUTHELIA_COOKIE_DOMAIN\" }}', config)
+        self.assertIn('{{ env \"PROXMENUX_AUTHELIA_URL\" }}', config)
+        self.assertTrue(self.generated["/config/configuration.yml"]["only_if_missing"])
+        volume = self.recipe["container_contract"]["volumes"][0]
+        self.assertEqual(volume["container_path"], "/config")
+        self.assertEqual(volume["installation_choice"], ["managed-volume"])
+        self.assertTrue(volume["managed_volume"]["backup"])
+
+    def test_bootstrap_hashes_initial_password_and_never_ships_a_default_password(self):
+        bootstrap = self.generated["/usr/local/bin/proxmenux-authelia-bootstrap"]["content"]
+        self.assertIn("authelia crypto hash generate argon2", bootstrap)
+        self.assertIn("unset PROXMENUX_ADMIN_PASSWORD", bootstrap)
+        self.assertIn("exec /app/entrypoint.sh", bootstrap)
+        self.assertNotIn("password: authelia", bootstrap)
+        self.assertEqual(
+            self.recipe["first_run"]["credentials"][0]["password_environment"],
+            "PROXMENUX_ADMIN_PASSWORD",
+        )
+
+    def test_healthcheck_uses_authelias_documented_endpoint_and_profile_remains_unvalidated(self):
+        healthcheck = self.profile["startup_healthcheck"]
+        self.assertEqual((healthcheck["port"], healthcheck["path"]), (9091, "/api/health"))
+        self.assertFalse(self.recipe["compatibility"]["validated"])
+        self.assertEqual(self.recipe["status"], "generated-unvalidated")
+
+
+if __name__ == "__main__":
+    unittest.main()