shmick/docker
1
0
Fork 0
Code Issues Pull Requests Actions Projects Releases Wiki Activity

Welcome to Traefik

Browse Source
This commit is contained in:
Matan Horovitz
2022-02-28 20:39:21 +02:00
commit ff43ad4b31
6 changed files with 1052 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
.gitignore vendored Normal file
View File

@@ -0,0 +1,3 @@
*
!docker-compose.yml
!authelia/*.yml

119
authelia/configuration.yml Normal file
View File

@@ -0,0 +1,119 @@
server.host: 0.0.0.0
server.port: 9091
server:
read_buffer_size: 4096
write_buffer_size: 4096
path: "authelia"
log.level: debug
jwt_secret: M22162530
totp:
issuer: authelia.com
period: 30
skew: 1
default_redirection_url: https://pukeko.xyz/
authentication_backend:
disable_reset_password: false
file:
path: /config/users_database.yml
password:
algorithm: argon2id
iterations: 1
key_length: 32
salt_length: 16
memory: 512
parallelism: 8
access_control:
default_policy: deny
rules:
# Dumb redirect to dash.pukeko.xyz - do not auth
- domain: "pukeko.xyz"
policy: bypass
- domain:
- "*.pukeko.xyz"
networks:
- 192.168.0.0/24
policy: bypass
# Allow access to specific subdomains with family group
- domain: "photos.pukeko.xyz"
policy: one_factor
subject: "group:family"
# Allow access to shares within Filebrowser
- domain: "cloud.pukeko.xyz"
policy: bypass
resources:
# Match only /share/ url's - Filebrowser's shares
- "^*/share/.*"
- domain:
- "*.pukeko.xyz"
policy: two_factor
session:
name: authelia_session
secret: M22162530
expiration: 1h
inactivity: 5m
remember_me_duration: 1M
domain: "pukeko.xyz"
regulation:
max_retries: 3
find_time: 2m
ban_time: 5m
storage:
encryption_key: "D3$RQ2N%S*t@q*hA@i53yb7aG5eSRgpFYqXU@Na3E^j&UB*JGEG#eRoT$vs8#h#mNM3BDA549JNabVaM7vM6pZ89YxE*a68zZ%^RCx@GV362V6$jo*mA!X5%y7M9Ru*F"
local:
path: /config/db.sqlite3
notifier:
disable_startup_check: false
smtp:
host: smtp.mail.yahoo.com
port: 587
timeout: 5s
username: "pukekoxyz"
password: "pvefngmuhcxunzqs"
sender: pukekoxyz@yahoo.com
identifier: localhost
subject: "[Authelia] {authelia}"
startup_check_address: test@authelia.com
disable_require_tls: false
disable_html_emails: false
identity_providers:
oidc:
clients:
- id: portainer
description: Portainer CE
secret: '8zDD%J3Z66A4uL%!N*G@@Uo5b6z2JbgQ3fxCr39o%LXE%Yb@6SAegGGU#!v*o3Z5u$2WJ#YC6TwEb723rZ$bbtmNJ#35Nsq7E!i9v$jU223$C@!Z&Nkwa&^Yg#DmDxk5'
redirect_uris:
- https://portain.pukeko.xyz/
- id: gitea
description: Gitea
secret: '3s4as%cU$cKH2&MiXwzC#h8GJCY2eoS%#7&*9qC&H$ujv%qD8P6rWvrtbM8$f2#zM^phWUAz%2Bk7gCGJf#nA&i3BKvwG79&5hdp&mgddhdSFt&3BpX%a2Sv*Z#mK^J3'
redirect_uris:
- https://git.pukeko.xyz/user/oauth2/Authelia/callback
- id: wekan
description: Wekan
secret: '6BekdjG2Rs25MGg!NU#VEbScrQDriT2z6#wDgRK2KS4fsq5bB8hA@z8RSqs5y&pm%f94*xTw2@4&3Qv2Vg2%hv6Vq9&GNLcJfGdUxb&KM!Y@@My&ujqG3%j^Xdqs8bF^'
redirect_uris:
- https://tasks.pukeko.xyz/_oauth/oidc
- id: wikijs
description: WikiJS
secret: 'mT#!fwRZ3$pE5g2rG4CCNKLkg4zg7&3L92e9LGemfYMbr92gPos&Js*4DU#&^*EUJ#PrP*y#W$W7^i2#zqJPhiK$3$z9uDNXYA$h9Urcuo8!Ggcq^#C6dow^s*VxV&WU'
redirect_uris:
- https://wiki.pukeko.xyz/login/2075d75c-0a5f-4949-bc42-2114036b97b3/callback
scopes:
- openid
- email
- profile
- groups
grant_types:
- refresh_token
- authorization_code
response_types:
- code
response_modes:
- form_post
- query
- fragment
- id: grafana
description: Grafana
secret: '8Jx#U^%NXEvD#jc@A35wH!6PT8^DYo7pXftCKe3P%C%*xN9FQn26ec^kTxkuhA*9fZx@7*P65Y*L2Ty#Z*7n*f3#^$R!8TSuQ3THW*t#seL#iE7MatYEowb$GvU!8Y!5'
redirect_uris:
- https://flight.pukeko.xyz/

676
authelia/configuration_default.yml Normal file
View File

@@ -0,0 +1,676 @@
# yamllint disable rule:comments-indentation
---
###############################################################################
# Authelia Configuration #
###############################################################################
## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to
## the system certificates store.
## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem.
# certificates_directory: /config/certificates
## The theme to display: light, dark, grey, auto.
theme: light
## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be
## set using a secret: https://www.authelia.com/docs/configuration/secrets.html
jwt_secret: a_very_important_secret
## Default redirection URL
##
## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end
## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use
## in such a case.
##
## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
default_redirection_url: https://home.example.com/
##
## Server Configuration
##
server:
## The address to listen on.
host: 0.0.0.0
## The port to listen on.
port: 9091
## Set the single level path Authelia listens on.
## Must be alphanumeric chars and should not contain any slashes.
path: ""
## Buffers usually should be configured to be the same value.
## Explanation at https://www.authelia.com/docs/configuration/server.html
## Read buffer size adjusts the server's max incoming request size in bytes.
## Write buffer size does the same for outgoing responses.
read_buffer_size: 4096
write_buffer_size: 4096
## Enables the pprof endpoint.
enable_pprof: false
## Enables the expvars endpoint.
enable_expvars: false
## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0.
## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist.
disable_healthcheck: false
## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour.
tls:
## The path to the DER base64/PEM format private key.
key: ""
## The path to the DER base64/PEM format public certificate.
certificate: ""
##
## Log Configuration
##
log:
## Level of verbosity for logs: info, debug, trace.
level: debug
## Format the logs are written as: json, text.
# format: json
## File path where the logs will be written. If not set logs are written to stdout.
# file_path: /config/authelia.log
## Whether to also log to stdout when a log_file_path is defined.
# keep_stdout: false
##
## TOTP Configuration
##
## Parameters used for TOTP generation.
totp:
## The issuer name displayed in the Authenticator application of your choice
## See: https://github.com/google/google-authenticator/wiki/Key-Uri-Format for more info on issuer names
issuer: authelia.com
## The period in seconds a one-time password is current for. Changing this will require all users to register
## their TOTP applications again. Warning: before changing period read the docs link below.
period: 30
## The skew controls number of one-time passwords either side of the current one that are valid.
## Warning: before changing skew read the docs link below.
skew: 1
## See: https://www.authelia.com/docs/configuration/one-time-password.html#period-and-skew to read the documentation.
##
## Duo Push API Configuration
##
## Parameters used to contact the Duo API. Those are generated when you protect an application of type
## "Partner Auth API" in the management panel.
duo_api:
hostname: api-123456789.example.com
integration_key: ABCDEF
## Secret can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html
secret_key: 1234567890abcdefghifjkl
##
## Authentication Backend Provider Configuration
##
## Used for verifying user passwords and retrieve information such as email address and groups users belong to.
##
## The available providers are: `file`, `ldap`. You must use only one of these providers.
authentication_backend:
## Disable both the HTML element and the API for reset password functionality.
disable_reset_password: false
## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation.
## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
## To force update on every request you can set this to '0' or 'always', this will increase processor demand.
## See the below documentation for more information.
## Duration Notation docs: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
## Refresh Interval docs: https://www.authelia.com/docs/configuration/authentication/ldap.html#refresh-interval
refresh_interval: 5m
##
## LDAP (Authentication Provider)
##
## This is the recommended Authentication Provider in production
## because it allows Authelia to offload the stateful operations
## onto the LDAP service.
ldap:
## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
## Acceptable options are as follows:
## - 'activedirectory' - For Microsoft Active Directory.
## - 'custom' - For custom specifications of attributes and filters.
## This currently defaults to 'custom' to maintain existing behaviour.
##
## Depending on the option here certain other values in this section have a default value, notably all of the
## attribute mappings have a default value that this config overrides, you can read more about these default values
## at https://www.authelia.com/docs/configuration/authentication/ldap.html#defaults
implementation: custom
## The url to the ldap server. Format: <scheme>://<address>[:<port>].
## Scheme can be ldap or ldaps in the format (port optional).
url: ldap://127.0.0.1
## The dial timeout for LDAP.
timeout: 5s
## Use StartTLS with the LDAP connection.
start_tls: false
tls:
## Server Name for certificate validation (in case it's not set correctly in the URL).
# server_name: ldap.example.com
## Skip verifying the server certificate (to allow a self-signed certificate).
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
skip_verify: false
## Minimum TLS version for either Secure LDAP or LDAP StartTLS.
minimum_version: TLS1.2
## The distinguished name of the container searched for objects in the directory information tree.
## See also: additional_users_dn, additional_groups_dn.
base_dn: dc=example,dc=com
## The attribute holding the username of the user. This attribute is used to populate the username in the session
## information. It was introduced due to #561 to handle case insensitive search queries. For you information,
## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this
## attribute holds the unique identifiers for the users binding the user and the configuration stored in database.
## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user
## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also
## be used but we don't recommend using them, we instead advise to use the attributes mentioned above
## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt.
# username_attribute: uid
## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users.
## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users.
additional_users_dn: ou=users
## The users filter used in search queries to find the user profile based on input filled in login form.
## Various placeholders are available in the user filter which you can read about in the documentation which can
## be found at: https://www.authelia.com/docs/configuration/authentication/ldap.html#users-filter-replacements
##
## Recommended settings are as follows:
## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
## - OpenLDAP:
## - (&({username_attribute}={input})(objectClass=person))
## - (&({username_attribute}={input})(objectClass=inetOrgPerson))
##
## To allow sign in both with username and email, one can use a filter like
## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
users_filter: (&({username_attribute}={input})(objectClass=person))
## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups.
## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups.
additional_groups_dn: ou=groups
## The groups filter used in search queries to find the groups based on relevant authenticated user.
## Various placeholders are available in the groups filter which you can read about in the documentation which can
## be found at: https://www.authelia.com/docs/configuration/authentication/ldap.html#groups-filter-replacements
##
## If your groups use the `groupOfUniqueNames` structure use this instead:
## (&(uniqueMember={dn})(objectClass=groupOfUniqueNames))
groups_filter: (&(member={dn})(objectClass=groupOfNames))
## The attribute holding the name of the group.
# group_name_attribute: cn
## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
## first one returned by the LDAP server is used.
# mail_attribute: mail
## The attribute holding the display name of the user. This will be used to greet an authenticated user.
# display_name_attribute: displayName
## The username and password of the admin user.
user: cn=admin,dc=example,dc=com
## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html
password: password
##
## File (Authentication Provider)
##
## With this backend, the users database is stored in a file which is updated when users reset their passwords.
## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia
## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security
## implications it is highly recommended you leave the default values. Before considering changing these settings
## please read the docs page below:
## https://www.authelia.com/docs/configuration/authentication/file.html#password-hash-algorithm-tuning
##
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
##
# file:
# path: /config/users_database.yml
# password:
# algorithm: argon2id
# iterations: 1
# key_length: 32
# salt_length: 16
# memory: 1024
# parallelism: 8
##
## Access Control Configuration
##
## Access control is a list of rules defining the authorizations applied for one resource to users or group of users.
##
## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed
## to anyone. Otherwise restrictions follow the rules defined.
##
## Note: One can use the wildcard * to match any subdomain.
## It must stand at the beginning of the pattern. (example: *.mydomain.com)
##
## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct.
##
## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'.
##
## - 'domain' defines which domain or set of domains the rule applies to.
##
## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not
## provided. If provided, the parameter represents either a user or a group. It should be of the form
## 'user:<username>' or 'group:<groupname>'.
##
## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'.
##
## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter
## is optional and matches any resource if not provided.
##
## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies.
access_control:
## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
## resource if there is no policy to be applied to the user.
default_policy: deny
networks:
- name: internal
networks:
- 10.10.0.0/16
- 192.168.2.0/24
- name: VPN
networks: 10.9.0.0/16
rules:
## Rules applied to everyone
- domain: public.example.com
policy: bypass
- domain: secure.example.com
policy: one_factor
## Network based rule, if not provided any network matches.
networks:
- internal
- VPN
- 192.168.1.0/24
- 10.0.0.1
- domain:
- secure.example.com
- private.example.com
policy: two_factor
- domain: singlefactor.example.com
policy: one_factor
## Rules applied to 'admins' group
- domain: "mx2.mail.example.com"
subject: "group:admins"
policy: deny
- domain: "*.example.com"
subject:
- "group:admins"
- "group:moderators"
policy: two_factor
## Rules applied to 'dev' group
- domain: dev.example.com
resources:
- "^/groups/dev/.*$"
subject: "group:dev"
policy: two_factor
## Rules applied to user 'john'
- domain: dev.example.com
resources:
- "^/users/john/.*$"
subject: "user:john"
policy: two_factor
## Rules applied to user 'harry'
- domain: dev.example.com
resources:
- "^/users/harry/.*$"
subject: "user:harry"
policy: two_factor
## Rules applied to user 'bob'
- domain: "*.mail.example.com"
subject: "user:bob"
policy: two_factor
- domain: "dev.example.com"
resources:
- "^/users/bob/.*$"
subject: "user:bob"
policy: two_factor
##
## Session Provider Configuration
##
## The session cookies identify the user once logged in.
## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined.
session:
## The name of the session cookie.
name: authelia_session
## The domain to protect.
## Note: the authenticator must also be in that domain.
## If empty, the cookie is restricted to the subdomain of the issuer.
domain: example.com
## Sets the Cookie SameSite value. Possible options are none, lax, or strict.
## Please read https://www.authelia.com/docs/configuration/session.html#same_site
same_site: lax
## The secret to encrypt the session data. This is only used with Redis / Redis Sentinel.
## Secret can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html
secret: insecure_session_secret
## The value for expiration, inactivity, and remember_me_duration are in seconds or the duration notation format.
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
## All three of these values affect the cookie/session validity period. Longer periods are considered less secure
## because a stolen cookie will last longer giving attackers more time to spy or attack.
## The time before the cookie expires and the session is destroyed if remember me IS NOT selected.
expiration: 1h
## The inactivity time before the session is reset. If expiration is set to 1h, and this is set to 5m, if the user
## does not select the remember me option their session will get destroyed after 1h, or after 5m since the last time
## Authelia detected user activity.
inactivity: 5m
## The time before the cookie expires and the session is destroyed if remember me IS selected.
## Value of 0 disables remember me.
remember_me_duration: 1M
##
## Redis Provider
##
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
##
redis:
host: 127.0.0.1
port: 6379
## Use a unix socket instead
# host: /var/run/redis/redis.sock
## Username used for redis authentication. This is optional and a new feature in redis 6.0.
# username: authelia
## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html
password: authelia
## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
database_index: 0
## The maximum number of concurrent active connections to Redis.
maximum_active_connections: 8
## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
minimum_idle_connections: 0
## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s).
# tls:
## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
# server_name: myredis.example.com
## Skip verifying the server certificate (to allow a self-signed certificate).
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
# skip_verify: false
## Minimum TLS version for the connection.
# minimum_version: TLS1.2
## The Redis HA configuration options.
## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
# high_availability:
## Sentinel Name / Master Name.
# sentinel_name: mysentinel
## Specific password for Redis Sentinel. The node username and password is configured above.
# sentinel_password: sentinel_specific_pass
## The additional nodes to pre-seed the redis provider with (for sentinel).
## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
## For high availability to be used you must have either defined; the host above or at least one node below.
# nodes:
# - host: sentinel-node1
# port: 6379
# - host: sentinel-node2
# port: 6379
## Choose the host with the lowest latency.
# route_by_latency: false
## Choose the host randomly.
# route_randomly: false
##
## Regulation Configuration
##
## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are made
## in a short period of time.
regulation:
## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
max_retries: 3
## The time range during which the user can attempt login before being banned. The user is banned if the
## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
find_time: 2m
## The length of time before a banned user can login again. Ban Time accepts duration notation.
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
ban_time: 5m
##
## Storage Provider Configuration
##
## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.
storage:
##
## Local (Storage Provider)
##
## This stores the data in a SQLite3 Database.
## This is only recommended for lightweight non-stateful installations.
##
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
##
# local:
# path: /config/db.sqlite3
##
## MySQL / MariaDB (Storage Provider)
##
mysql:
host: 127.0.0.1
port: 3306
database: authelia
username: authelia
## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html
password: mypassword
timeout: 5s
##
## PostgreSQL (Storage Provider)
##
# postgres:
# host: 127.0.0.1
# port: 5432
# database: authelia
# username: authelia
# ## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html
# password: mypassword
# timeout: 5s
# sslmode: disable
##
## Notification Provider
##
## Notifications are sent to users when they require a password reset, a U2F registration or a TOTP registration.
## The available providers are: filesystem, smtp. You must use only one of these providers.
notifier:
## You can disable the notifier startup check by setting this to true.
disable_startup_check: false
##
## File System (Notification Provider)
##
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
##
# filesystem:
# filename: /config/notification.txt
##
## SMTP (Notification Provider)
##
## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate.
## [Security] By default Authelia will:
## - force all SMTP connections over TLS including unauthenticated connections
## - use the disable_require_tls boolean value to disable this requirement
## (only works for unauthenticated connections)
## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates
## (configure in tls section)
smtp:
## The SMTP host to connect to.
host: 127.0.0.1
## The port to connect to the SMTP host on.
port: 1025
## The connection timeout.
timeout: 5s
## The username used for SMTP authentication.
username: test
## The password used for SMTP authentication.
## Can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html
password: password
## The address to send the email FROM.
sender: admin@example.com
## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost.
identifier: localhost
## Subject configuration of the emails sent. {title} is replaced by the text from the notifier.
subject: "[Authelia] {title}"
## This address is used during the startup check to verify the email configuration is correct.
## It's not important what it is except if your email server only allows local delivery.
startup_check_address: test@authelia.com
## By default we require some form of TLS. This disables this check though is not advised.
disable_require_tls: false
## Disables sending HTML formatted emails.
disable_html_emails: false
tls:
## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
# server_name: smtp.example.com
## Skip verifying the server certificate (to allow a self-signed certificate).
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
skip_verify: false
## Minimum TLS version for either StartTLS or SMTPS.
minimum_version: TLS1.2
##
## Identity Providers
##
# identity_providers:
##
## OpenID Connect (Identity Provider)
##
## It's recommended you read the documentation before configuration of this section:
## https://www.authelia.com/docs/configuration/identity-providers/oidc.html
# oidc:
## The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens).
## HMAC Secret can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html
# hmac_secret: this_is_a_secret_abc123abc123abc
## The issuer_private_key is used to sign the JWT forged by OpenID Connect.
## Issuer Private Key can also be set using a secret: https://docs.authelia.com/configuration/secrets.html
# issuer_private_key: |
# --- KEY START
# --- KEY END
## The lifespans configure the expiration for these token types.
# access_token_lifespan: 1h
# authorize_code_lifespan: 1m
# id_token_lifespan: 1h
# refresh_token_lifespan: 90m
## Enables additional debug messages.
# enable_client_debug_messages: false
## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for
## security reasons.
# minimum_parameter_entropy: 8
## Clients is a list of known clients and their configuration.
# clients:
# -
## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
# id: myapp
## The description to show to users when they end up on the consent screen. Defaults to the ID above.
# description: My Application
## The client secret is a shared secret between Authelia and the consumer of this client.
# secret: this_is_a_secret
## Sets the client to public. This should typically not be set, please see the documentation for usage.
# public: false
## The policy to require for this client; one_factor or two_factor.
# authorization_policy: two_factor
## Audience this client is allowed to request.
# audience: []
## Scopes this client is allowed to request.
# scopes:
# - openid
# - groups
# - email
# - profile
## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
# redirect_uris:
# - https://oidc.example.com:8080/oauth2/callback
## Grant Types configures which grants this client can obtain.
## It's not recommended to define this unless you know what you're doing.
# grant_types:
# - refresh_token
# - authorization_code
## Response Types configures which responses this client can be sent.
## It's not recommended to define this unless you know what you're doing.
# response_types:
# - code
## Response Modes configures which response modes this client supports.
# response_modes:
# - form_post
# - query
# - fragment
## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
# userinfo_signing_algorithm: none
...

62
authelia/openid.yml Normal file
View File

@@ -0,0 +1,62 @@
identity_providers:
oidc:
hmac_secret: &R#&e^xYwijUmr5d$5$Wa^Ki@g3%@6Ehykih#u@qUtFK9%rHy9H6soBr^86^4p!H*q!u4D7Pq6j&pXUz2jVrF992mejt&5s3mvG^q8Ls7UZCyo8rd&$BVTx@y#s%yf5U #Bitwarden
issuer_private_key: |
--- KEY START
MIIEogIBAAKCAQEAnkzvqdtgIl71Bd7fIarSCDLI/dhTyl8G+xdmoH9wH3dGqbbn
m0SV280wVRVEkGEJIohqXY+DMNrLiqvPvCTxjYAyqinjHqQFsEgtDsQ7rqpoi2U/
3HvAdF+2obQvFz5w5urkXKyLTfkFU7+tvjiJhCYvAoUZA/Bx0LcK8Hh0OhuwN0L9
9Rq7VK0HlC5TlP1nRCUZYEDNLR0mKcKqCuAST8m5FucF/ZQaanF9anphgRavbUfp
EyKvnbPGZLPf4IjbRQbxfwyNqRcDjNaP4ytjAAY4+F6aSdZePos08IzC8qemgqEm
/iKVn9XUcgwZ/EjITLoEbzoFUJV91H0CiyfuBwIDAQABAoIBAHWMGddekGdVbcrb
MYOVjfsKgxeEQMwgflWLjeiWWRL0hiNWL2urpUAfgMldTpmLhLYA6ELrY3auscAa
Ttqd8ESrsnOLQRyqnZLGNbcmXk8YOSNxntdBiaqgvEQdQW6YLkw6ljJ+6b6PsLX8
uq5q2yqnE/diEC5NqKZclaH1QBE4/R+iDRXuAgrHvArv9uL0pD+lrms7dEfHcewn
vKzv3+AKv0maGQ+aZyh3i0xPvmMqiT8ddvRmSqq60aCtCrVezJ8rd1D7IxLQ3t/T
uR0jwCf8kPS8KNcPgGb5RuJ4Up+8IywU8PSiReIugD+wyvVxWLTcMCEXd7qITofR
pWF447ECgYEAwpSRc26hEo9JX0yBAP5dqBKdW8BJzxjCjWJ5N1KmZFppuymyJ7I0
2aGUM8ffm8uiecJpMmnzUuF9v2/SjcsDghcslSn9qczajBI4x1Xic1272HjstrfO
9HSoGf1M1Rn7tHFFoM/ydELMkTacxvZa6i3d+UmZ3OBDheGTj1c4lK8CgYEA0ES1
ln+JRGW+sMBEhP6VZgGXkwgLJzMCDJQ1riNfYy/UxFldXB2Tz7+pAVYUndRsMh+u
DHcBFe9ENnYMDfba434NqyhmWEeXgtJ1ICu1nunltTtM458zB84OGt9j8mmCTedW
HxfyE0YGYgVF47n7fc+h5QB/3BapK7diOUYtQikCgYBcQZbJFT33j8ppDdvofbIo
O1MyqnQUZhfwcy0n5t8Pm7Kf1AAtRBg8y5h6CJ1jv+Q0ONIp3gRJWrKFbt507jmm
l5hCzRsBRCim2wjisjzhGCM1WvhZFcNhMmJ1mByyuVQXVNF/krjRGM7nVu50g1/N
wpuJU7VI/WfmdXLCNseT7wKBgCvxk28B0fDAlw+sQcjd/p/bTiQT2maW+KO20ezA
Qewnt3kGchBxnTKEeiByDT+QBpQ84vh2U6BRL89d8QUxRNYjTrcCezW9RVaxGU2E
a3nwWCt5K6wLdzT6YTeCUxBe+sN9QEqnPsiaSdZ8zlZSc6IEIWC0TkYd8evrcaos
CHihAoGAFt+od36TPiYgczaoWJ2dlLz6xLnPn/nhrSICxJhdBtCywT1uxH0THaiA
NiAwc5R8fJUPBuIdd0ur/mgAV8VTcXsY/mvihrHnqCKinQKdCt1yukpFhvs68AyP
O+iDoe3R22OcCFg+wuEMGDPspkNtuKV0j0UvqtaDuWqWZNOyYCU=
--- KEY END
access_token_lifespan: 1h
authorize_code_lifespan: 1m
id_token_lifespan: 1h
refresh_token_lifespan: 90m
enable_client_debug_messages: false
clients:
- id: portainer
description: Container management interface
secret: 8zDD%J3Z66A4uL%!N*G@@Uo5b6z2JbgQ3fxCr39o%LXE%Yb@6SAegGGU#!v*o3Z5u$2WJ#YC6TwEb723rZ$bbtmNJ#35Nsq7E!i9v$jU223$C@!Z&Nkwa&^Yg#DmDxk5 #Bitwarden
public: false
authorization_policy: two_factor
audience: []
scopes:
- openid
- groups
- email
- profile
redirect_uris:
- https://oidc.example.com:8080/oauth2/callback
grant_types:
- refresh_token
- authorization_code
response_types:
- code
response_modes:
- form_post
- query
- fragment
userinfo_signing_algorithm: none

38
authelia/users_database.yml Normal file
View File

@@ -0,0 +1,38 @@
users:
ishgamad:
password: $argon2id$v=19$m=65536,t=1,p=8$aDNUbCtTSEpJdkJnL1B5aQ$lSTiaRsWgPpTqYSGissf4umr0VQPPulynH9igqiMVFg
displayname: Omer Horovitz
email: ishgamad@gmail.com
groups:
- family
joe:
password: $argon2id$v=19$m=65536,t=1,p=8$aDNUbCtTSEpJdkJnL1B5aQ$lSTiaRsWgPpTqYSGissf4umr0VQPPulynH9igqiMVFg
displayname: Jospeh Horovitz
email: yhorovitz@gmail.com
groups:
- family
shmick:
password: $argon2id$v=19$m=524288,t=1,p=8$OXZDU0NqS3J1VVBhWkdGMg$yvlKAog0MTtP95VpXgeWFnyiX5uNGK23vDqmcP8lLAU
displayname: Shmickonon Shmickovski
email: matanhorovitz@protonmail.com
groups:
- admins
- dev
sigal:
password: $argon2id$v=19$m=65536,t=1,p=8$aDNUbCtTSEpJdkJnL1B5aQ$lSTiaRsWgPpTqYSGissf4umr0VQPPulynH9igqiMVFg
displayname: Sigal Horovitz
email: sigalh666@gmail.com
groups:
- family
tieke:
password: $argon2id$v=19$m=65536,t=1,p=8$Q1lhdTgzZU9KUGRYaElPRg$HsXPgSjC0gmpbXjrvg1kb6FJdrSZlO8dL2jxvXRY9vc
displayname: Guest User
email: ""
groups:
- guest
yuval:
password: $argon2id$v=19$m=65536,t=1,p=8$aDNUbCtTSEpJdkJnL1B5aQ$lSTiaRsWgPpTqYSGissf4umr0VQPPulynH9igqiMVFg
displayname: Yuval Horovitz
email: iamJUSTICEo3o@gmail.com
groups:
- family

154
docker-compose.yml Normal file
View File

@@ -0,0 +1,154 @@
version: "3.3"
services:
traefik:
image: "traefik:v2.6"
container_name: "traefik"
command:
- "--log.level=DEBUG"
- "--api.insecure=true"
- "--providers.docker=true"
- "--providers.docker.exposedbydefault=false"
- "--entrypoints.web.address=:80"
- "--entrypoints.websecure.address=:443"
- "--certificatesresolvers.pukekoresolver.acme.dnschallenge=true"
- "--certificatesresolvers.pukekoresolver.acme.dnschallenge.provider=cloudflare"
#- "--certificatesresolvers.pukekoresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
- "--certificatesresolvers.pukekoresolver.acme.email=matanhorovitz@protonmail.com"
- "--certificatesresolvers.pukekoresolver.acme.storage=/letsencrypt/acme.json"
- "--certificatesresolvers.pukekoresolver.acme.dnschallenge.resolvers=1.1.1.1:53"
ports:
- "80:80"
- "443:443"
- "8282:8080"
environment:
- CF_API_KEY=12fd3e74bd60d39d192ff0e51fa2f6af90402
- CF_API_EMAIL=matanhorovitz@protonmail.com
- CF_DNS_API_TOKEN=0dFNYA8qtzVhVtGi4nEb7_aclTOdGthYm5Q7N05n
volumes:
- "./letsencrypt:/letsencrypt"
- "/var/run/docker.sock:/var/run/docker.sock:ro"
networks:
- traefik_network
- arr_network
- filebrowser_network
- gitea_network
- grocy_network
- vaultwarden_network
- vikunja_network
- freshrss_network
- jekyll_network
- jellyfin_network
- joplin_network
- photoprism_network
- podgrab_network
- portainer_network
- prometheus_network
- qbittorrent_network
- syncthing_network
- wikijs_network
- wireguard_network
restart: unless-stopped
labels:
- "traefik.enable=true"
- "traefik.http.routers.homer.entrypoints=websecure"
- "traefik.http.routers.domain.rule=Host(`pukeko.xyz`)"
