4 ms·

From what I can tell, Ory is a high quality auth stack capable of scaling up. If you're looking for something a bit simpler to work with for indiehosting use c

From what I can tell, Ory is a high quality auth stack capable of scaling up. If you're looking for something a bit simpler to work with for indiehosting use cases, I maintain a list here: https://github.com/lastlogin-net/obligator?tab=readme-ov-file#comparison-is-the-thief-of-joy https://github.com/lastlogin-net/obligator?tab=readme-ov-fil...

mooreds 2y ago
Is this only for open source self-hosted solutions, or for any auth solution that can be self-hosted? I'd like to add FusionAuth if the latter (we have a full featured free option but are not open source). Should I just add a comment on the google sheet or is there a better way?
- apitman 2y ago
  Yeah open source only, sorry.
  - mooreds 2y ago
    No worries! I get it. You should add Gluu/Janssen to your list; they are a venerable open source OIDC implementation: https://github.com/JanssenProject/jans https://github.com/JanssenProject/jans
    - apitman 2y ago
      I'll check it out, thanks!
aeneas_ory 2y ago
The list is really helpful for people to navigate, and here is additional context to the complexity topic :) If you use our managed services (https://console.ory.sh https://console.ory.sh), it is easy to set up and scale because we have a bunch of defaults, UIs, and the security stuff all set up already. If you run it completely on your own, which does require some skill especially in terms of (security) incident response, it is more work because you have to figure out a few pieces yourself (the stack is agnostic to the environment). We have an option for self hosting with all the stuff we have built for the SaaS, but it only makes sense for businesses of a certain size. Complexity also depends on how many services you combine, some people try to use everything at once and it's overwhelming. What’s making Ory complex for people who do it by themselves, is that Ory is 3 different API first products that work stand alone or in concert. To wire this up, one requires understanding of every service. Here it is easier to spin up a cloud account, or use an alternate project which is e.g. just one docker container.
- deleted 2y ago
  [deleted]
- gavinray 2y ago
  > but it's still less work than setting up JVM correctly :D I'm not sure that either of these are what I'd called "difficult" FROM openjdk:21 Or sudo apt install openjdk-21-jdk
  - apitman 2y ago
    I would guess parent is referring more to tuning the JVM.
- apitman 2y ago
  EDIT: For the record, I'm grateful Ory is open source and wish you all the success in the world. My comments below are specifically for the indiehosting case. For indiehosting, my threat model is "what are my options if the team behind this software takes it in a direction I don't like?" For some projects (Redis, Terraform), the answer is that a high quality fork pops up (Valkey, OpenTofu). For others (MongoDB), there's still not a FLOSS alternative included in major package managers. But even if a fork does appear, they are relatively likely to eventually fall prey to the same incentives that impacted the original. I try to cut this off at the root, and prefer software I would be confident forking myself. All of the options marked "simple" on my list fall under that category. Sometimes you can't avoid complicated software, but you often can. For an indiehosted identity server, 5,000-10,000 lines of code provides pretty much all the features I need. I don't think the extra ~100,000-900,000k lines of code of the major players is worth the risk.
throwaway894345 2y ago
That’s awesome. Bookmarking this. I’ve been surprised at how difficult it has been to find a simple auth tool for indie/homelab use cases.
zenlot 2y ago
So what is tl;dr for simpler?

mooreds 2y ago

Is this only for open source self-hosted solutions, or for any auth solution that can be self-hosted? I'd like to add FusionAuth if the latter (we have a full featured free option but are not open source). Should I just add a comment on the google sheet or is there a better way?

apitman 2y ago
Yeah open source only, sorry.
- mooreds 2y ago
  No worries! I get it. You should add Gluu/Janssen to your list; they are a venerable open source OIDC implementation: https://github.com/JanssenProject/jans https://github.com/JanssenProject/jans
  - apitman 2y ago
    I'll check it out, thanks!

aeneas_ory 2y ago

The list is really helpful for people to navigate, and here is additional context to the complexity topic :) If you use our managed services (https://console.ory.sh https://console.ory.sh), it is easy to set up and scale because we have a bunch of defaults, UIs, and the security stuff all set up already. If you run it completely on your own, which does require some skill especially in terms of (security) incident response, it is more work because you have to figure out a few pieces yourself (the stack is agnostic to the environment). We have an option for self hosting with all the stuff we have built for the SaaS, but it only makes sense for businesses of a certain size. Complexity also depends on how many services you combine, some people try to use everything at once and it's overwhelming. What’s making Ory complex for people who do it by themselves, is that Ory is 3 different API first products that work stand alone or in concert. To wire this up, one requires understanding of every service. Here it is easier to spin up a cloud account, or use an alternate project which is e.g. just one docker container.

deleted 2y ago
[deleted]
gavinray 2y ago
> but it's still less work than setting up JVM correctly :D I'm not sure that either of these are what I'd called "difficult" FROM openjdk:21 Or sudo apt install openjdk-21-jdk
- apitman 2y ago
  I would guess parent is referring more to tuning the JVM.
apitman 2y ago
EDIT: For the record, I'm grateful Ory is open source and wish you all the success in the world. My comments below are specifically for the indiehosting case. For indiehosting, my threat model is "what are my options if the team behind this software takes it in a direction I don't like?" For some projects (Redis, Terraform), the answer is that a high quality fork pops up (Valkey, OpenTofu). For others (MongoDB), there's still not a FLOSS alternative included in major package managers. But even if a fork does appear, they are relatively likely to eventually fall prey to the same incentives that impacted the original. I try to cut this off at the root, and prefer software I would be confident forking myself. All of the options marked "simple" on my list fall under that category. Sometimes you can't avoid complicated software, but you often can. For an indiehosted identity server, 5,000-10,000 lines of code provides pretty much all the features I need. I don't think the extra ~100,000-900,000k lines of code of the major players is worth the risk.

throwaway894345 2y ago

That’s awesome. Bookmarking this. I’ve been surprised at how difficult it has been to find a simple auth tool for indie/homelab use cases.

zenlot 2y ago

So what is tl;dr for simpler?