From ff43ad4b315fdead3e2f6499fd5ed5abb1b3dc46 Mon Sep 17 00:00:00 2001 From: Matan Horovitz Date: Mon, 28 Feb 2022 20:39:21 +0200 Subject: [PATCH] Welcome to Traefik --- .gitignore | 3 + authelia/configuration.yml | 119 +++++ authelia/configuration_default.yml | 676 +++++++++++++++++++++++++++++ authelia/openid.yml | 62 +++ authelia/users_database.yml | 38 ++ docker-compose.yml | 154 +++++++ 6 files changed, 1052 insertions(+) create mode 100644 .gitignore create mode 100644 authelia/configuration.yml create mode 100644 authelia/configuration_default.yml create mode 100644 authelia/openid.yml create mode 100644 authelia/users_database.yml create mode 100644 docker-compose.yml diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..e3100ec --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +* +!docker-compose.yml +!authelia/*.yml diff --git a/authelia/configuration.yml b/authelia/configuration.yml new file mode 100644 index 0000000..c0d804f --- /dev/null +++ b/authelia/configuration.yml @@ -0,0 +1,119 @@ +server.host: 0.0.0.0 +server.port: 9091 +server: + read_buffer_size: 4096 + write_buffer_size: 4096 + path: "authelia" +log.level: debug +jwt_secret: M22162530 +totp: + issuer: authelia.com + period: 30 + skew: 1 +default_redirection_url: https://pukeko.xyz/ +authentication_backend: + disable_reset_password: false + file: + path: /config/users_database.yml + password: + algorithm: argon2id + iterations: 1 + key_length: 32 + salt_length: 16 + memory: 512 + parallelism: 8 +access_control: + default_policy: deny + rules: +# Dumb redirect to dash.pukeko.xyz - do not auth + - domain: "pukeko.xyz" + policy: bypass + - domain: + - "*.pukeko.xyz" + networks: + - 192.168.0.0/24 + policy: bypass +# Allow access to specific subdomains with family group + - domain: "photos.pukeko.xyz" + policy: one_factor + subject: "group:family" +# Allow access to shares within Filebrowser + - domain: "cloud.pukeko.xyz" + policy: bypass + resources: +# Match only /share/ url's - Filebrowser's shares + - "^*/share/.*" + - domain: + - "*.pukeko.xyz" + policy: two_factor +session: + name: authelia_session + secret: M22162530 + expiration: 1h + inactivity: 5m + remember_me_duration: 1M + domain: "pukeko.xyz" +regulation: + max_retries: 3 + find_time: 2m + ban_time: 5m +storage: + encryption_key: "D3$RQ2N%S*t@q*hA@i53yb7aG5eSRgpFYqXU@Na3E^j&UB*JGEG#eRoT$vs8#h#mNM3BDA549JNabVaM7vM6pZ89YxE*a68zZ%^RCx@GV362V6$jo*mA!X5%y7M9Ru*F" + local: + path: /config/db.sqlite3 +notifier: + disable_startup_check: false + smtp: + host: smtp.mail.yahoo.com + port: 587 + timeout: 5s + username: "pukekoxyz" + password: "pvefngmuhcxunzqs" + sender: pukekoxyz@yahoo.com + identifier: localhost + subject: "[Authelia] {authelia}" + startup_check_address: test@authelia.com + disable_require_tls: false + disable_html_emails: false +identity_providers: + oidc: + clients: + - id: portainer + description: Portainer CE + secret: '8zDD%J3Z66A4uL%!N*G@@Uo5b6z2JbgQ3fxCr39o%LXE%Yb@6SAegGGU#!v*o3Z5u$2WJ#YC6TwEb723rZ$bbtmNJ#35Nsq7E!i9v$jU223$C@!Z&Nkwa&^Yg#DmDxk5' + redirect_uris: + - https://portain.pukeko.xyz/ + - id: gitea + description: Gitea + secret: '3s4as%cU$cKH2&MiXwzC#h8GJCY2eoS%#7&*9qC&H$ujv%qD8P6rWvrtbM8$f2#zM^phWUAz%2Bk7gCGJf#nA&i3BKvwG79&5hdp&mgddhdSFt&3BpX%a2Sv*Z#mK^J3' + redirect_uris: + - https://git.pukeko.xyz/user/oauth2/Authelia/callback + - id: wekan + description: Wekan + secret: '6BekdjG2Rs25MGg!NU#VEbScrQDriT2z6#wDgRK2KS4fsq5bB8hA@z8RSqs5y&pm%f94*xTw2@4&3Qv2Vg2%hv6Vq9&GNLcJfGdUxb&KM!Y@@My&ujqG3%j^Xdqs8bF^' + redirect_uris: + - https://tasks.pukeko.xyz/_oauth/oidc + - id: wikijs + description: WikiJS + secret: 'mT#!fwRZ3$pE5g2rG4CCNKLkg4zg7&3L92e9LGemfYMbr92gPos&Js*4DU#&^*EUJ#PrP*y#W$W7^i2#zqJPhiK$3$z9uDNXYA$h9Urcuo8!Ggcq^#C6dow^s*VxV&WU' + redirect_uris: + - https://wiki.pukeko.xyz/login/2075d75c-0a5f-4949-bc42-2114036b97b3/callback + scopes: + - openid + - email + - profile + - groups + grant_types: + - refresh_token + - authorization_code + response_types: + - code + response_modes: + - form_post + - query + - fragment + - id: grafana + description: Grafana + secret: '8Jx#U^%NXEvD#jc@A35wH!6PT8^DYo7pXftCKe3P%C%*xN9FQn26ec^kTxkuhA*9fZx@7*P65Y*L2Ty#Z*7n*f3#^$R!8TSuQ3THW*t#seL#iE7MatYEowb$GvU!8Y!5' + redirect_uris: + - https://flight.pukeko.xyz/ diff --git a/authelia/configuration_default.yml b/authelia/configuration_default.yml new file mode 100644 index 0000000..b349511 --- /dev/null +++ b/authelia/configuration_default.yml @@ -0,0 +1,676 @@ +# yamllint disable rule:comments-indentation +--- +############################################################################### +# Authelia Configuration # +############################################################################### + +## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to +## the system certificates store. +## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem. +# certificates_directory: /config/certificates + +## The theme to display: light, dark, grey, auto. +theme: light + +## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be +## set using a secret: https://www.authelia.com/docs/configuration/secrets.html +jwt_secret: a_very_important_secret + +## Default redirection URL +## +## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end +## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use +## in such a case. +## +## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication. +default_redirection_url: https://home.example.com/ + +## +## Server Configuration +## +server: + + ## The address to listen on. + host: 0.0.0.0 + + ## The port to listen on. + port: 9091 + + ## Set the single level path Authelia listens on. + ## Must be alphanumeric chars and should not contain any slashes. + path: "" + + ## Buffers usually should be configured to be the same value. + ## Explanation at https://www.authelia.com/docs/configuration/server.html + ## Read buffer size adjusts the server's max incoming request size in bytes. + ## Write buffer size does the same for outgoing responses. + read_buffer_size: 4096 + write_buffer_size: 4096 + + ## Enables the pprof endpoint. + enable_pprof: false + + ## Enables the expvars endpoint. + enable_expvars: false + + ## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0. + ## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist. + disable_healthcheck: false + + ## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour. + tls: + ## The path to the DER base64/PEM format private key. + key: "" + + ## The path to the DER base64/PEM format public certificate. + certificate: "" + +## +## Log Configuration +## +log: + ## Level of verbosity for logs: info, debug, trace. + level: debug + + ## Format the logs are written as: json, text. + # format: json + + ## File path where the logs will be written. If not set logs are written to stdout. + # file_path: /config/authelia.log + + ## Whether to also log to stdout when a log_file_path is defined. + # keep_stdout: false + +## +## TOTP Configuration +## +## Parameters used for TOTP generation. +totp: + ## The issuer name displayed in the Authenticator application of your choice + ## See: https://github.com/google/google-authenticator/wiki/Key-Uri-Format for more info on issuer names + issuer: authelia.com + ## The period in seconds a one-time password is current for. Changing this will require all users to register + ## their TOTP applications again. Warning: before changing period read the docs link below. + period: 30 + ## The skew controls number of one-time passwords either side of the current one that are valid. + ## Warning: before changing skew read the docs link below. + skew: 1 + ## See: https://www.authelia.com/docs/configuration/one-time-password.html#period-and-skew to read the documentation. + +## +## Duo Push API Configuration +## +## Parameters used to contact the Duo API. Those are generated when you protect an application of type +## "Partner Auth API" in the management panel. +duo_api: + hostname: api-123456789.example.com + integration_key: ABCDEF + ## Secret can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html + secret_key: 1234567890abcdefghifjkl + +## +## Authentication Backend Provider Configuration +## +## Used for verifying user passwords and retrieve information such as email address and groups users belong to. +## +## The available providers are: `file`, `ldap`. You must use only one of these providers. +authentication_backend: + ## Disable both the HTML element and the API for reset password functionality. + disable_reset_password: false + + ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation. + ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will + ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP. + ## To force update on every request you can set this to '0' or 'always', this will increase processor demand. + ## See the below documentation for more information. + ## Duration Notation docs: https://www.authelia.com/docs/configuration/index.html#duration-notation-format + ## Refresh Interval docs: https://www.authelia.com/docs/configuration/authentication/ldap.html#refresh-interval + refresh_interval: 5m + + ## + ## LDAP (Authentication Provider) + ## + ## This is the recommended Authentication Provider in production + ## because it allows Authelia to offload the stateful operations + ## onto the LDAP service. + ldap: + ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password. + ## Acceptable options are as follows: + ## - 'activedirectory' - For Microsoft Active Directory. + ## - 'custom' - For custom specifications of attributes and filters. + ## This currently defaults to 'custom' to maintain existing behaviour. + ## + ## Depending on the option here certain other values in this section have a default value, notably all of the + ## attribute mappings have a default value that this config overrides, you can read more about these default values + ## at https://www.authelia.com/docs/configuration/authentication/ldap.html#defaults + implementation: custom + + ## The url to the ldap server. Format: ://
[:]. + ## Scheme can be ldap or ldaps in the format (port optional). + url: ldap://127.0.0.1 + + ## The dial timeout for LDAP. + timeout: 5s + + ## Use StartTLS with the LDAP connection. + start_tls: false + + tls: + ## Server Name for certificate validation (in case it's not set correctly in the URL). + # server_name: ldap.example.com + + ## Skip verifying the server certificate (to allow a self-signed certificate). + ## In preference to setting this we strongly recommend you add the public portion of the certificate to the + ## certificates directory which is defined by the `certificates_directory` option at the top of the config. + skip_verify: false + + ## Minimum TLS version for either Secure LDAP or LDAP StartTLS. + minimum_version: TLS1.2 + + ## The distinguished name of the container searched for objects in the directory information tree. + ## See also: additional_users_dn, additional_groups_dn. + base_dn: dc=example,dc=com + + ## The attribute holding the username of the user. This attribute is used to populate the username in the session + ## information. It was introduced due to #561 to handle case insensitive search queries. For you information, + ## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this + ## attribute holds the unique identifiers for the users binding the user and the configuration stored in database. + ## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user + ## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also + ## be used but we don't recommend using them, we instead advise to use the attributes mentioned above + ## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt. + # username_attribute: uid + + ## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users. + ## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users. + additional_users_dn: ou=users + + ## The users filter used in search queries to find the user profile based on input filled in login form. + ## Various placeholders are available in the user filter which you can read about in the documentation which can + ## be found at: https://www.authelia.com/docs/configuration/authentication/ldap.html#users-filter-replacements + ## + ## Recommended settings are as follows: + ## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) + ## - OpenLDAP: + ## - (&({username_attribute}={input})(objectClass=person)) + ## - (&({username_attribute}={input})(objectClass=inetOrgPerson)) + ## + ## To allow sign in both with username and email, one can use a filter like + ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person)) + users_filter: (&({username_attribute}={input})(objectClass=person)) + + ## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups. + ## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups. + additional_groups_dn: ou=groups + + ## The groups filter used in search queries to find the groups based on relevant authenticated user. + ## Various placeholders are available in the groups filter which you can read about in the documentation which can + ## be found at: https://www.authelia.com/docs/configuration/authentication/ldap.html#groups-filter-replacements + ## + ## If your groups use the `groupOfUniqueNames` structure use this instead: + ## (&(uniqueMember={dn})(objectClass=groupOfUniqueNames)) + groups_filter: (&(member={dn})(objectClass=groupOfNames)) + + ## The attribute holding the name of the group. + # group_name_attribute: cn + + ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the + ## first one returned by the LDAP server is used. + # mail_attribute: mail + + ## The attribute holding the display name of the user. This will be used to greet an authenticated user. + # display_name_attribute: displayName + + ## The username and password of the admin user. + user: cn=admin,dc=example,dc=com + ## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html + password: password + + ## + ## File (Authentication Provider) + ## + ## With this backend, the users database is stored in a file which is updated when users reset their passwords. + ## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia + ## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security + ## implications it is highly recommended you leave the default values. Before considering changing these settings + ## please read the docs page below: + ## https://www.authelia.com/docs/configuration/authentication/file.html#password-hash-algorithm-tuning + ## + ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html + ## + # file: + # path: /config/users_database.yml + # password: + # algorithm: argon2id + # iterations: 1 + # key_length: 32 + # salt_length: 16 + # memory: 1024 + # parallelism: 8 + +## +## Access Control Configuration +## +## Access control is a list of rules defining the authorizations applied for one resource to users or group of users. +## +## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed +## to anyone. Otherwise restrictions follow the rules defined. +## +## Note: One can use the wildcard * to match any subdomain. +## It must stand at the beginning of the pattern. (example: *.mydomain.com) +## +## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct. +## +## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'. +## +## - 'domain' defines which domain or set of domains the rule applies to. +## +## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not +## provided. If provided, the parameter represents either a user or a group. It should be of the form +## 'user:' or 'group:'. +## +## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'. +## +## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter +## is optional and matches any resource if not provided. +## +## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies. +access_control: + ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any + ## resource if there is no policy to be applied to the user. + default_policy: deny + + networks: + - name: internal + networks: + - 10.10.0.0/16 + - 192.168.2.0/24 + - name: VPN + networks: 10.9.0.0/16 + + rules: + ## Rules applied to everyone + - domain: public.example.com + policy: bypass + + - domain: secure.example.com + policy: one_factor + ## Network based rule, if not provided any network matches. + networks: + - internal + - VPN + - 192.168.1.0/24 + - 10.0.0.1 + + - domain: + - secure.example.com + - private.example.com + policy: two_factor + + - domain: singlefactor.example.com + policy: one_factor + + ## Rules applied to 'admins' group + - domain: "mx2.mail.example.com" + subject: "group:admins" + policy: deny + + - domain: "*.example.com" + subject: + - "group:admins" + - "group:moderators" + policy: two_factor + + ## Rules applied to 'dev' group + - domain: dev.example.com + resources: + - "^/groups/dev/.*$" + subject: "group:dev" + policy: two_factor + + ## Rules applied to user 'john' + - domain: dev.example.com + resources: + - "^/users/john/.*$" + subject: "user:john" + policy: two_factor + + ## Rules applied to user 'harry' + - domain: dev.example.com + resources: + - "^/users/harry/.*$" + subject: "user:harry" + policy: two_factor + + ## Rules applied to user 'bob' + - domain: "*.mail.example.com" + subject: "user:bob" + policy: two_factor + - domain: "dev.example.com" + resources: + - "^/users/bob/.*$" + subject: "user:bob" + policy: two_factor + +## +## Session Provider Configuration +## +## The session cookies identify the user once logged in. +## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined. +session: + ## The name of the session cookie. + name: authelia_session + + ## The domain to protect. + ## Note: the authenticator must also be in that domain. + ## If empty, the cookie is restricted to the subdomain of the issuer. + domain: example.com + + ## Sets the Cookie SameSite value. Possible options are none, lax, or strict. + ## Please read https://www.authelia.com/docs/configuration/session.html#same_site + same_site: lax + + ## The secret to encrypt the session data. This is only used with Redis / Redis Sentinel. + ## Secret can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html + secret: insecure_session_secret + + ## The value for expiration, inactivity, and remember_me_duration are in seconds or the duration notation format. + ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format + ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure + ## because a stolen cookie will last longer giving attackers more time to spy or attack. + + ## The time before the cookie expires and the session is destroyed if remember me IS NOT selected. + expiration: 1h + + ## The inactivity time before the session is reset. If expiration is set to 1h, and this is set to 5m, if the user + ## does not select the remember me option their session will get destroyed after 1h, or after 5m since the last time + ## Authelia detected user activity. + inactivity: 5m + + ## The time before the cookie expires and the session is destroyed if remember me IS selected. + ## Value of 0 disables remember me. + remember_me_duration: 1M + + ## + ## Redis Provider + ## + ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html + ## + redis: + host: 127.0.0.1 + port: 6379 + ## Use a unix socket instead + # host: /var/run/redis/redis.sock + + ## Username used for redis authentication. This is optional and a new feature in redis 6.0. + # username: authelia + + ## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html + password: authelia + + ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc). + database_index: 0 + + ## The maximum number of concurrent active connections to Redis. + maximum_active_connections: 8 + + ## The target number of idle connections to have open ready for work. Useful when opening connections is slow. + minimum_idle_connections: 0 + + ## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s). + # tls: + ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option). + # server_name: myredis.example.com + + ## Skip verifying the server certificate (to allow a self-signed certificate). + ## In preference to setting this we strongly recommend you add the public portion of the certificate to the + ## certificates directory which is defined by the `certificates_directory` option at the top of the config. + # skip_verify: false + + ## Minimum TLS version for the connection. + # minimum_version: TLS1.2 + + ## The Redis HA configuration options. + ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name). + # high_availability: + ## Sentinel Name / Master Name. + # sentinel_name: mysentinel + + ## Specific password for Redis Sentinel. The node username and password is configured above. + # sentinel_password: sentinel_specific_pass + + ## The additional nodes to pre-seed the redis provider with (for sentinel). + ## If the host in the above section is defined, it will be combined with this list to connect to sentinel. + ## For high availability to be used you must have either defined; the host above or at least one node below. + # nodes: + # - host: sentinel-node1 + # port: 6379 + # - host: sentinel-node2 + # port: 6379 + + ## Choose the host with the lowest latency. + # route_by_latency: false + + ## Choose the host randomly. + # route_randomly: false + +## +## Regulation Configuration +## +## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are made +## in a short period of time. +regulation: + ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation. + max_retries: 3 + + ## The time range during which the user can attempt login before being banned. The user is banned if the + ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation. + ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format + find_time: 2m + + ## The length of time before a banned user can login again. Ban Time accepts duration notation. + ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format + ban_time: 5m + +## +## Storage Provider Configuration +## +## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers. +storage: + ## + ## Local (Storage Provider) + ## + ## This stores the data in a SQLite3 Database. + ## This is only recommended for lightweight non-stateful installations. + ## + ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html + ## + # local: + # path: /config/db.sqlite3 + + ## + ## MySQL / MariaDB (Storage Provider) + ## + mysql: + host: 127.0.0.1 + port: 3306 + database: authelia + username: authelia + ## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html + password: mypassword + timeout: 5s + + ## + ## PostgreSQL (Storage Provider) + ## + # postgres: + # host: 127.0.0.1 + # port: 5432 + # database: authelia + # username: authelia + # ## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html + # password: mypassword + # timeout: 5s + # sslmode: disable + +## +## Notification Provider +## +## Notifications are sent to users when they require a password reset, a U2F registration or a TOTP registration. +## The available providers are: filesystem, smtp. You must use only one of these providers. +notifier: + ## You can disable the notifier startup check by setting this to true. + disable_startup_check: false + + ## + ## File System (Notification Provider) + ## + ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html + ## + # filesystem: + # filename: /config/notification.txt + + ## + ## SMTP (Notification Provider) + ## + ## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate. + ## [Security] By default Authelia will: + ## - force all SMTP connections over TLS including unauthenticated connections + ## - use the disable_require_tls boolean value to disable this requirement + ## (only works for unauthenticated connections) + ## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates + ## (configure in tls section) + smtp: + ## The SMTP host to connect to. + host: 127.0.0.1 + + ## The port to connect to the SMTP host on. + port: 1025 + + ## The connection timeout. + timeout: 5s + + ## The username used for SMTP authentication. + username: test + + ## The password used for SMTP authentication. + ## Can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html + password: password + + ## The address to send the email FROM. + sender: admin@example.com + + ## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost. + identifier: localhost + + ## Subject configuration of the emails sent. {title} is replaced by the text from the notifier. + subject: "[Authelia] {title}" + + ## This address is used during the startup check to verify the email configuration is correct. + ## It's not important what it is except if your email server only allows local delivery. + startup_check_address: test@authelia.com + + ## By default we require some form of TLS. This disables this check though is not advised. + disable_require_tls: false + + ## Disables sending HTML formatted emails. + disable_html_emails: false + + tls: + ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option). + # server_name: smtp.example.com + + ## Skip verifying the server certificate (to allow a self-signed certificate). + ## In preference to setting this we strongly recommend you add the public portion of the certificate to the + ## certificates directory which is defined by the `certificates_directory` option at the top of the config. + skip_verify: false + + ## Minimum TLS version for either StartTLS or SMTPS. + minimum_version: TLS1.2 + +## +## Identity Providers +## +# identity_providers: + + ## + ## OpenID Connect (Identity Provider) + ## + ## It's recommended you read the documentation before configuration of this section: + ## https://www.authelia.com/docs/configuration/identity-providers/oidc.html + # oidc: + ## The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens). + ## HMAC Secret can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html + # hmac_secret: this_is_a_secret_abc123abc123abc + + ## The issuer_private_key is used to sign the JWT forged by OpenID Connect. + ## Issuer Private Key can also be set using a secret: https://docs.authelia.com/configuration/secrets.html + # issuer_private_key: | + # --- KEY START + # --- KEY END + + ## The lifespans configure the expiration for these token types. + # access_token_lifespan: 1h + # authorize_code_lifespan: 1m + # id_token_lifespan: 1h + # refresh_token_lifespan: 90m + + ## Enables additional debug messages. + # enable_client_debug_messages: false + + ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for + ## security reasons. + # minimum_parameter_entropy: 8 + + ## Clients is a list of known clients and their configuration. + # clients: + # - + ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration. + # id: myapp + + ## The description to show to users when they end up on the consent screen. Defaults to the ID above. + # description: My Application + + ## The client secret is a shared secret between Authelia and the consumer of this client. + # secret: this_is_a_secret + + ## Sets the client to public. This should typically not be set, please see the documentation for usage. + # public: false + + ## The policy to require for this client; one_factor or two_factor. + # authorization_policy: two_factor + + ## Audience this client is allowed to request. + # audience: [] + + ## Scopes this client is allowed to request. + # scopes: + # - openid + # - groups + # - email + # - profile + + ## Redirect URI's specifies a list of valid case-sensitive callbacks for this client. + # redirect_uris: + # - https://oidc.example.com:8080/oauth2/callback + + ## Grant Types configures which grants this client can obtain. + ## It's not recommended to define this unless you know what you're doing. + # grant_types: + # - refresh_token + # - authorization_code + + ## Response Types configures which responses this client can be sent. + ## It's not recommended to