Like 0
Fork 0

Last active 1695683667

My Authelia setup https://auth.aly.pet

configuration.yml Raw
1# authelia/config/configuration.yml
2# run `openssl rand -hex 20` three times and update `jwt_secret`, `session.secret` and `storage.encryption_key`
3server:
4 host: 0.0.0.0
5 port: 9091
6log:
7 level: info
8jwt_secret: TODO
9default_redirection_url: https://auth.example.com
10totp:
11 issuer: example.com
12 period: 30
13 skew: 1
14
15#duo_api: ## If you want push notifictions of login attempts you can pay for this feature
16# hostname: api-123456789.example.com
17# integration_key: ABCDEF
18# secret_key: yet-another-long-string-of-characters-and-numbers-and-symbols
19
20authentication_backend:
21 password_reset:
22 disable: false
23 file:
24 path: /config/users_database.yml # Make sure this file exists
25 password:
26 algorithm: argon2
27 argon2:
28 variant: argon2id
29 iterations: 3
30 salt_length: 16
31 parallelism: 4
32 memory: 65536
33 key_length: 32
34
35access_control:
36 default_policy: deny
37 rules:
38 # Rules applied to everyone
39 - domain:
40 - "auth.example.com"
41 - "nextcloud.home.example.com"
42 - "plex.home.example.com"
43 policy: bypass
44 - domain: # Proxies only requiring username and password
45 - "*.example.com"
46 - "*.*.example.com"
47 policy: two_factor
48# networks:
49# - 192.168.1.0/24
50
51session:
52 name: authelia_session
53 # This secret can also be set using the env variables AUTHELIA_SESSION_SECRET_FILE
54 secret: TODO
55 expiration: 3600 # 1 hour
56 inactivity: 7200 # 2 hours
57 remember_me_duration: 1M
58 domain: example.com # Needs to be your root domain
59
60 redis:
61 host: redis
62 port: 6379
63 # This secret can also be set using the env variables AUTHELIA_SESSION_REDIS_PASSWORD_FILE
64# password: authelia
65
66regulation:
67 max_retries: 5
68 find_time: 2m
69 ban_time: 10m
70
71theme: dark # options: dark, light
72
73storage:
74 encryption_key: TODO
75 local:
76 path: /config/db.sqlite3
77
78notifier:
79 disable_startup_check: false
80 #filesystem:
81 # filename: /config/notification.txt
82 smtp:
83 username: APIKEY
84 password: SECRET
85 host: in-v3.mailjet.com
86 port: 587
87 sender: auth@example.com
88 subject: "[Authelia] {title}"
89 startup_check_address: admin@example.com
90
docker-compose.yml Raw
1# authelia/docker-compose.yml
2# update TZ=
3version: '3.3'
4services:
5 authelia:
6 image: authelia/authelia
7 volumes:
8 - ./config:/config
9 ports:
10 - 127.0.0.1:9091:9091
11 restart: unless-stopped
12 healthcheck:
13 disable: true
14 environment:
15 - TZ=<SET>
16 depends_on:
17 - redis
18
19 redis:
20 image: redis:alpine
21 volumes:
22 - ./redis:/data
23 expose:
24 - 6379
25 restart: unless-stopped
26 environment:
27 - TZ=<SET>
nginx.md Raw 
# /etc/nginx/sites-available/home.conf
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name home.example.com *.home.example.com;
    include /etc/nginx/snippets/authloc.conf;
    location / {
        include /etc/nginx/snippets/authinc.conf;
        proxy_pass http://10.8.0.2:80;
    }
}

# /etc/nginx/sites-available/auth.conf
server {
    listen [::]:443 ssl http2;
    listen 443 ssl http2;
    server_name auth.example.com;
    include /etc/nginx/snippets/ssl-examplecom.conf;
    location / {
        proxy_pass http://localhost:9091;
        include /etc/nginx/snippets/proxy.conf;
    }
}

# /etc/nginx/snippets/proxy.conf
# global proxy conf
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host:$server_port;
proxy_set_header X-Forwarded-Port $server_port;
proxy_redirect off;
client_body_buffer_size 128k;
client_max_body_size 0;
send_timeout 5m;
proxy_read_timeout 240;
proxy_send_timeout 240;
proxy_connect_timeout 240;
# websocket support
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;

# /etc/nginx/snippets/authproxy.conf
include /etc/nginx/snippets/proxy.conf;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_redirect http:// $scheme://;
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 4 32k;

# /etc/nginx/snippets/authloc.conf
location /auth {
    internal;
    proxy_pass_request_body off;
    proxy_pass http://localhost:9091/api/verify;
    proxy_set_header Content-Length "";
    include /etc/nginx/snippets/authproxy.conf;
}

# /etc/nginx/snippets/authinc.conf
auth_request /auth;
auth_request_set $target_url $scheme://$http_host$request_uri;
auth_request_set $user $upstream_http_remote_user;
auth_request_set $groups $upstream_http_remote_groups;
proxy_set_header Remote-User $user;
proxy_set_header Remote-Groups $groups;
error_page 401 =302 https://auth.example.com/?rd=$target_url;

# /etc/nginx/snippets/ssl.conf
    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;

    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
    ssl_prefer_server_ciphers off;

    resolver 1.1.1.1;

    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
    ssl_session_tickets off;

    ssl_dhparam /etc/nginx/dhparam.pem;

# /etc/nginx/snippets/ssl-home.conf
    ssl_certificate /etc/letsencrypt/live/home.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/home.example.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/home.example.com/fullchain.pem;
    include /etc/nginx/snippets/ssl.conf;
users-database.yml Raw
1# authelia/config/users-database.yml
2# docker run -v ./config:/config authelia/authelia:latest authelia -c /config/configuration.yml hash-password PASSWORD
3users:
4 admin:
5 displayname: "Admin"
6 password: "$argon2id$v=19$m=65536,t=3,p=4$uHJg6OCfd/OjwzwXu8SIbQ$BUeIp60Ay0mZOn1byhjYFwkdixsf4dWPqfx5C367B2o"
7 email: admin@example.com
8 groups:
9 - admins
10 - dev

Powered by Opengist ⋅ Load: 71ms⋅

English