I got tired of spinning up heavy auth stacks that gobble up hundreds of MBs of RAM and require separate database containers just to get simple Single Sign-On for a few homelab services. So, I built Zen IdP.

It’s a lightweight OpenID Connect provider written in Go that runs as a single binary or container.

What it is: A simple OIDC provider designed for local services and internal tools where users sign in using just their username and a TOTP code (no user passwords stored or managed).

What it isn't: A heavy enterprise identity platform with self-signup, password resets, or LDAP sync. It isn't trying to replace Keycloak or Authentik for complex enterprise environments.

Key homelab-friendly features:

• Identity as Code: Users, applications, and custom claims are declared entirely in YAML files.
• Zero database servers: Disposable session state lives in a local SQLite file. If you lose or wipe the DB, identity data isn't lost—users just sign in again with their same TOTP codes.
• CI/CD validation: Includes a validate-config command to test your YAML files in Git workflows before deploying.
• Ready-to-run examples: The repo includes Docker Compose setups for Grafana, OAuth2 Proxy, Gatus, OliveTin, and Zot out of the box.

Watch a 1-minute video demo (using Grafana as an example OIDC client)

A quick note on transparency: English is not my native language, so I used AI to help polish the docs and post text. I also used AI assistance to implement some features, but every line of code was designed, supervised, and tested by me.

It's MIT licensed: https://github.com/varavelio/zen-idp

I’d love to hear your feedback, thoughts, or any questions about integrating it into your setup!