SELinux purges; DNS updates; remember Authelian consent
This commit is contained in:
@@ -42,7 +42,7 @@ access_control:
|
||||
- 192.168.0.0/24
|
||||
# Wireguard
|
||||
- 10.8.0.0/16
|
||||
policy: one_factor
|
||||
policy: bypass
|
||||
# Allow access to container's /api address
|
||||
- domain:
|
||||
- "*.pukeko.xyz"
|
||||
@@ -74,6 +74,9 @@ access_control:
|
||||
- domain: "news.pukeko.xyz"
|
||||
policy: one_factor
|
||||
subject: "group:family"
|
||||
- domain: "tasks.pukeko.xyz"
|
||||
policy: one_factor
|
||||
subject: "group:family"
|
||||
# Allow access to shares within Filebrowser
|
||||
- domain: "cloud.pukeko.xyz"
|
||||
policy: bypass
|
||||
@@ -107,12 +110,12 @@ storage:
|
||||
notifier:
|
||||
disable_startup_check: false
|
||||
smtp:
|
||||
host: smtp.mail.yahoo.com
|
||||
host: smtp.zoho.com
|
||||
port: 587
|
||||
timeout: 5s
|
||||
username: "pukekoxyz"
|
||||
password: "pvefngmuhcxunzqs"
|
||||
sender: pukekoxyz@yahoo.com
|
||||
username: "matan@pukeko.xyz"
|
||||
password: "DjazsDaEzrU9"
|
||||
sender: matan@pukeko.xyz
|
||||
identifier: localhost
|
||||
subject: "[Authelia] {authelia}"
|
||||
startup_check_address: test@authelia.com
|
||||
@@ -124,16 +127,19 @@ identity_providers:
|
||||
- id: portainer
|
||||
description: Portainer CE
|
||||
secret: '8zDD%J3Z66A4uL%!N*G@@Uo5b6z2JbgQ3fxCr39o%LXE%Yb@6SAegGGU#!v*o3Z5u$2WJ#YC6TwEb723rZ$bbtmNJ#35Nsq7E!i9v$jU223$C@!Z&Nkwa&^Yg#DmDxk5'
|
||||
pre_configured_consent_duration: 100y
|
||||
redirect_uris:
|
||||
- https://portain.pukeko.xyz/
|
||||
- id: gitea
|
||||
description: Gitea
|
||||
secret: '3s4as%cU$cKH2&MiXwzC#h8GJCY2eoS%#7&*9qC&H$ujv%qD8P6rWvrtbM8$f2#zM^phWUAz%2Bk7gCGJf#nA&i3BKvwG79&5hdp&mgddhdSFt&3BpX%a2Sv*Z#mK^J3'
|
||||
pre_configured_consent_duration: 100y
|
||||
redirect_uris:
|
||||
- https://git.pukeko.xyz/user/oauth2/Authelia/callback
|
||||
- id: wekan
|
||||
description: Wekan
|
||||
secret: '6BekdjG2Rs25MGg!NU#VEbScrQDriT2z6#wDgRK2KS4fsq5bB8hA@z8RSqs5y&pm%f94*xTw2@4&3Qv2Vg2%hv6Vq9&GNLcJfGdUxb&KM!Y@@My&ujqG3%j^Xdqs8bF^'
|
||||
pre_configured_consent_duration: 100y
|
||||
redirect_uris:
|
||||
- https://tasks.pukeko.xyz/_oauth/oidc
|
||||
- id: wikijs
|
||||
@@ -141,7 +147,7 @@ identity_providers:
|
||||
secret: 'mT#!fwRZ3$pE5g2rG4CCNKLkg4zg7&3L92e9LGemfYMbr92gPos&Js*4DU#&^*EUJ#PrP*y#W$W7^i2#zqJPhiK$3$z9uDNXYA$h9Urcuo8!Ggcq^#C6dow^s*VxV&WU'
|
||||
public: false
|
||||
authorization_policy: two_factor
|
||||
audience: []
|
||||
pre_configured_consent_duration: 100y
|
||||
redirect_uris:
|
||||
- https://wiki.pukeko.xyz/login/a8755bfb-8a4e-49b7-b31b-43ac5638367a/callback
|
||||
userinfo_signing_algorithm: none
|
||||
@@ -150,21 +156,19 @@ identity_providers:
|
||||
- email
|
||||
- profile
|
||||
- groups
|
||||
grant_types:
|
||||
- refresh_token
|
||||
