Pruned services; added Grafana auth

Add Redis and WikiJS_Study; remove DNS
SELinux purges; DNS updates; remember Authelian consent
2023-11-17 16:51:09 +02:00 · 2022-12-16 10:53:03 +02:00 · 2022-10-16 13:05:44 +03:00 · 2022-09-16 19:26:38 +03:00 · 2022-09-16 19:24:05 +03:00
2 changed files with 147 additions and 68 deletions
--- a/authelia/configuration.yml
+++ b/authelia/configuration.yml
@@ -32,14 +32,16 @@ access_control:
    - domain:
      - "*.pukeko.xyz"
      networks:
+        #Docker main subnet
+        - 150.200.0.1/24
+        #Docker subnet A
+        - 150.201.0.1/24
+        #Docker subnet B
+        - 150.202.0.1/24
        # Home
        - 192.168.0.0/24
-        # traefik_internal
-        - 172.19.0.0/16
        # Wireguard
        - 10.8.0.0/16 
-        # Arr, for some reason
-        - 192.168.240.0/16 
      policy: bypass
 #   Allow access to container's /api address
    - domain:
@@ -72,17 +74,27 @@ access_control:
    - domain: "news.pukeko.xyz"
      policy: one_factor
      subject: "group:family"
+    - domain: "tasks.pukeko.xyz"
+      policy: one_factor
+      subject: "group:family"
 #   Allow access to shares within Filebrowser
    - domain: "cloud.pukeko.xyz"
      policy: bypass
      resources:
 #     Match only /share/ url's - Filebrowser's shares
-      - "^*/share/.*"
+      - '^/share([/?].*)?$'
    - domain:
      - "git.pukeko.xyz"
      policy: bypass
      resources:
      - "^/public([/?].*)?$"
+      - ".*/shmick/study.git"
+    - domain:
+      - "photos.pukeko.xyz"
+      policy: bypass
+      resources:
+      - "^.*/s/.*$"
+      - '^/s([/?].*)?$'
    - domain:
      - "*.pukeko.xyz"
      policy: two_factor 
@@ -94,6 +106,9 @@ session:
  inactivity: 5m
  remember_me_duration: 1M
  domain: "pukeko.xyz"
+  redis:
+    host: authelia_redis
+    port: 6379
 regulation:
  max_retries: 3
  find_time: 2m
@@ -105,12 +120,12 @@ storage:
 notifier:
  disable_startup_check: false
  smtp:
-    host: smtp.mail.yahoo.com
+    host: smtp.zoho.com
    port: 587
    timeout: 5s
-    username: "pukekoxyz"
-    password: "pvefngmuhcxunzqs"
-    sender: pukekoxyz@yahoo.com
+    username: "matan@pukeko.xyz"
+    password: "DjazsDaEzrU9"
+    sender: matan@pukeko.xyz
    identifier: localhost
    subject: "[Authelia] {authelia}"
    startup_check_address: test@authelia.com
@@ -118,45 +133,112 @@ notifier:
    disable_html_emails: false
 identity_providers:
  oidc:
+    issuer_private_key: |
+      -----BEGIN RSA PRIVATE KEY-----
+      MIIEogIBAAKCAQEAnkzvqdtgIl71Bd7fIarSCDLI/dhTyl8G+xdmoH9wH3dGqbbn
+      m0SV280wVRVEkGEJIohqXY+DMNrLiqvPvCTxjYAyqinjHqQFsEgtDsQ7rqpoi2U/
+      3HvAdF+2obQvFz5w5urkXKyLTfkFU7+tvjiJhCYvAoUZA/Bx0LcK8Hh0OhuwN0L9
+      9Rq7VK0HlC5TlP1nRCUZYEDNLR0mKcKqCuAST8m5FucF/ZQaanF9anphgRavbUfp
+      EyKvnbPGZLPf4IjbRQbxfwyNqRcDjNaP4ytjAAY4+F6aSdZePos08IzC8qemgqEm
+      /iKVn9XUcgwZ/EjITLoEbzoFUJV91H0CiyfuBwIDAQABAoIBAHWMGddekGdVbcrb
+      MYOVjfsKgxeEQMwgflWLjeiWWRL0hiNWL2urpUAfgMldTpmLhLYA6ELrY3auscAa
+      Ttqd8ESrsnOLQRyqnZLGNbcmXk8YOSNxntdBiaqgvEQdQW6YLkw6ljJ+6b6PsLX8
