---
# Authelia configuration — secrets via template files under /secrets/
# SMTP username/password/sender come from environment (see compose.yml / .env)

server:
  address: 'tcp://:9091'

log:
  level: 'info'
  keep_stdout: true

theme: 'auto'

totp:
  disable: false
  issuer: 'schwenk.online'
  period: 30
  skew: 1

identity_validation:
  reset_password:
    jwt_secret: {{ secret "/secrets/jwt_secret.txt" | mindent 0 "|" | msquote }}

authentication_backend:
  refresh_interval: '5 minutes'
  file:
    path: '/config/users_database.yml'
    password:
      algorithm: 'argon2'
      argon2:
        variant: 'argon2id'
        iterations: 3
        memory: 65536
        parallelism: 4
        key_length: 32
        salt_length: 16

access_control:
  default_policy: 'deny'
  rules:
    - domain: 'auth.schwenk.online'
      policy: 'bypass'
    - domain: 'whoami-auth.schwenk.online'
      policy: 'two_factor'
    - domain: 'pi.schwenk.online'
      policy: 'two_factor'

session:
  name: 'authelia_session'
  secret: {{ secret "/secrets/session_secret.txt" | mindent 0 "|" | msquote }}
  cookies:
    - domain: 'schwenk.online'
      authelia_url: 'https://auth.schwenk.online'
      name: 'authelia_session'
      same_site: 'lax'
      expiration: '1 hour'
      inactivity: '15 minutes'
      remember_me: '1 month'
  redis:
    host: 'redis'
    port: 6379

regulation:
  max_retries: 5
  find_time: '2 minutes'
  ban_time: '5 minutes'

storage:
  encryption_key: {{ secret "/secrets/storage_encryption_key.txt" | mindent 0 "|" | msquote }}
  local:
    path: '/config/db.sqlite3'

notifier:
  disable_startup_check: false
  smtp:
    address: 'submission://ha01s019.org-dns.com:587'
    timeout: '10s'
    subject: '[Authelia] {title}'
    startup_check_address: 'cuidas@gmail.com'
    disable_require_tls: false
    disable_starttls: false
    # username, password, sender: AUTHELIA_NOTIFIER_SMTP_* from environment