- authorization_code
|
||||
response_types:
|
||||
- code
|
||||
response_modes:
|
||||
- form_post
|
||||
- id: grafana
|
||||
description: Grafana
|
||||
secret: '8Jx#U^%NXEvD#jc@A35wH!6PT8^DYo7pXftCKe3P%C%*xN9FQn26ec^kTxkuhA*9fZx@7*P65Y*L2Ty#Z*7n*f3#^$R!8TSuQ3THW*t#seL#iE7MatYEowb$GvU!8Y!5'
|
||||
pre_configured_consent_duration: 100y
|
||||
redirect_uris:
|
||||
- https://flight.pukeko.xyz/
|
||||
- id: vikunja
|
||||
description: Vikunja
|
||||
secret: 'ryKVwXhfHeAQKJJHwejEpK66pAuTGvY2saZArKTFZPjWVs2fKNHDAwah8TbPP44LGKYPBYJxU5Ua5H4Su87DAY4ktpAz6UfmpB9XnXCPoACtBrwBgykjoC6cUzXJRc7t'
|
||||
pre_configured_consent_duration: 100y
|
||||
authorization_policy: one_factor
|
||||
redirect_uris:
|
||||
- https://tasks.pukeko.xyz/auth/openid/
|
||||
- https://tasks.pukeko.xyz/auth/openid/authelia
|
||||
|
||||
@@ -1,7 +1,5 @@
|
||||
version: "3.3"
|
||||
|
||||
services:
|
||||
|
||||
traefik:
|
||||
image: "traefik:v2.6"
|
||||
container_name: "traefik"
|
||||
@@ -20,10 +18,6 @@ services:
|
||||
- "--certificatesresolvers.pukekoresolver.acme.email=matanhorovitz@protonmail.com"
|
||||
- "--certificatesresolvers.pukekoresolver.acme.storage=/letsencrypt/acme.json"
|
||||
- "--certificatesresolvers.pukekoresolver.acme.dnschallenge.resolvers=1.1.1.1:53"
|
||||
# Proxy to local Cockpit server
|
||||
# - "--providers.file=true"
|
||||
# - "--providers.file.directory=./config/cockpit.yml"
|
||||
# - "--providers.file.watch=true"
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
@@ -33,8 +27,8 @@ services:
|
||||
- CF_API_EMAIL=matanhorovitz@protonmail.com
|
||||
- CF_DNS_API_TOKEN=0dFNYA8qtzVhVtGi4nEb7_aclTOdGthYm5Q7N05n
|
||||
volumes:
|
||||
- "./letsencrypt:/letsencrypt:z"
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:z"
|
||||
- "./letsencrypt:/letsencrypt"
|
||||
- "/var/run/docker.sock:/var/run/docker.sock"
|
||||
networks:
|
||||
- network
|
||||
- internal
|
||||
@@ -70,12 +64,12 @@ services:
|
||||
- "traefik.http.middlewares.domain.redirectregex.permanent=true"
|
||||
# user: 1001:1001
|
||||
dns:
|
||||
- 150.201.34.6
|
||||
- 150.201.34.99
|
||||
homer:
|
||||
image: b4bz/homer
|
||||
container_name: homer
|
||||
volumes:
|
||||
- ./homer/:/www/assets:z
|
||||
- ./homer/:/www/assets
|
||||
ports:
|
||||
- 4957:8080
|
||||
environment:
|
||||
@@ -98,7 +92,7 @@ services:
|
||||
- TZ=Asia/Jerusalem
|
||||
- AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE=/run/secrets/private_key
|
||||
volumes:
|
||||
- ./authelia:/config:z
|
||||
- ./authelia:/config
|
||||
restart: unless-stopped
|
||||
secrets:
|
||||
- hmac
|
||||
@@ -120,7 +114,7 @@ services:
|
||||
- internal
|
||||
- dns_network
|
||||
dns:
|
||||
- 150.201.34.6
|
||||
- 150.201.34.99
|
||||
expose:
|
||||
- 9091
|
||||
secrets:
|
||||
|
||||
Reference in New Issue
Block a user