Frank Schwenk
93c78f503e
Compose + Traefik ForwardAuth middleware, Redis sessions, SMTP via 0012.de, TOTP and ACL for consumer apps (e.g. pi.schwenk.online). Co-authored-by: Cursor <cursoragent@cursor.com>
83 lines
1.9 KiB
YAML
83 lines
1.9 KiB
YAML
---
|
|
# Authelia configuration — secrets via template files under /secrets/
|
|
# SMTP username/password/sender come from environment (see compose.yml / .env)
|
|
|
|
server:
|
|
address: 'tcp://:9091'
|
|
|
|
log:
|
|
level: 'info'
|
|
keep_stdout: true
|
|
|
|
theme: 'auto'
|
|
|
|
totp:
|
|
disable: false
|
|
issuer: 'schwenk.online'
|
|
period: 30
|
|
skew: 1
|
|
|
|
identity_validation:
|
|
reset_password:
|
|
jwt_secret: {{ secret "/secrets/jwt_secret.txt" | mindent 0 "|" | msquote }}
|
|
|
|
authentication_backend:
|
|
refresh_interval: '5 minutes'
|
|
file:
|
|
path: '/config/users_database.yml'
|
|
password:
|
|
algorithm: 'argon2'
|
|
argon2:
|
|
variant: 'argon2id'
|
|
iterations: 3
|
|
memory: 65536
|
|
parallelism: 4
|
|
key_length: 32
|
|
salt_length: 16
|
|
|
|
access_control:
|
|
default_policy: 'deny'
|
|
rules:
|
|
- domain: 'auth.schwenk.online'
|
|
policy: 'bypass'
|
|
- domain: 'whoami-auth.schwenk.online'
|
|
policy: 'two_factor'
|
|
- domain: 'pi.schwenk.online'
|
|
policy: 'two_factor'
|
|
|
|
session:
|
|
name: 'authelia_session'
|
|
secret: {{ secret "/secrets/session_secret.txt" | mindent 0 "|" | msquote }}
|
|
cookies:
|
|
- domain: 'schwenk.online'
|
|
authelia_url: 'https://auth.schwenk.online'
|
|
name: 'authelia_session'
|
|
same_site: 'lax'
|
|
expiration: '1 hour'
|
|
inactivity: '15 minutes'
|
|
remember_me: '1 month'
|
|
redis:
|
|
host: 'redis'
|
|
port: 6379
|
|
|
|
regulation:
|
|
max_retries: 5
|
|
find_time: '2 minutes'
|
|
ban_time: '5 minutes'
|
|
|
|
storage:
|
|
encryption_key: {{ secret "/secrets/storage_encryption_key.txt" | mindent 0 "|" | msquote }}
|
|
local:
|
|
path: '/config/db.sqlite3'
|
|
|
|
notifier:
|
|
disable_startup_check: false
|
|
smtp:
|
|
address: 'submission://ha01s019.org-dns.com:587'
|
|
timeout: '10s'
|
|
subject: '[Authelia] {title}'
|
|
startup_check_address: 'cuidas@gmail.com'
|
|
disable_require_tls: false
|
|
disable_starttls: false
|
|
# username, password, sender: AUTHELIA_NOTIFIER_SMTP_* from environment
|