I just installed Pomerium and got it to integrate with AdguardHome and my router which both use basic HTTP, I also use Authentik. It’s a bit of a learning curve, but in short, this is what the config.yaml file needs to work to get it up and running:

The basic auth header for this is just UN: example PW: Password

authenticate_service_url: https://verify.mydomain.com
idp_provider: oidc
idp_provider_url: https://Authentik.mydomain.com/application/o/pomerium/
idp_client_id: AUTHENTIK'S CLIENT ID
idp_client_secret: AUTHENTIK'S CLIENT SECRET
idp_provider_scopes: null
routes:
  - from: https://agh.mydomain.com
    to: http://192.168.1.200  ##Adguardhome address
    policy:
      - allow:
          or:
            - email:
                is: [email protected]
    set_request_headers:
    # https://www.blitter.se/utils/basic-authentication-header-generator/
       Authorization: "Basic ZXhhbXBsZTpwYXNzd29yZA==" #AdguardHome
      allow_websockets: true


  - from: https://router.mydomain.com
    to: http://192.168.1.254
    policy:
      - allow:
          or:
            - email:
                is: [email protected]
    set_request_headers:
    # https://www.blitter.se/utils/basic-authentication-header-generator/
      Authorization: "Basic ZXhhbXBsZTpwYXNzd29yZA=="  #Router 
    allow_websockets: true


cookie_name: pomerium
cookie_secret: RANDOM 32 CHARACTER COOKIE=
cookie_domain: mydomain.com
pomerium_debug: true

So, now when I go to my Adguardhome’s URL ( agh.mydomain.com), it auto directs to my Authentik instance, then upon matching my signed in email in the browser session, it transparently logs me into Adguardhome without issue. The same applies to my router’s login.

In short, if you have found an NVR which supports basic http auth, Pomerium is the missing piece I’ve found to work.