Skip to main content

Accounts, 2FA and App Passwords

Accounts, 2FA and App Passwords

Adapted from GitLab's identity and access guidance, for NFE's Nextcloud + LDAP setup.

How NFE accounts work

System How you log in Notes
Nextcloud (files, Talk, Deck, Mail app, Calendar) NFE username + LDAP password Supports 2FA (TOTP) and app passwords
Mail: IMAP/SMTP (phone and desktop mail apps) full email address + LDAP password No 2FA. A stolen password can send mail directly.
Roundcube webmail (roundcube.nearlyfreeenergy.com) email + LDAP password Public login page, no 2FA today
BookStack (this Library) own login
ERPNext, Plane, others own logins Turn on 2FA wherever offered

Because mail and webmail accept the bare LDAP password, 2FA in Nextcloud alone does not stop someone with your password from sending mail as you. That is exactly what happened in 2026.

What every team member does

  1. Turn on 2FA in Authelia, NFE's login screen for all Core apps. Follow Setting up 2FA (current approach) below. Required for every NFE account.
  2. Use Nextcloud Mail or Roundcube in the browser instead of saving your LDAP password in phone or desktop mail apps where possible.
  3. One app password per device or tool:
    • Create it in Nextcloud → Personal settings → Security → Devices & sessions → Create new app password.
    • Name it after the device or tool (aaron-phone-mail, claude-api, dansturn-laptop-sync).
    • Revoke it when the device is lost, replaced or no longer used.
  4. Review Devices & sessions monthly. Revoke anything you don't recognise and report it.
  5. Admins: use your admin rights only when you need them. The Security DRI reviews admins membership every quarter.

Setting up 2FA (current approach)

Every NFE account must have two-factor authentication (2FA). Our apps sign in through Authelia, the NFE login screen at authelia.nearlyfreeenergy.com, so you set 2FA up there once and it covers every app that requires it.

Important: add the key using the URI, not the QR code. At the moment our Authelia only accepts codes from authenticator apps that were set up with the full otpauth:// link (the URI). Scanning the QR code or copying the "Secret" into Google Authenticator or Duo produces codes that Authelia rejects: the field turns red, even with a fresh code. We've asked Federated Computer to switch Authelia to standard settings so any app works. This page will be updated when that's done.

What you need: your NFE login, access to your NFE email (for a confirmation code), and an authenticator that accepts a URI. We recommend Vaultwarden/Bitwarden, our password manager. Aegis and 2FAS also work.

Steps

  1. Go to authelia.nearlyfreeenergy.com and sign in with your NFE username and password.
  2. Open Settings → Two-Factor Authentication and choose to add a One-Time Password.
  3. Authelia emails you a one-time code to confirm it's you. Enter it in the browser. Never share this code with anyone, including IT support.
  4. On the registration screen, copy the URI (the link starting with otpauth://). Don't scan the QR code and don't copy the "Secret".
  5. In Vaultwarden/Bitwarden, create or edit a login item called "NFE Authelia", paste the URI into the Authenticator key (TOTP) field, and save. A 6-digit code now appears on the item.
  6. Type the current code into Authelia and confirm. Wait for a new code if one was already used or is about to expire.
  7. Store any backup or recovery details in your password manager, never in email, chat or this Library.

Afterwards

  • Authelia emails you whenever a 2FA method is added or removed. If you get one of these emails and didn't make the change, report it immediately (see Reporting a Security Incident).
  • If you get locked out, contact the Security DRI, who will ask Federated Computer to reset your 2FA. Don't turn 2FA off yourself to get around a problem.
  • Federated's walkthrough video of the URI method is saved in our support thread with them. Ask Aaron for a copy.

Last reviewed: 21 October 2026, Aaron Tushabe.

Planned improvements (Security DRI + Federated Computer)

  • 2FA for Roundcube (e.g. twofactor_gauthenticator), or retire Roundcube in favour of Nextcloud Mail.
  • Per-user outbound mail rate limits and alerts on unusual sending volume.
  • Rate-limiting and blocking of repeated failed logins (fail2ban) on SMTP/IMAP/Roundcube.
  • Investigate app-password-only access for IMAP/SMTP, so the main password never sits in a mail app.
Back to top