diff --git a/authelia/configuration.yml b/authelia/configuration.yml index dd123a2..de43974 100644 --- a/authelia/configuration.yml +++ b/authelia/configuration.yml @@ -42,7 +42,7 @@ access_control: - 192.168.0.0/24 # Wireguard - 10.8.0.0/16 - policy: one_factor + policy: bypass # Allow access to container's /api address - domain: - "*.pukeko.xyz" @@ -74,6 +74,9 @@ access_control: - domain: "news.pukeko.xyz" policy: one_factor subject: "group:family" + - domain: "tasks.pukeko.xyz" + policy: one_factor + subject: "group:family" # Allow access to shares within Filebrowser - domain: "cloud.pukeko.xyz" policy: bypass @@ -107,12 +110,12 @@ storage: notifier: disable_startup_check: false smtp: - host: smtp.mail.yahoo.com + host: smtp.zoho.com port: 587 timeout: 5s - username: "pukekoxyz" - password: "pvefngmuhcxunzqs" - sender: pukekoxyz@yahoo.com + username: "matan@pukeko.xyz" + password: "DjazsDaEzrU9" + sender: matan@pukeko.xyz identifier: localhost subject: "[Authelia] {authelia}" startup_check_address: test@authelia.com @@ -124,16 +127,19 @@ identity_providers: - id: portainer description: Portainer CE secret: '8zDD%J3Z66A4uL%!N*G@@Uo5b6z2JbgQ3fxCr39o%LXE%Yb@6SAegGGU#!v*o3Z5u$2WJ#YC6TwEb723rZ$bbtmNJ#35Nsq7E!i9v$jU223$C@!Z&Nkwa&^Yg#DmDxk5' + pre_configured_consent_duration: 100y redirect_uris: - https://portain.pukeko.xyz/ - id: gitea description: Gitea secret: '3s4as%cU$cKH2&MiXwzC#h8GJCY2eoS%#7&*9qC&H$ujv%qD8P6rWvrtbM8$f2#zM^phWUAz%2Bk7gCGJf#nA&i3BKvwG79&5hdp&mgddhdSFt&3BpX%a2Sv*Z#mK^J3' + pre_configured_consent_duration: 100y redirect_uris: - https://git.pukeko.xyz/user/oauth2/Authelia/callback - id: wekan description: Wekan secret: '6BekdjG2Rs25MGg!NU#VEbScrQDriT2z6#wDgRK2KS4fsq5bB8hA@z8RSqs5y&pm%f94*xTw2@4&3Qv2Vg2%hv6Vq9&GNLcJfGdUxb&KM!Y@@My&ujqG3%j^Xdqs8bF^' + pre_configured_consent_duration: 100y redirect_uris: - https://tasks.pukeko.xyz/_oauth/oidc - id: wikijs @@ -141,7 +147,7 @@ identity_providers: secret: 'mT#!fwRZ3$pE5g2rG4CCNKLkg4zg7&3L92e9LGemfYMbr92gPos&Js*4DU#&^*EUJ#PrP*y#W$W7^i2#zqJPhiK$3$z9uDNXYA$h9Urcuo8!Ggcq^#C6dow^s*VxV&WU' public: false authorization_policy: two_factor - audience: [] + pre_configured_consent_duration: 100y redirect_uris: - https://wiki.pukeko.xyz/login/a8755bfb-8a4e-49b7-b31b-43ac5638367a/callback userinfo_signing_algorithm: none @@ -150,21 +156,19 @@ identity_providers: - email - profile - groups - grant_types: - - refresh_token - - authorization_code - response_types: - - code response_modes: - form_post - id: grafana description: Grafana secret: '8Jx#U^%NXEvD#jc@A35wH!6PT8^DYo7pXftCKe3P%C%*xN9FQn26ec^kTxkuhA*9fZx@7*P65Y*L2Ty#Z*7n*f3#^$R!8TSuQ3THW*t#seL#iE7MatYEowb$GvU!8Y!5' + pre_configured_consent_duration: 100y redirect_uris: - https://flight.pukeko.xyz/ - id: vikunja description: Vikunja secret: 'ryKVwXhfHeAQKJJHwejEpK66pAuTGvY2saZArKTFZPjWVs2fKNHDAwah8TbPP44LGKYPBYJxU5Ua5H4Su87DAY4ktpAz6UfmpB9XnXCPoACtBrwBgykjoC6cUzXJRc7t' + pre_configured_consent_duration: 100y + authorization_policy: one_factor redirect_uris: - https://tasks.pukeko.xyz/auth/openid/ - https://tasks.pukeko.xyz/auth/openid/authelia diff --git a/docker-compose.yml b/docker-compose.yml index 6242127..ebbb788 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,7 +1,5 @@ version: "3.3" - services: - traefik: image: "traefik:v2.6" container_name: "traefik" @@ -20,10 +18,6 @@ services: - "--certificatesresolvers.pukekoresolver.acme.email=matanhorovitz@protonmail.com" - "--certificatesresolvers.pukekoresolver.acme.storage=/letsencrypt/acme.json" - "--certificatesresolvers.pukekoresolver.acme.dnschallenge.resolvers=1.1.1.1:53" -# Proxy to local Cockpit server -# - "--providers.file=true" -# - "--providers.file.directory=./config/cockpit.yml" -# - "--providers.file.watch=true" ports: - "80:80" - "443:443" @@ -33,8 +27,8 @@ services: - CF_API_EMAIL=matanhorovitz@protonmail.com - CF_DNS_API_TOKEN=0dFNYA8qtzVhVtGi4nEb7_aclTOdGthYm5Q7N05n volumes: - - "./letsencrypt:/letsencrypt:z" - - "/var/run/docker.sock:/var/run/docker.sock:z" + - "./letsencrypt:/letsencrypt" + - "/var/run/docker.sock:/var/run/docker.sock" networks: - network - internal @@ -70,12 +64,12 @@ services: - "traefik.http.middlewares.domain.redirectregex.permanent=true" # user: 1001:1001 dns: - - 150.201.34.6 + - 150.201.34.99 homer: image: b4bz/homer container_name: homer volumes: - - ./homer/:/www/assets:z + - ./homer/:/www/assets ports: - 4957:8080 environment: @@ -98,7 +92,7 @@ services: - TZ=Asia/Jerusalem - AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE=/run/secrets/private_key volumes: - - ./authelia:/config:z + - ./authelia:/config restart: unless-stopped secrets: - hmac @@ -120,7 +114,7 @@ services: - internal - dns_network dns: - - 150.201.34.6 + - 150.201.34.99 expose: - 9091 secrets: