SELinux purges; DNS updates; remember Authelian consent

authelia/configuration.yml

@@ -42,7 +42,7 @@ access_control:
         - 192.168.0.0/24
         # Wireguard
         - 10.8.0.0/16 
-      policy: one_factor
+      policy: bypass
 #   Allow access to container's /api address
     - domain:
       - "*.pukeko.xyz"
@@ -74,6 +74,9 @@ access_control:
     - domain: "news.pukeko.xyz"
       policy: one_factor
       subject: "group:family"
+    - domain: "tasks.pukeko.xyz"
+      policy: one_factor
+      subject: "group:family"
 #   Allow access to shares within Filebrowser
     - domain: "cloud.pukeko.xyz"
       policy: bypass
@@ -107,12 +110,12 @@ storage:
 notifier:
   disable_startup_check: false
   smtp:
-    host: smtp.mail.yahoo.com
+    host: smtp.zoho.com
     port: 587
     timeout: 5s
-    username: "pukekoxyz"
+    username: "matan@pukeko.xyz"
-    password: "pvefngmuhcxunzqs"
+    password: "DjazsDaEzrU9"
-    sender: pukekoxyz@yahoo.com
+    sender: matan@pukeko.xyz
     identifier: localhost
     subject: "[Authelia] {authelia}"
     startup_check_address: test@authelia.com
@@ -124,16 +127,19 @@ identity_providers:
       - id: portainer
         description: Portainer CE
         secret: '8zDD%J3Z66A4uL%!N*G@@Uo5b6z2JbgQ3fxCr39o%LXE%Yb@6SAegGGU#!v*o3Z5u$2WJ#YC6TwEb723rZ$bbtmNJ#35Nsq7E!i9v$jU223$C@!Z&Nkwa&^Yg#DmDxk5'
+        pre_configured_consent_duration: 100y
         redirect_uris:
           - https://portain.pukeko.xyz/
       - id: gitea
         description: Gitea
         secret: '3s4as%cU$cKH2&MiXwzC#h8GJCY2eoS%#7&*9qC&H$ujv%qD8P6rWvrtbM8$f2#zM^phWUAz%2Bk7gCGJf#nA&i3BKvwG79&5hdp&mgddhdSFt&3BpX%a2Sv*Z#mK^J3'
+        pre_configured_consent_duration: 100y
         redirect_uris:
           - https://git.pukeko.xyz/user/oauth2/Authelia/callback
       - id: wekan
         description: Wekan
         secret: '6BekdjG2Rs25MGg!NU#VEbScrQDriT2z6#wDgRK2KS4fsq5bB8hA@z8RSqs5y&pm%f94*xTw2@4&3Qv2Vg2%hv6Vq9&GNLcJfGdUxb&KM!Y@@My&ujqG3%j^Xdqs8bF^'
+        pre_configured_consent_duration: 100y
         redirect_uris:
           - https://tasks.pukeko.xyz/_oauth/oidc
       - id: wikijs
@@ -141,7 +147,7 @@ identity_providers:
         secret: 'mT#!fwRZ3$pE5g2rG4CCNKLkg4zg7&3L92e9LGemfYMbr92gPos&Js*4DU#&^*EUJ#PrP*y#W$W7^i2#zqJPhiK$3$z9uDNXYA$h9Urcuo8!Ggcq^#C6dow^s*VxV&WU'
         public: false
         authorization_policy: two_factor
-        audience: []
+        pre_configured_consent_duration: 100y
         redirect_uris:
           - https://wiki.pukeko.xyz/login/a8755bfb-8a4e-49b7-b31b-43ac5638367a/callback
         userinfo_signing_algorithm: none
@@ -150,21 +156,19 @@ identity_providers:
           - email
           - profile
           - groups
-        grant_types:
-          - refresh_token
-          - authorization_code
-        response_types:
-          - code
         response_modes:
           - form_post
       - id: grafana
         description: Grafana
         secret: '8Jx#U^%NXEvD#jc@A35wH!6PT8^DYo7pXftCKe3P%C%*xN9FQn26ec^kTxkuhA*9fZx@7*P65Y*L2Ty#Z*7n*f3#^$R!8TSuQ3THW*t#seL#iE7MatYEowb$GvU!8Y!5'
+        pre_configured_consent_duration: 100y
         redirect_uris:
           - https://flight.pukeko.xyz/
       - id: vikunja
         description: Vikunja
         secret: 'ryKVwXhfHeAQKJJHwejEpK66pAuTGvY2saZArKTFZPjWVs2fKNHDAwah8TbPP44LGKYPBYJxU5Ua5H4Su87DAY4ktpAz6UfmpB9XnXCPoACtBrwBgykjoC6cUzXJRc7t'
+        pre_configured_consent_duration: 100y
+        authorization_policy: one_factor
         redirect_uris:
           - https://tasks.pukeko.xyz/auth/openid/
           - https://tasks.pukeko.xyz/auth/openid/authelia

docker-compose.yml

@@ -1,7 +1,5 @@
 version: "3.3"
-
 services:
-
   traefik:
     image: "traefik:v2.6"
     container_name: "traefik"
@@ -20,10 +18,6 @@ services:
       - "--certificatesresolvers.pukekoresolver.acme.email=matanhorovitz@protonmail.com"
       - "--certificatesresolvers.pukekoresolver.acme.storage=/letsencrypt/acme.json"
       - "--certificatesresolvers.pukekoresolver.acme.dnschallenge.resolvers=1.1.1.1:53"
-# Proxy to local Cockpit server
-#      - "--providers.file=true"
-#      - "--providers.file.directory=./config/cockpit.yml"
-#      - "--providers.file.watch=true"
     ports:
       - "80:80"
       - "443:443"
@@ -33,8 +27,8 @@ services:
       - CF_API_EMAIL=matanhorovitz@protonmail.com
       - CF_DNS_API_TOKEN=0dFNYA8qtzVhVtGi4nEb7_aclTOdGthYm5Q7N05n
     volumes:
-      - "./letsencrypt:/letsencrypt:z"
+      - "./letsencrypt:/letsencrypt"
-      - "/var/run/docker.sock:/var/run/docker.sock:z"
+      - "/var/run/docker.sock:/var/run/docker.sock"
     networks:
       - network
       - internal
@@ -70,12 +64,12 @@ services:
       - "traefik.http.middlewares.domain.redirectregex.permanent=true"
         #    user: 1001:1001
     dns:
-      - 150.201.34.6
+      - 150.201.34.99
   homer:
     image: b4bz/homer
     container_name: homer
     volumes:
-      - ./homer/:/www/assets:z
+      - ./homer/:/www/assets
     ports:
       - 4957:8080
     environment:
@@ -98,7 +92,7 @@ services:
       - TZ=Asia/Jerusalem
       - AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE=/run/secrets/private_key
     volumes:
-      - ./authelia:/config:z
+      - ./authelia:/config
     restart: unless-stopped
     secrets:
       - hmac
@@ -120,7 +114,7 @@ services:
       - internal
       - dns_network
     dns:
-      - 150.201.34.6
+      - 150.201.34.99
     expose:
       - 9091
 secrets: