Multi-Factor Authentication for Self-Hosted Applications: MFA vs TOTP vs U2F

CompactHost · March 28, 2026

When I first set up Nextcloud on a public VPS, I thought a strong password was enough. It wasn't. After noticing failed login attempts in my logs, I realized that self-hosted applications need real multi-factor authentication—not just the marketing buzzword, but actual security layers that stop attackers cold. In this guide, I'll walk you through MFA, TOTP, and U2F: what they are, how they differ, and exactly how to implement them in your homelab.

Why Multi-Factor Authentication Matters for Self-Hosted Apps

Self-hosted applications are juicy targets. Unlike SaaS platforms with massive security teams, your homelab runs on your infrastructure, your VPS, your hardware. If someone compromises your Vaultwarden, they own your passwords. If they breach your Nextcloud, they access your files. A single strong password isn't enough anymore—you need multiple independent verification methods.

I prefer MFA implementations because they transform authentication from a single point of failure into a chain of custody. Even if an attacker brute-forces your password (or finds it in a breach), they still can't log in without the second factor. That's the difference between "probably fine" and "actually secure."

Understanding the Three Main MFA Methods

Time-Based One-Time Passwords (TOTP)

TOTP is the most popular MFA method for self-hosted applications, and for good reason. It's simple, doesn't require extra hardware, and works on any smartphone with an authenticator app.

Here's how it works: Your server and your phone share a secret key. Every 30 seconds, both generate a new 6-digit code based on that key and the current time. You type the code into the login form. The server verifies it matches, and grants access. If the codes don't synchronize, the login fails.

I use TOTP for Nextcloud, Gitea, and Vaultwarden. It's built into most self-hosted stacks and requires minimal configuration. The trade-off: if you lose your phone, you lose access (unless you save backup codes).

Universal 2nd Factor (U2F)

U2F is cryptography-based authentication using a physical security key—USB dongles like YubiKey or Titan keys. When you plug in the key and press its button, it signs a challenge from the server. This signature proves you physically possess the key.

U2F is the strongest option I've tested. It's immune to phishing (the key only works with the correct domain), resistant to brute force, and leaves no seeds for attackers to steal. The downside: security keys cost $20–60 each, and you need to carry them or buy backups.

I use U2F for critical applications: my Authelia instance, my identity provider, and anything that controls other systems. The friction is worth the security.

FIDO2/WebAuthn

FIDO2 is the modern evolution of U2F, supporting both hardware keys and biometric authentication (Windows Hello, Face ID on newer systems). It's the future, but adoption on self-hosted apps is still patchy compared to TOTP.

For most homelab setups, think of FIDO2 as "U2F plus Windows Hello support." If your app supports FIDO2, it likely supports U2F, so you get both options.

Implementing TOTP with Nextcloud

Let me show you a real implementation. Nextcloud's two-factor authentication is solid and easy to enable.

First, enable TOTP in your Nextcloud instance. Log in as admin and navigate to Administration → Security → Two-factor authentication. Enable the "TOTP" provider.

Then, for each user, navigate to Settings → Security and click "Enable TOTP." Nextcloud displays a QR code. Scan it with Google Authenticator, Microsoft Authenticator, Authy, or any TOTP app. The app generates 6-digit codes every 30 seconds.

Here's a Docker Compose snippet to ensure Nextcloud has the right PHP modules for TOTP:

version: '3.8'

services:
  nextcloud:
    image: nextcloud:latest
    container_name: nextcloud
    restart: unless-stopped
    ports:
      - "8080:80"
    environment:
      MYSQL_PASSWORD: your_db_password
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      MYSQL_HOST: db
    volumes:
      - ./nextcloud:/var/www/html
      - ./nextcloud/data:/var/www/html/data
      - ./nextcloud/config:/var/www/html/config
    depends_on:
      - db
    networks:
      - nextcloud-net

  db:
    image: mariadb:latest
    container_name: nextcloud-db
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: root_password
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      MYSQL_PASSWORD: your_db_password
    volumes:
      - ./db:/var/lib/mysql
    networks:
      - nextcloud-net

networks:
  nextcloud-net:
    driver: bridge

After deploying, log in and enable TOTP as described. Nextcloud will also generate backup codes—save these in a password manager. They let you regain access if you lose your phone.

