feat: Authelia SSO stack for auth.schwenk.online

Compose + Traefik ForwardAuth middleware, Redis sessions, SMTP via 0012.de, TOTP and ACL for consumer apps (e.g. pi.schwenk.online). Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-01 10:29:17 +02:00
commit 93c78f503e
15 changed files with 1186 additions and 0 deletions
@@ -0,0 +1,71 @@
+services:
+  authelia:
+    image: authelia/authelia:4.39
+    container_name: authelia
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges=true
+    volumes:
+      - ./secrets:/secrets:ro
+      - ./config:/config
+    networks:
+      - traefik
+      - internal
+    environment:
+      TZ: ${TZ:-Europe/Berlin}
+      X_AUTHELIA_CONFIG_FILTERS: template
+      AUTHELIA_NOTIFIER_SMTP_USERNAME: ${AUTHELIA_NOTIFIER_SMTP_USERNAME}
+      AUTHELIA_NOTIFIER_SMTP_PASSWORD: ${AUTHELIA_NOTIFIER_SMTP_PASSWORD}
+      AUTHELIA_NOTIFIER_SMTP_SENDER: ${AUTHELIA_NOTIFIER_SMTP_SENDER}
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=traefik
+      - traefik.http.routers.authelia.rule=Host(`auth.schwenk.online`)
+      - traefik.http.routers.authelia.entrypoints=websecure
+      - traefik.http.routers.authelia.tls.certresolver=myresolver
+      - traefik.http.routers.authelia.service=authelia
+      - traefik.http.services.authelia.loadbalancer.server.port=9091
+      - traefik.http.middlewares.authelia.forwardAuth.address=http://authelia:9091/api/authz/forward-auth
+      - traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader=true
+      - traefik.http.middlewares.authelia.forwardAuth.maxResponseBodySize=8192
+      - traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email
+    depends_on:
+      - redis
+
+  redis:
+    image: redis:7-alpine
+    container_name: authelia-redis
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges=true
+    command: redis-server --save 60 1 --loglevel warning
+    volumes:
+      - redis-data:/data
+    networks:
+      - internal
+
+  whoami:
+    image: traefik/whoami:v1.10
+    container_name: whoami-auth
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges=true
+    networks:
+      - traefik
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=traefik
+      - traefik.http.routers.whoami-auth.rule=Host(`whoami-auth.schwenk.online`)
+      - traefik.http.routers.whoami-auth.entrypoints=websecure
+      - traefik.http.routers.whoami-auth.tls.certresolver=myresolver
+      - traefik.http.routers.whoami-auth.middlewares=authelia@docker
+      - traefik.http.services.whoami-auth.loadbalancer.server.port=80
+
+networks:
+  traefik:
+    external: true
+  internal:
+    driver: bridge
+
+volumes:
+  redis-data: