diff options
Diffstat (limited to 'authelia/config')
| -rw-r--r-- | authelia/config/configuration.yml | 134 | ||||
| -rw-r--r-- | authelia/config/users_database.yml.example | 28 |
2 files changed, 162 insertions, 0 deletions
diff --git a/authelia/config/configuration.yml b/authelia/config/configuration.yml new file mode 100644 index 0000000..ace649e --- /dev/null +++ b/authelia/config/configuration.yml @@ -0,0 +1,134 @@ +--- +# Authelia configuration for swave.lol + +server: + address: 'tcp://0.0.0.0:9091' + +log: + level: info + +# Session cookie covers all *.swave.lol subdomains — one login, all services +session: + name: authelia_session + expiration: 3600 # 1 hour + inactivity: 300 # 5 minutes idle timeout + remember_me: 1M + redis: + host: authelia-redis + port: 6379 + cookies: + - domain: swave.lol + authelia_url: https://auth.swave.lol + default_redirection_url: https://swave.lol + +# SQLite storage — simple, no extra container needed +storage: + local: + path: /data/db.sqlite3 + +# Filesystem notifier — upgrade to SMTP later (see setup.md) +notifier: + filesystem: + filename: /data/notification.txt + +# User database (argon2id hashed passwords) +authentication_backend: + file: + path: /config/users_database.yml + password: + algorithm: argon2id + iterations: 3 + memory: 65536 + parallelism: 4 + key_length: 32 + salt_length: 16 + +# Default deny — only explicitly bypassed or permitted resources are accessible +access_control: + default_policy: deny + rules: + # Auth portal itself — must be accessible without auth + - domain: auth.swave.lol + policy: bypass + + # Public services — no auth required + - domain: + - swave.lol + - blog.swave.lol + - ghost.swave.lol + policy: bypass + + # Cgit — public read-only git browser + - domain: cgit.swave.lol + policy: bypass + - domain: swave.lol + resources: + - '^/cgit(/.*)?$' + policy: bypass + + # Netdata — requires login + - domain: swave.lol + resources: + - '^/netdata(/.*)?$' + policy: one_factor + + # Cockpit — requires login + - domain: swave.lol + resources: + - '^/cockpit(/.*)?$' + policy: one_factor + + # Gerrit login — auth_request on /login/ injects X-Forwarded-User once, Gerrit + # maintains its own session from there; anonymous users never hit /login/ directly + - domain: gerrit.swave.lol + resources: + - '^/login(/.*)?$' + policy: one_factor + + # Gerrit general — public read, no auth_request needed on other paths + - domain: gerrit.swave.lol + policy: bypass + + + # Jenkins — requires login (OIDC) + - domain: jenkins.swave.lol + policy: one_factor + + # Nexus — requires login + - domain: nexus.swave.lol + policy: one_factor + - domain: swave.lol + resources: + - '^/nexus(/.*)?$' + policy: one_factor + + # Docker registry — requires login + - domain: registry.swave.lol + policy: one_factor + +# OIDC provider — used by Jenkins for true SSO +identity_providers: + oidc: + # HMAC secret loaded via AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE env var + # RSA key loaded from file via template below + jwks: + - key: | + OIDC_RSA_KEY_PLACEHOLDER + clients: + - client_id: jenkins + client_name: Jenkins CI + # Hash generated with: authelia crypto hash generate argon2 --password 'YOUR_SECRET' + client_secret: '$argon2id$v=19$m=65536,t=3,p=4$REPLACE_WITH_REAL_HASH' + authorization_policy: one_factor + redirect_uris: + - https://jenkins.swave.lol/securityRealm/finishLogin + scopes: + - openid + - profile + - email + - groups + grant_types: + - authorization_code + response_types: + - code + userinfo_signed_response_alg: none diff --git a/authelia/config/users_database.yml.example b/authelia/config/users_database.yml.example new file mode 100644 index 0000000..1cd73f3 --- /dev/null +++ b/authelia/config/users_database.yml.example @@ -0,0 +1,28 @@ +--- +# Authelia users database example +# +# Copy this file to users_database.yml and fill in real values. +# The actual users_database.yml is gitignored (contains password hashes). +# +# Generate an argon2id hash for a password: +# docker run --rm authelia/authelia:latest authelia crypto hash generate argon2 --password 'yourpassword' +# +# Group membership controls access if you add group-based rules later. + +users: + admin: + displayname: Admin + # Replace with hash from: authelia crypto hash generate argon2 --password 'yourpassword' + password: '$argon2id$v=19$m=65536,t=3,p=4$REPLACE_WITH_REAL_HASH$REPLACE_WITH_REAL_HASH' + email: admin@swave.lol + groups: + - admins + - developers + + # Example: add more users here + # alice: + # displayname: Alice + # password: '$argon2id$v=19$m=65536,t=3,p=4$...$...' + # email: alice@swave.lol + # groups: + # - developers |