+      uq5q2yqnE/diEC5NqKZclaH1QBE4/R+iDRXuAgrHvArv9uL0pD+lrms7dEfHcewn
+      vKzv3+AKv0maGQ+aZyh3i0xPvmMqiT8ddvRmSqq60aCtCrVezJ8rd1D7IxLQ3t/T
+      uR0jwCf8kPS8KNcPgGb5RuJ4Up+8IywU8PSiReIugD+wyvVxWLTcMCEXd7qITofR
+      pWF447ECgYEAwpSRc26hEo9JX0yBAP5dqBKdW8BJzxjCjWJ5N1KmZFppuymyJ7I0
+      2aGUM8ffm8uiecJpMmnzUuF9v2/SjcsDghcslSn9qczajBI4x1Xic1272HjstrfO
+      9HSoGf1M1Rn7tHFFoM/ydELMkTacxvZa6i3d+UmZ3OBDheGTj1c4lK8CgYEA0ES1
+      ln+JRGW+sMBEhP6VZgGXkwgLJzMCDJQ1riNfYy/UxFldXB2Tz7+pAVYUndRsMh+u
+      DHcBFe9ENnYMDfba434NqyhmWEeXgtJ1ICu1nunltTtM458zB84OGt9j8mmCTedW
+      HxfyE0YGYgVF47n7fc+h5QB/3BapK7diOUYtQikCgYBcQZbJFT33j8ppDdvofbIo
+      O1MyqnQUZhfwcy0n5t8Pm7Kf1AAtRBg8y5h6CJ1jv+Q0ONIp3gRJWrKFbt507jmm
+      l5hCzRsBRCim2wjisjzhGCM1WvhZFcNhMmJ1mByyuVQXVNF/krjRGM7nVu50g1/N
+      wpuJU7VI/WfmdXLCNseT7wKBgCvxk28B0fDAlw+sQcjd/p/bTiQT2maW+KO20ezA
+      Qewnt3kGchBxnTKEeiByDT+QBpQ84vh2U6BRL89d8QUxRNYjTrcCezW9RVaxGU2E
+      a3nwWCt5K6wLdzT6YTeCUxBe+sN9QEqnPsiaSdZ8zlZSc6IEIWC0TkYd8evrcaos
+      CHihAoGAFt+od36TPiYgczaoWJ2dlLz6xLnPn/nhrSICxJhdBtCywT1uxH0THaiA
+      NiAwc5R8fJUPBuIdd0ur/mgAV8VTcXsY/mvihrHnqCKinQKdCt1yukpFhvs68AyP
+      O+iDoe3R22OcCFg+wuEMGDPspkNtuKV0j0UvqtaDuWqWZNOyYCU=
+      -----END RSA PRIVATE KEY-----
+
    clients:
      - id: portainer
        description: Portainer CE
        secret: '8zDD%J3Z66A4uL%!N*G@@Uo5b6z2JbgQ3fxCr39o%LXE%Yb@6SAegGGU#!v*o3Z5u$2WJ#YC6TwEb723rZ$bbtmNJ#35Nsq7E!i9v$jU223$C@!Z&Nkwa&^Yg#DmDxk5'
+        pre_configured_consent_duration: 100y
        redirect_uris:
          - https://portain.pukeko.xyz/
+
      - id: gitea
        description: Gitea
        secret: '3s4as%cU$cKH2&MiXwzC#h8GJCY2eoS%#7&*9qC&H$ujv%qD8P6rWvrtbM8$f2#zM^phWUAz%2Bk7gCGJf#nA&i3BKvwG79&5hdp&mgddhdSFt&3BpX%a2Sv*Z#mK^J3'
+        pre_configured_consent_duration: 100y
        redirect_uris:
          - https://git.pukeko.xyz/user/oauth2/Authelia/callback
-      - id: wekan
-        description: Wekan
-        secret: '6BekdjG2Rs25MGg!NU#VEbScrQDriT2z6#wDgRK2KS4fsq5bB8hA@z8RSqs5y&pm%f94*xTw2@4&3Qv2Vg2%hv6Vq9&GNLcJfGdUxb&KM!Y@@My&ujqG3%j^Xdqs8bF^'
-        redirect_uris:
-          - https://tasks.pukeko.xyz/_oauth/oidc
+
      - id: wikijs
        description: WikiJS
        secret: 'mT#!fwRZ3$pE5g2rG4CCNKLkg4zg7&3L92e9LGemfYMbr92gPos&Js*4DU#&^*EUJ#PrP*y#W$W7^i2#zqJPhiK$3$z9uDNXYA$h9Urcuo8!Ggcq^#C6dow^s*VxV&WU'
        public: false
        authorization_policy: two_factor
-        audience: []
+        pre_configured_consent_duration: 100y
        redirect_uris:
          - https://wiki.pukeko.xyz/login/a8755bfb-8a4e-49b7-b31b-43ac5638367a/callback
+
+      - id: wikijs_study
+        description: WikiJS-Study
+        secret: 'jPdRbutexLB9aTanEthKiTXVtzcYsM3N9DmwbBKXdSikMRYWKLAMffETp9ads6cTAgkBMNu9Cp8aujFdXcEkpEeq5cMHc3KoiS64HHCK9CrVLH4PHdDFxLquGbd2h3Sz'
+        public: false
+        authorization_policy: two_factor
+        pre_configured_consent_duration: 100y
+        redirect_uris:
+          - https://logos.pukeko.xyz/login/2a01989c-e0f5-431a-95f1-c3e0383f67ce/callback
+
+      - id: grafana