define this unless you know what you're doing. + # response_types: + # - code + + ## Response Modes configures which response modes this client supports. + # response_modes: + # - form_post + # - query + # - fragment + + ## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256. + # userinfo_signing_algorithm: none +... diff --git a/authelia/openid.yml b/authelia/openid.yml new file mode 100644 index 0000000..c7b3410 --- /dev/null +++ b/authelia/openid.yml @@ -0,0 +1,62 @@ +identity_providers: + oidc: + hmac_secret: &R#&e^xYwijUmr5d$5$Wa^Ki@g3%@6Ehykih#u@qUtFK9%rHy9H6soBr^86^4p!H*q!u4D7Pq6j&pXUz2jVrF992mejt&5s3mvG^q8Ls7UZCyo8rd&$BVTx@y#s%yf5U #Bitwarden + issuer_private_key: | + --- KEY START +MIIEogIBAAKCAQEAnkzvqdtgIl71Bd7fIarSCDLI/dhTyl8G+xdmoH9wH3dGqbbn +m0SV280wVRVEkGEJIohqXY+DMNrLiqvPvCTxjYAyqinjHqQFsEgtDsQ7rqpoi2U/ +3HvAdF+2obQvFz5w5urkXKyLTfkFU7+tvjiJhCYvAoUZA/Bx0LcK8Hh0OhuwN0L9 +9Rq7VK0HlC5TlP1nRCUZYEDNLR0mKcKqCuAST8m5FucF/ZQaanF9anphgRavbUfp +EyKvnbPGZLPf4IjbRQbxfwyNqRcDjNaP4ytjAAY4+F6aSdZePos08IzC8qemgqEm +/iKVn9XUcgwZ/EjITLoEbzoFUJV91H0CiyfuBwIDAQABAoIBAHWMGddekGdVbcrb +MYOVjfsKgxeEQMwgflWLjeiWWRL0hiNWL2urpUAfgMldTpmLhLYA6ELrY3auscAa +Ttqd8ESrsnOLQRyqnZLGNbcmXk8YOSNxntdBiaqgvEQdQW6YLkw6ljJ+6b6PsLX8 +uq5q2yqnE/diEC5NqKZclaH1QBE4/R+iDRXuAgrHvArv9uL0pD+lrms7dEfHcewn +vKzv3+AKv0maGQ+aZyh3i0xPvmMqiT8ddvRmSqq60aCtCrVezJ8rd1D7IxLQ3t/T +uR0jwCf8kPS8KNcPgGb5RuJ4Up+8IywU8PSiReIugD+wyvVxWLTcMCEXd7qITofR +pWF447ECgYEAwpSRc26hEo9JX0yBAP5dqBKdW8BJzxjCjWJ5N1KmZFppuymyJ7I0 +2aGUM8ffm8uiecJpMmnzUuF9v2/SjcsDghcslSn9qczajBI4x1Xic1272HjstrfO +9HSoGf1M1Rn7tHFFoM/ydELMkTacxvZa6i3d+UmZ3OBDheGTj1c4lK8CgYEA0ES1 +ln+JRGW+sMBEhP6VZgGXkwgLJzMCDJQ1riNfYy/UxFldXB2Tz7+pAVYUndRsMh+u +DHcBFe9ENnYMDfba434NqyhmWEeXgtJ1ICu1nunltTtM458zB84OGt9j8mmCTedW +HxfyE0YGYgVF47n7fc+h5QB/3BapK7diOUYtQikCgYBcQZbJFT33j8ppDdvofbIo +O1MyqnQUZhfwcy0n5t8Pm7Kf1AAtRBg8y5h6CJ1jv+Q0ONIp3gRJWrKFbt507jmm +l5hCzRsBRCim2wjisjzhGCM1WvhZFcNhMmJ1mByyuVQXVNF/krjRGM7nVu50g1/N +wpuJU7VI/WfmdXLCNseT7wKBgCvxk28B0fDAlw+sQcjd/p/bTiQT2maW+KO20ezA +Qewnt3kGchBxnTKEeiByDT+QBpQ84vh2U6BRL89d8QUxRNYjTrcCezW9RVaxGU2E +a3nwWCt5K6wLdzT6YTeCUxBe+sN9QEqnPsiaSdZ8zlZSc6IEIWC0TkYd8evrcaos +CHihAoGAFt+od36TPiYgczaoWJ2dlLz6xLnPn/nhrSICxJhdBtCywT1uxH0THaiA +NiAwc5R8fJUPBuIdd0ur/mgAV8VTcXsY/mvihrHnqCKinQKdCt1yukpFhvs68AyP +O+iDoe3R22OcCFg+wuEMGDPspkNtuKV0j0UvqtaDuWqWZNOyYCU= + --- KEY END + access_token_lifespan: 1h + authorize_code_lifespan: 1m + id_token_lifespan: 1h + refresh_token_lifespan: 90m + enable_client_debug_messages: false + clients: + - id: portainer + description: Container management interface + secret: 8zDD%J3Z66A4uL%!N*G@@Uo5b6z2JbgQ3fxCr39o%LXE%Yb@6SAegGGU#!v*o3Z5u$2WJ#YC6TwEb723rZ$bbtmNJ#35Nsq7E!i9v$jU223$C@!Z&Nkwa&^Yg#DmDxk5 #Bitwarden + public: false + authorization_policy: two_factor + audience: [] + scopes: + - openid + - groups + - email + - profile + redirect_uris: + - https://oidc.example.com:8080/oauth2/callback + grant_types: + - refresh_token + - authorization_code + response_types: + - code + response_modes: + - form_post + - query + - fragment + userinfo_signing_algorithm: none + + diff --git a/authelia/users_database.yml b/authelia/users_database.yml new file mode 100644 index 0000000..0760ee0 --- /dev/null +++ b/authelia/users_database.yml @@ -0,0 +1,38 @@ +users: + ishgamad: + password: $argon2id$v=19$m=65536,t=1,p=8$aDNUbCtTSEpJdkJnL1B5aQ$lSTiaRsWgPpTqYSGissf4umr0VQPPulynH9igqiMVFg + displayname: Omer Horovitz + email: ishgamad@gmail.com + groups: + - family + joe: + password: $argon2id$v=19$m=65536,t=1,p=8$aDNUbCtTSEpJdkJnL1B5aQ$lSTiaRsWgPpTqYSGissf4umr0VQPPulynH9igqiMVFg + displayname: Jospeh Horovitz + email: yhorovitz@gmail.com + groups: + - family + shmick: + password: $argon2id$v=19$m=524288,t=1,p=8$OXZDU0NqS3J1VVBhWkdGMg$yvlKAog0MTtP95VpXgeWFnyiX5uNGK23vDqmcP8lLAU + displayname: Shmickonon Shmickovski + email: matanhorovitz@protonmail.com + groups: + - admins + - dev + sigal: + password: $argon2id$v=19$m=65536,t=1,p=8$aDNUbCtTSEpJdkJnL1B5aQ$lSTiaRsWgPpTqYSGissf4umr0VQPPulynH9igqiMVFg + displayname: Sigal Horovitz + email: sigalh666@gmail.com + groups: + - family + tieke: + password: $argon2id$v=19$m=65536,t=1,p=8$Q1lhdTgzZU9KUGRYaElPRg$HsXPgSjC0gmpbXjrvg1kb6FJdrSZlO8dL2jxvXRY9vc + displayname: Guest User + email: "" + groups: + - guest + yuval: + password: $argon2id$v=19$m=65536,t=1,p=8$aDNUbCtTSEpJdkJnL1B5aQ$lSTiaRsWgPpTqYSGissf4umr0VQPPulynH9igqiMVFg + displayname: Yuval Horovitz + email: iamJUSTICEo3o@gmail.com + groups: + - family diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..e1f7572 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,154 @@ +version: "3.3" + +services: + + traefik: + image: "traefik:v2.6" + container_name: "traefik" + command: + - "--log.level=DEBUG" + - "--api.insecure=true" + - "--providers.docker=true" + - "--providers.docker.exposedbydefault=false" + - "--entrypoints.web.address=:80" + - "--entrypoints.websecure.address=:443" + - "--certificatesresolvers.pukekoresolver.acme.dnschallenge=true" + - "--certificatesresolvers.pukekoresolver.acme.dnschallenge.provider=cloudflare" + #- "--certificatesresolvers.pukekoresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory" + - "--certificatesresolvers.pukekoresolver.acme.email=matanhorovitz@protonmail.com" + - "--certificatesresolvers.pukekoresolver.acme.storage=/letsencrypt/acme.json" + - "--certificatesresolvers.pukekoresolver.acme.dnschallenge.resolvers=1.1.1.1:53" + ports: + - "80:80" + - "443:443" + - "8282:8080" + environment: + - CF_API_KEY=12fd3e74bd60d39d192ff0e51fa2f6af90402 + - CF_API_EMAIL=matanhorovitz@protonmail.com + - CF_DNS_API_TOKEN=0dFNYA8qtzVhVtGi4nEb7_aclTOdGthYm5Q7N05n + volumes: + - "./letsencrypt:/letsencrypt" + - "/var/run/docker.sock:/var/run/docker.sock:ro" + networks: + - traefik_network + - arr_network + - filebrowser_network + - gitea_network + - grocy_network + - vaultwarden_network + - vikunja_network + - freshrss_network + - jekyll_network + - jellyfin_network + - joplin_network + - photoprism_network + - podgrab_network + - portainer_network + - prometheus_network + - qbittorrent_network + - syncthing_network + - wikijs_network + - wireguard_network + restart: unless-stopped + labels: + - "traefik.enable=true" + - "traefik.http.routers.homer.entrypoints=websecure" + - "traefik.http.routers.domain.rule=Host(`pukeko.xyz`)" + - "traefik.http.routers.domain.service=noop@internal" + - "traefik.http.routers.domain.middlewares=pukeko-redirect" + - 'traefik.http.middlewares.pukeko-redirect.redirectregex.regex=^http://pukeko.xyz/(.*)' + - 'traefik.http.middlewares.pukeko-redirect.redirectregex.replacement=http://dash.pukeko.xyz/$${1}' + - "traefik.http.middlewares.pukeko-redirect.redirectregex.permanent=true" + homer: + image: b4bz/homer + container_name: homer + volumes: + - /Red-Vol/Media/Containers/homer/assets/:/www/assets + ports: + - 4957:8080 + environment: + - UID=1000 + - GID=1000 + restart: unless-stopped + labels: + - "traefik.enable=true" + - "traefik.http.routers.homer.entrypoints=websecure" + - "traefik.http.routers.homer.rule=Host(`dash.pukeko.xyz`)" + - "traefik.http.routers.homer.service=homer-traefik@docker" + - "traefik.http.routers.homer.tls.certresolver=pukekoresolver" + - "traefik.http.routers.homer.middlewares=authelia@docker" + networks: + - traefik_network + authelia: + image: authelia/authelia:latest + container_name: authelia + environment: + - TZ=Asia/Jerusalem + - AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE=/run/secrets/private_key + volumes: + - ./authelia:/config + restart: unless-stopped + secrets: + - hmac + - private_key + labels: + - 'traefik.enable=true' + - 'traefik.http.routers.authelia.rule=Host(`auth.pukeko.xyz`)' + - 'traefik.http.routers.authelia.entrypoints=websecure' + - 'traefik.http.routers.authelia.tls=true' + - 'traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.pukeko.xyz/' + - 'traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true' + - 'traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User, Remote-Groups, Remote-Name, Remote-Email' + - 'traefik.http.middlewares.authelia-basic.forwardauth.address=http://authelia:9091/api/verify?auth=basic' + - 'traefik.http.middlewares.authelia-basic.forwardauth.trustForwardHeader=true' + - 'traefik.http.middlewares.authelia-basic.forwardauth.authResponseHeaders=Remote-User, Remote-Groups, Remote-Name, Remote-Email' + expose: + - 9091 + networks: + - traefik_network +secrets: + hmac: + file: ./authelia/secrets/hmac + private_key: + file: ./authelia/secrets/issuer_private_key +networks: + traefik_network: + driver: bridge + traefik_internal: + driver: bridge + arr_network: + external: true + filebrowser_network: + external: true + freshrss_network: + external: true + gitea_network: + external: true + grocy_network: + external: true + jekyll_network: + external: true + jellyfin_network: + external: true + joplin_network: + external: true + photoprism_network: + external: true + podgrab_network: + external: true + portainer_network: + external: true + prometheus_network: + external: true + vaultwarden_network: + external: true + vikunja_network: + external: true + wikijs_network: + external: true + wireguard_network: + external: true + qbittorrent_network: + external: true + syncthing_network: + external: true