Setting Up U2F with Authelia Behind a Reverse Proxy

For maximum security, I implement U2F at the authentication layer using Authelia, a self-hosted identity provider. This protects all downstream applications at once.

Here's a minimal Authelia configuration with U2F enabled:

---
server:
  host: 0.0.0.0
  port: 9091

log:
  level: info

default_redirection_url: https://auth.yourdomain.com

totp:
  issuer: YourHomelab
  period: 30
  skew: 1

webauthn:
  disable: false
  display_name: YourHomelab
  attestation_conveyance_preference: indirect
  user_verification: preferred
  timeout: 60s

session:
  secret: your_session_secret_min_32_chars
  domain: yourdomain.com
  cookies:
    - name: authelia_session
      domain: yourdomain.com
      authelia_url: https://auth.yourdomain.com
      inactivity: 1h
      expiration: 8h
      remember_me: 7d

regulation:
  max_retries: 5
  find_time: 5m
  ban_time: 15m

authentication_backend:
  file:
    path: /etc/authelia/users_database.yml

access_control:
  default_policy: two_factor
  rules:
    - domain: auth.yourdomain.com
      policy: one_factor

storage:
  encryption_key: your_encryption_key_min_20_chars
  local:
    path: /var/lib/authelia/db.sqlite3

Deploy Authelia in Docker:

docker run -d \
  --name authelia \
  --restart unless-stopped \
  -p 9091:9091 \
  -v /path/to/config:/etc/authelia \
  -v /path/to/db:/var/lib/authelia \
  authelia/authelia:latest

Users register U2F keys in their profile. When they log in, they're prompted to touch their security key. Authelia verifies the signature and grants access.

Choosing Your VPS for MFA-Protected Self-Hosting

If you're running MFA-protected applications on a public VPS (which I recommend over home internet), you need reliable hosting. For around $40 per year, providers like RackNerd offer solid specs: 2-4 vCPUs, 2-4GB RAM, and 40-60GB SSD. That's enough for Authelia, Nextcloud, Vaultwarden, and a reverse proxy running simultaneously.

I've used several providers, and I prefer ones with good uptime guarantees and no port blocking on common services like SMTP and HTTP/HTTPS. Check their current promotions—deals rotate seasonally, and you might find even better specs.

Best Practices for MFA in Your Homelab

Layer your authentication. Use TOTP for day-to-day access and U2F for administrative accounts. If someone steals your TOTP seed from a backup, they can't touch your admin account.

Save backup codes everywhere. When you enable TOTP or U2F, the application generates backup codes. Store these in your password manager, your offline notebook, and (for critical systems) a printed copy in a safe. Losing access to a self-hosted app is a real problem with no customer support to call.

Test your recovery process before disaster strikes. Actually use a backup code. Actually re-register a U2F key. Know exactly what happens and how long it takes. I've seen people panic when they lost their phone without knowing their backup codes worked.

Use TOTP for applications, U2F for identity providers. Most self-hosted apps support TOTP natively. Authelia, Authentik, and similar identity providers support U2F, so you can use them as a security layer protecting everything behind them.

Sync the time on your server. TOTP relies on synchronized clocks between your phone and server. If your server's time drifts by more than 30 seconds, TOTP codes fail. Use NTP:

sudo apt install chrony
sudo systemctl enable chrony
sudo systemctl start chrony
timedatectl

Comparing the Three Methods

My Current Setup

In my homelab, I use a tiered approach:

• Tier 1 (Most Critical): Authelia identity provider with U2F only. No password login, only security keys.
• Tier 2 (Important): Vaultwarden and Nextcloud with TOTP enforced. Backup codes stored offline.
• Tier 3 (Useful): Internal tools (Gitea, monitoring dashboards) behind Authelia, so they inherit U2F protection.

This setup means compromising one application doesn't cascade. And if someone somehow gets a password, they hit TOTP or U2F and stop cold.

Next Steps

If you're running self-hosted applications exposed to the internet, start with TOTP on your password manager (Vaultwarden) this week. It takes 15 minutes, requires no hardware, and closes a major attack vector.

Then, consider deploying Authelia or Authentik as a central authentication layer. This lets you add U2F protection across multiple applications at once, rather than configuring MFA in each app individually.

Finally, invest in one or two security keys. They're cheap insurance against phishing, brute force, and credential stuffing. Your self-hosted infrastructure is too