blob: ace649ebef19f69e1773d1d3ec0d2dfdc2ca93e3 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
|
---
# Authelia configuration for swave.lol
server:
address: 'tcp://0.0.0.0:9091'
log:
level: info
# Session cookie covers all *.swave.lol subdomains — one login, all services
session:
name: authelia_session
expiration: 3600 # 1 hour
inactivity: 300 # 5 minutes idle timeout
remember_me: 1M
redis:
host: authelia-redis
port: 6379
cookies:
- domain: swave.lol
authelia_url: https://auth.swave.lol
default_redirection_url: https://swave.lol
# SQLite storage — simple, no extra container needed
storage:
local:
path: /data/db.sqlite3
# Filesystem notifier — upgrade to SMTP later (see setup.md)
notifier:
filesystem:
filename: /data/notification.txt
# User database (argon2id hashed passwords)
authentication_backend:
file:
path: /config/users_database.yml
password:
algorithm: argon2id
iterations: 3
memory: 65536
parallelism: 4
key_length: 32
salt_length: 16
# Default deny — only explicitly bypassed or permitted resources are accessible
access_control:
default_policy: deny
rules:
# Auth portal itself — must be accessible without auth
- domain: auth.swave.lol
policy: bypass
# Public services — no auth required
- domain:
- swave.lol
- blog.swave.lol
- ghost.swave.lol
policy: bypass
# Cgit — public read-only git browser
- domain: cgit.swave.lol
policy: bypass
- domain: swave.lol
resources:
- '^/cgit(/.*)?$'
policy: bypass
# Netdata — requires login
- domain: swave.lol
resources:
- '^/netdata(/.*)?$'
policy: one_factor
# Cockpit — requires login
- domain: swave.lol
resources:
- '^/cockpit(/.*)?$'
policy: one_factor
# Gerrit login — auth_request on /login/ injects X-Forwarded-User once, Gerrit
# maintains its own session from there; anonymous users never hit /login/ directly
- domain: gerrit.swave.lol
resources:
- '^/login(/.*)?$'
policy: one_factor
# Gerrit general — public read, no auth_request needed on other paths
- domain: gerrit.swave.lol
policy: bypass
# Jenkins — requires login (OIDC)
- domain: jenkins.swave.lol
policy: one_factor
# Nexus — requires login
- domain: nexus.swave.lol
policy: one_factor
- domain: swave.lol
resources:
- '^/nexus(/.*)?$'
policy: one_factor
# Docker registry — requires login
- domain: registry.swave.lol
policy: one_factor
# OIDC provider — used by Jenkins for true SSO
identity_providers:
oidc:
# HMAC secret loaded via AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE env var
# RSA key loaded from file via template below
jwks:
- key: |
OIDC_RSA_KEY_PLACEHOLDER
clients:
- client_id: jenkins
client_name: Jenkins CI
# Hash generated with: authelia crypto hash generate argon2 --password 'YOUR_SECRET'
client_secret: '$argon2id$v=19$m=65536,t=3,p=4$REPLACE_WITH_REAL_HASH'
authorization_policy: one_factor
redirect_uris:
- https://jenkins.swave.lol/securityRealm/finishLogin
scopes:
- openid
- profile
- email
- groups
grant_types:
- authorization_code
response_types:
- code
userinfo_signed_response_alg: none
|
