feat: Authelia SSO stack for auth.schwenk.online

Compose + Traefik ForwardAuth middleware, Redis sessions, SMTP via 0012.de, TOTP and ACL for consumer apps (e.g. pi.schwenk.online). Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-01 10:29:17 +02:00
commit 93c78f503e
15 changed files with 1186 additions and 0 deletions
@@ -0,0 +1,82 @@
+---
+# Authelia configuration — secrets via template files under /secrets/
+# SMTP username/password/sender come from environment (see compose.yml / .env)
+
+server:
+  address: 'tcp://:9091'
+
+log:
+  level: 'info'
+  keep_stdout: true
+
+theme: 'auto'
+
+totp:
+  disable: false
+  issuer: 'schwenk.online'
+  period: 30
+  skew: 1
+
+identity_validation:
+  reset_password:
+    jwt_secret: {{ secret "/secrets/jwt_secret.txt" | mindent 0 "|" | msquote }}
+
+authentication_backend:
+  refresh_interval: '5 minutes'
+  file:
+    path: '/config/users_database.yml'
+    password:
+      algorithm: 'argon2'
+      argon2:
+        variant: 'argon2id'
+        iterations: 3
+        memory: 65536
+        parallelism: 4
+        key_length: 32
+        salt_length: 16
+
+access_control:
+  default_policy: 'deny'
+  rules:
+    - domain: 'auth.schwenk.online'
+      policy: 'bypass'
+    - domain: 'whoami-auth.schwenk.online'
+      policy: 'two_factor'
+    - domain: 'pi.schwenk.online'
+      policy: 'two_factor'
+
+session:
+  name: 'authelia_session'
+  secret: {{ secret "/secrets/session_secret.txt" | mindent 0 "|" | msquote }}
+  cookies:
+    - domain: 'schwenk.online'
+      authelia_url: 'https://auth.schwenk.online'
+      name: 'authelia_session'
+      same_site: 'lax'
+      expiration: '1 hour'
+      inactivity: '15 minutes'
+      remember_me: '1 month'
+  redis:
+    host: 'redis'
+    port: 6379
+
+regulation:
+  max_retries: 5
+  find_time: '2 minutes'
+  ban_time: '5 minutes'
+
+storage:
+  encryption_key: {{ secret "/secrets/storage_encryption_key.txt" | mindent 0 "|" | msquote }}
+  local:
+    path: '/config/db.sqlite3'
+
+notifier:
+  disable_startup_check: false
+  smtp:
+    address: 'submission://ha01s019.org-dns.com:587'
+    timeout: '10s'
+    subject: '[Authelia] {title}'
+    startup_check_address: 'cuidas@gmail.com'
+    disable_require_tls: false
+    disable_starttls: false
+    # username, password, sender: AUTHELIA_NOTIFIER_SMTP_* from environment
@@ -0,0 +1,14 @@
+---
+# Copy to users_database.yml on the server and replace the password hash.
+# Generate hash:
+#   docker run --rm authelia/authelia:4.39 authelia crypto hash generate argon2 --password 'YOUR_PASSWORD'
+#
+# Use an email inbox that accepts mail from 0012.de SMTP (Tuta may reject).
+
+users:
+  frank:
+    displayname: 'Fränky'
+    password: '$argon2id$v=19$m=65536,t=3,p=4$REPLACE_WITH_REAL_HASH'
+    email: 'cuidas@gmail.com'
+    groups:
+      - 'admins'