+        description: Grafana
+        secret: 'P6x3vpNvZcLCZnmwts7E3sEYmtnLVx2cmjPafyFjNRHRsJmcBajaGYzdYjEB4iZemmCTK5H5QAxqg8fSmjMkydKkYcynDgbCciR3tdz3XbcKgRX3LpDVFHqejEKLPz7n'
+        public: false
+        authorization_policy: two_factor
+        pre_configured_consent_duration: 100y
+        redirect_uris:
+          - https://flight.pukeko.xyz/login/generic_oauth
+        scopes:
+          - openid
+          - profile
+          - groups
+          - email
        userinfo_signing_algorithm: none
+
+      - id: vikunja
+        description: Vikunja
+        secret: 'ryKVwXhfHeAQKJJHwejEpK66pAuTGvY2saZArKTFZPjWVs2fKNHDAwah8TbPP44LGKYPBYJxU5Ua5H4Su87DAY4ktpAz6UfmpB9XnXCPoACtBrwBgykjoC6cUzXJRc7t'
+        pre_configured_consent_duration: 100y
+        authorization_policy: one_factor
+        redirect_uris:
+          - https://tasks.pukeko.xyz/auth/openid/
+          - https://tasks.pukeko.xyz/auth/openid/authelia
+          - https://tasks.pukeko.xyz/api/oidc/authorization
        scopes:
          - openid
          - email
          - profile
          - groups
-        grant_types:
-          - refresh_token
-          - authorization_code
+
+      - id: docspell
+        description: Docspell
+        secret: 'tEf47Me$YsXG8K4%63$%!kbMqbgVnc*bAq2i4SPERay#T!&ajc35m&D%C#uRMiaSv@cRFxwMcqo%SwEq*49G9HufJ&d#^f*&MK9hzU6s&7C2^XmfGC8Up7YeegnH#VhP'
+        pre_configured_consent_duration: 100y
+        authorization_policy: one_factor
+        redirect_uris:
+          - https://docs.pukeko.xyz/api/v1/open/auth/openid/authelia/resume
+        scopes:
+          - openid
+          - email
+          - profile
+          - groups
+        userinfo_signing_algorithm: none
        response_types:
          - code
-        response_modes:
-          - form_post
-      - id: grafana
-        description: Grafana
-        secret: '8Jx#U^%NXEvD#jc@A35wH!6PT8^DYo7pXftCKe3P%C%*xN9FQn26ec^kTxkuhA*9fZx@7*P65Y*L2Ty#Z*7n*f3#^$R!8TSuQ3THW*t#seL#iE7MatYEowb$GvU!8Y!5'
-        redirect_uris:
-          - https://flight.pukeko.xyz/
+        grant_types:
+          - authorization_code
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,9 +1,6 @@
-version: "3.3"
-
 services:
-
  traefik:
-    image: "traefik:v2.6"
+    image: "traefik:v2.10.4"
    container_name: "traefik"
    privileged: true
    command:
@@ -12,18 +9,14 @@ services:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
-      - "--entrypoints.websecure.address=:443"
-      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
-      - "--certificatesresolvers.pukekoresolver.acme.dnschallenge=true"
-      - "--certificatesresolvers.pukekoresolver.acme.dnschallenge.provider=cloudflare"
-        #- "--certificatesresolvers.pukekoresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
-      - "--certificatesresolvers.pukekoresolver.acme.email=matanhorovitz@protonmail.com"
-      - "--certificatesresolvers.pukekoresolver.acme.storage=/letsencrypt/acme.json"
-      - "--certificatesresolvers.pukekoresolver.acme.dnschallenge.resolvers=1.1.1.1:53"
-# Proxy to local Cockpit server
-#      - "--providers.file=true"
-#      - "--providers.file.directory=./config/cockpit.yml"
-#      - "--providers.file.watch=true"
+      - "--entrypoints.pukekos.address=:443"
+      - "--entrypoints.web.http.redirections.entrypoint.to=pukekos"
+      - "--certificatesresolvers.takaheresolver.acme.dnschallenge=true"
+      - "--certificatesresolvers.takaheresolver.acme.dnschallenge.provider=cloudflare"
+        #      - "--certificatesresolvers.takaheresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
+      - "--certificatesresolvers.takaheresolver.acme.email=matanhorovitz@protonmail.com"
+      - "--certificatesresolvers.takaheresolver.acme.storage=/certs/acme.json"
+      - "--certificatesresolvers.takaheresolver.acme.dnschallenge.resolvers=1.1.1.1:53"
    ports:
      - "80:80"
      - "443:443"
@@ -33,46 +26,44 @@ services:
      - CF_API_EMAIL=matanhorovitz@protonmail.com
      - CF_DNS_API_TOKEN=0dFNYA8qtzVhVtGi4nEb7_aclTOdGthYm5Q7N05n
    volumes:
-      - "./letsencrypt:/letsencrypt:z"
-      - "/var/run/docker.sock:/var/run/docker.sock:z"
+      - "./certs:/certs"
+      - "/var/run/docker.sock:/var/run/docker.sock"
    networks:
      - network
      - internal
      - arr_network
      - filebrowser_network
      - gitea_network
-      - gitea_public_instance_network
-      - grocy_network
      - vaultwarden_network
      - vikunja_network
-      - freshrss_network
-      - jekyll_network
      - jellyfin_network
      - joplin_network
-      - paperless-ngx_network 
      - photoprism_network
-      - podgrab_network
      - portainer_network
      - prometheus_network
      - qbittorrent_network
      - syncthing_network
      - wikijs_network
+      - wikijs_study_instance_network
+      - wireguard_network
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.domain.entrypoints=websecure"
+      - "traefik.http.routers.domain.entrypoints=pukekos"
      - "traefik.http.routers.domain.rule=Host(`pukeko.xyz`)"
-      - "traefik.http.routers.domain.tls.certresolver=pukekoresolver"
+      - "traefik.http.routers.domain.tls.certresolver=takaheresolver"
      - "traefik.http.routers.domain.middlewares=domain"
      - 'traefik.http.middlewares.domain.redirectregex.regex=^https://pukeko.xyz/(.*)'
      - 'traefik.http.middlewares.domain.redirectregex.replacement=https://dash.pukeko.xyz/$${1}'
      - "traefik.http.middlewares.domain.redirectregex.permanent=true"
+      - "traefik.tls.stores.default.defaultgeneratedcert.resolver=takaheresolver"
+      - "traefik.tls.stores.default.defaultgeneratedcert.domain.main=pukeko.xyz"
        #    user: 1001:1001
  homer:
    image: b4bz/homer
    container_name: homer
    volumes:
-      - ./homer/:/www/assets:z
+      - ./homer/:/www/assets
    ports:
      - 4957:8080
    environment:
@@ -81,10 +72,10 @@ services:
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.homer.entrypoints=websecure"
+      - "traefik.http.routers.homer.entrypoints=pukekos"
      - "traefik.http.routers.homer.rule=Host(`dash.pukeko.xyz`)"
      - "traefik.http.routers.homer.service=homer-traefik@docker"
-      - "traefik.http.routers.homer.tls.certresolver=pukekoresolver"
+      - "traefik.http.routers.homer.tls.certresolver=takaheresolver"
      - "traefik.http.routers.homer.middlewares=authelia@docker"
    networks:
      - internal
@@ -93,9 +84,9 @@ services:
    container_name: authelia
    environment:
      - TZ=Asia/Jerusalem
-      - AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE=/run/secrets/private_key
+        #      - AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE=/run/secrets/private_key
    volumes:
-      - ./authelia:/config:z
+      - ./authelia:/config
    restart: unless-stopped
    secrets:
      - hmac
@@ -103,10 +94,10 @@ services:
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.authelia.rule=Host(`auth.pukeko.xyz`)'
-      - 'traefik.http.routers.authelia.entrypoints=websecure'
+      - 'traefik.http.routers.authelia.entrypoints=pukekos'
      - "traefik.http.routers.authelia.service=authelia-traefik@docker"
      - 'traefik.http.routers.authelia.tls=true'
-      - "traefik.http.routers.authelia.tls.certresolver=pukekoresolver"
+      - "traefik.http.routers.authelia.tls.certresolver=takaheresolver"
      - 'traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.pukeko.xyz/'
      - 'traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true'
      - 'traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User, Remote-Groups, Remote-Name, Remote-Email'
@@ -117,6 +108,16 @@ services:
      - internal
    expose:
      - 9091
+  redis:
+    image: redis:alpine
+    container_name: authelia_redis
+    volumes:
+      - ./redis:/data
+    networks:
+      - internal
+    expose:
+      - 6379
+    restart: unless-stopped
 secrets:
  hmac:
    file: ./authelia/secrets/hmac
@@ -131,22 +132,14 @@ networks:
    external: true
  filebrowser_network:
    external: true
-  freshrss_network:
-    external: true
  gitea_network:
    external: true
-  gitea_public_instance_network:
-    external: true
-  grocy_network:
-    external: true
-  jekyll_network:
-    external: true
+      #jekyll_network:
+      #    external: true
  jellyfin_network:
    external: true
  joplin_network:
    external: true
-  paperless-ngx_network:
-    external: true
  photoprism_network:
    external: true
  podgrab_network:
@@ -161,6 +154,10 @@ networks:
    external: true
  wikijs_network:
    external: true
+  wikijs_study_instance_network:
+    external: true
+  wireguard_network:
+    external: true
  qbittorrent_network:
    external: true
  syncthing_network:
Author	SHA1	Message	Date
Matan Horovitz	f540d1c46b	Pruned services; added Grafana auth	2023-11-17 16:51:09 +02:00
Matan Horovitz	955e73d3b3	Add Redis and WikiJS_Study; remove DNS	2022-12-16 10:53:03 +02:00
Matan Horovitz	1c4520c0e8	SELinux purges; DNS updates; remember Authelian consent	2022-10-16 13:05:44 +03:00
Matan Horovitz	702ead89ef	Update DNS config to use dedicated Adguard network - for real	2022-09-16 19:26:38 +03:00
Matan Horovitz	56912e3c4c	Update DNS config to use dedicated Adguard network	2022-09-16 19:24:05 +03:00