Generally, your auth provider (assuming setup correctly) should be one of the most secure components of your internet-exposed setup. That being said, vulnerabilities can and do occur. Adding a combination of Crowdsec, OWASP CRS, other ModSecurity rulesets, and/or fail2ban will add a degree of migitation of potential exploits by blacklisting known bad actors/active bad behavior.

Above all, you should have a plan to keep aware of updates to your publicly-exposed software and be able to deploy those updates in a timely fashion.

Fail2ban is just another tool in your toolbox. Defense in depth, as others mentioned.

Fail2ban is primarily a tool to prevent brute force attacks, especially useful for services that don't do their own throttling. For example I usually put ssh in fail2ban, but if Authelia's built-in protection is good enough, then use that.

Outside ssh, anything that could be used to brute force credentials should be in fail2ban if they're exposed: web sites with simple auth, mail, etc.

I used to have my system through CrowdSec and authentik. Now it's Lan and Vpn only. Ai makes things too spicy for my liking.

Authelia should come with rate limiting to protect against brute-force attacks. That could be enough.

I'd generally advise to make sure such protection actually works. Like look up the limits and try to login with a wrong password 30 times... Especially if you added stuff on top (fail2ban, crowdsec...). Has happened to me I misconfigured stuff and it didn't limit anything... Now I check to make sure for important bits like an authentication service.

Security works in layers. You don't know if there's a vulnerability in Authelia.

Was thinking about the same thing before settling on mTLS. Seems like a fantastic defense so far.

I am not a fan of geoblocking as a first line defense but when I blocked everything outside of my country, fail2ban stopped firing, entirely.

My network has all the web ui stuff kept local and only accessible via OpenVPN on port 443, with fail2ban as well.

By the time a would-be attacker realizes it's not actually a webserver, they'll have exhausted most, if not all, of their public IP addresses on fuzzing for webserver vulnerabilities.

EDIT: and as a bonus, I can also just punch out through the firewall my work has on the visitor network with ease. All I needed was a second fail2ban rule for their static IP to deal with followup scans.

Put as many layers in your onion as possible, also limit outbiund traffic which will make further exploration more difficult (especially if it's an automated attack)

Please don't expose your services to the internet directly. Use something like Tailscale/Headscale/whatever mesh VPN is relevant now. It'll always be 100 times better than this and you wouldn't worry about Authelia, f2b and CrowdSec (though updating your services and server(s) is always worth it).