- "traefik.http.routers.domain.service=noop@internal"
- "traefik.http.routers.domain.middlewares=pukeko-redirect"
- 'traefik.http.middlewares.pukeko-redirect.redirectregex.regex=^http://pukeko.xyz/(.*)'
- 'traefik.http.middlewares.pukeko-redirect.redirectregex.replacement=http://dash.pukeko.xyz/$${1}'
- "traefik.http.middlewares.pukeko-redirect.redirectregex.permanent=true"
homer:
image: b4bz/homer
container_name: homer
volumes:
- /Red-Vol/Media/Containers/homer/assets/:/www/assets
ports:
- 4957:8080
environment:
- UID=1000
- GID=1000
restart: unless-stopped
labels:
- "traefik.enable=true"
- "traefik.http.routers.homer.entrypoints=websecure"
- "traefik.http.routers.homer.rule=Host(`dash.pukeko.xyz`)"
- "traefik.http.routers.homer.service=homer-traefik@docker"
- "traefik.http.routers.homer.tls.certresolver=pukekoresolver"
- "traefik.http.routers.homer.middlewares=authelia@docker"
networks:
- traefik_network
authelia:
image: authelia/authelia:latest
container_name: authelia
environment:
- TZ=Asia/Jerusalem
- AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE=/run/secrets/private_key
volumes:
- ./authelia:/config
restart: unless-stopped
secrets:
- hmac
- private_key
labels:
- 'traefik.enable=true'
- 'traefik.http.routers.authelia.rule=Host(`auth.pukeko.xyz`)'
- 'traefik.http.routers.authelia.entrypoints=websecure'
- 'traefik.http.routers.authelia.tls=true'
- 'traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.pukeko.xyz/'
- 'traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true'
- 'traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User, Remote-Groups, Remote-Name, Remote-Email'
- 'traefik.http.middlewares.authelia-basic.forwardauth.address=http://authelia:9091/api/verify?auth=basic'
- 'traefik.http.middlewares.authelia-basic.forwardauth.trustForwardHeader=true'
- 'traefik.http.middlewares.authelia-basic.forwardauth.authResponseHeaders=Remote-User, Remote-Groups, Remote-Name, Remote-Email'
expose:
- 9091
networks:
- traefik_network
secrets:
hmac:
file: ./authelia/secrets/hmac
private_key:
file: ./authelia/secrets/issuer_private_key
networks:
traefik_network:
driver: bridge
traefik_internal:
driver: bridge
arr_network:
external: true
filebrowser_network:
external: true
freshrss_network:
external: true
gitea_network:
external: true
grocy_network:
external: true
jekyll_network:
external: true
jellyfin_network:
external: true
joplin_network:
external: true
photoprism_network:
external: true
podgrab_network:
external: true
portainer_network:
external: true
prometheus_network:
external: true
vaultwarden_network:
external: true
vikunja_network:
external: true
wikijs_network:
external: true
wireguard_network:
external: true
qbittorrent_network:
external: true
syncthing_network:
external: true