Frank Schwenk
93c78f503e
Compose + Traefik ForwardAuth middleware, Redis sessions, SMTP via 0012.de, TOTP and ACL for consumer apps (e.g. pi.schwenk.online). Co-authored-by: Cursor <cursoragent@cursor.com>
72 lines
2.3 KiB
YAML
72 lines
2.3 KiB
YAML
services:
|
|
authelia:
|
|
image: authelia/authelia:4.39
|
|
container_name: authelia
|
|
restart: unless-stopped
|
|
security_opt:
|
|
- no-new-privileges=true
|
|
volumes:
|
|
- ./secrets:/secrets:ro
|
|
- ./config:/config
|
|
networks:
|
|
- traefik
|
|
- internal
|
|
environment:
|
|
TZ: ${TZ:-Europe/Berlin}
|
|
X_AUTHELIA_CONFIG_FILTERS: template
|
|
AUTHELIA_NOTIFIER_SMTP_USERNAME: ${AUTHELIA_NOTIFIER_SMTP_USERNAME}
|
|
AUTHELIA_NOTIFIER_SMTP_PASSWORD: ${AUTHELIA_NOTIFIER_SMTP_PASSWORD}
|
|
AUTHELIA_NOTIFIER_SMTP_SENDER: ${AUTHELIA_NOTIFIER_SMTP_SENDER}
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.docker.network=traefik
|
|
- traefik.http.routers.authelia.rule=Host(`auth.schwenk.online`)
|
|
- traefik.http.routers.authelia.entrypoints=websecure
|
|
- traefik.http.routers.authelia.tls.certresolver=myresolver
|
|
- traefik.http.routers.authelia.service=authelia
|
|
- traefik.http.services.authelia.loadbalancer.server.port=9091
|
|
- traefik.http.middlewares.authelia.forwardAuth.address=http://authelia:9091/api/authz/forward-auth
|
|
- traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader=true
|
|
- traefik.http.middlewares.authelia.forwardAuth.maxResponseBodySize=8192
|
|
- traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email
|
|
depends_on:
|
|
- redis
|
|
|
|
redis:
|
|
image: redis:7-alpine
|
|
container_name: authelia-redis
|
|
restart: unless-stopped
|
|
security_opt:
|
|
- no-new-privileges=true
|
|
command: redis-server --save 60 1 --loglevel warning
|
|
volumes:
|
|
- redis-data:/data
|
|
networks:
|
|
- internal
|
|
|
|
whoami:
|
|
image: traefik/whoami:v1.10
|
|
container_name: whoami-auth
|
|
restart: unless-stopped
|
|
security_opt:
|
|
- no-new-privileges=true
|
|
networks:
|
|
- traefik
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.docker.network=traefik
|
|
- traefik.http.routers.whoami-auth.rule=Host(`whoami-auth.schwenk.online`)
|
|
- traefik.http.routers.whoami-auth.entrypoints=websecure
|
|
- traefik.http.routers.whoami-auth.tls.certresolver=myresolver
|
|
- traefik.http.routers.whoami-auth.middlewares=authelia@docker
|
|
- traefik.http.services.whoami-auth.loadbalancer.server.port=80
|
|
|
|
networks:
|
|
traefik:
|
|
external: true
|
|
internal:
|
|
driver: bridge
|
|
|
|
volumes:
|
|
redis-data:
|