add authelia

examples/authelia/README.md

@@ -0,0 +1,9 @@
+# References
+
+- https://github.com/authelia/authelia
+- https://www.youtube.com/watch?v=u6H-Qwf4nZA&t=1314s
+- https://docs.technotim.live/posts/authelia-traefik/
+
+# Notes
+
+You have to put the configuration files in the directory `config` to your Docker volume bind mount.

examples/authelia/config/configuration.yml

@@ -0,0 +1,82 @@
+---
+###############################################################
+#                   Authelia configuration                    #
+###############################################################
+
+server:
+  host: 0.0.0.0
+  port: 9091
+log:
+  level: debug
+
+theme: dark
+
+# This secret can also be set using the env variables AUTHELIA_JWT_SECRET_FILE
+jwt_secret: a_very_important_secret
+default_redirection_url: https://auth.example.com # replace with your domain name
+totp:
+  issuer: authelia.com
+
+# duo_api:
+#  hostname: api-123456789.example.com
+#  integration_key: ABCDEF
+#  # This secret can also be set using the env variables AUTHELIA_DUO_API_SECRET_KEY_FILE
+#  secret_key: 1234567890abcdefghifjkl
+
+authentication_backend:
+  file:
+    path: /config/users_database.yml
+    password:
+      algorithm: argon2id
+      iterations: 1
+      salt_length: 16
+      parallelism: 8
+      memory: 64
+
+access_control:
+  default_policy: deny
+  rules:
+    # Rules applied to everyone
+    # chose from bypass, one_factor and two_factor
+    - domain: public.example.com
+      policy: bypass
+    - domain: subdomain1.example.com
+      policy: one_factor
+    - domain: subdomain2.example.com
+      policy: two_factor
+
+session:
+  name: authelia_session
+  # This secret can also be set using the env variables AUTHELIA_SESSION_SECRET_FILE
+  secret: unsecure_session_secret
+  expiration: 3600  # 1 hour
+  inactivity: 300  # 5 minutes
+  domain: example.com  # Should match whatever your root protected domain is
+
+  redis:
+    host: authelia-redis
+    port: 6379
+    # This secret can also be set using the env variables AUTHELIA_SESSION_REDIS_PASSWORD_FILE
+    # password: authelia
+
+regulation:
+  max_retries: 3
+  find_time: 120
+  ban_time: 300
+
+storage:
+  encryption_key: a_very_important_secret # Now required
+  local:
+    path: /config/db.sqlite3
+
+notifier:
+  # smtp:
+  #   username: test
+  #   # This secret can also be set using the env variables AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE
+  #   password: password
+  #   host: mail.example.com
+  #   port: 25
+  #   sender: admin@example.com
+  filesystem:
+    filename: /config/notifications.txt
+...

examples/authelia/config/users_database.yml

@@ -0,0 +1,19 @@
+---
+###############################################################
+#                         Users Database                      #
+###############################################################
+
+# This file can be used if you do not have an LDAP set up.
+
+# List of users
+users:
+  yourUsername:  # define here your username
+    disabled: false
+    displayname: "My Authelia User"
+    # Password is authelia
+    password: "$argon2id$v=19$m=65536,t=3,p=4$mTOaOa3MOexX7JQ02BdXzw$OzAxTnSPEnahQgIi+y4QPP5/xYIQ8uEWDYW+vlupeTM"  # generate a secure hash with: $ docker run authelia/authelia:latest authelia crypto hash generate argon2 --password 'password'
+    email: authelia@example.com
+    groups:
+      - admins
+      - dev
+...

examples/authelia/docker-compose.yml

@@ -0,0 +1,39 @@
+version: '3.3'
+
+services:
+  authelia:
+    image: authelia/authelia
+    container_name: authelia
+    volumes:
+      - ${DOCKER_VOLUME_STORAGE:-/mnt/docker-volumes}/authelia/config:/config
+    networks:
+      - proxy
+    labels:
+      - 'traefik.enable=true'
+      - 'traefik.http.routers.authelia.rule=Host(`auth.example.com`)'  # replace with your domain name
+      - 'traefik.http.routers.authelia.entrypoints=https'
+      - 'traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/authz/forward-auth?authelia_url=https://auth.example.com'  # replace with your domain name
+      - 'traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true'
+      - 'traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email'  # yamllint disable-line rule:line-length
+    expose:
+      - 9091
+    restart: unless-stopped
+    environment:
+      - TZ=Europe/Berlin
+
+  redis:
+    image: redis:alpine
+    container_name: authelia-redis
+    volumes:
+      - ${DOCKER_VOLUME_STORAGE:-/mnt/docker-volumes}/authelia/redis:/data
+    networks:
+      - proxy
+    expose:
+      - 6379
+    restart: unless-stopped
+    environment:
+      - TZ=Europe/Berlin
+
+networks:
+   proxy:
+      external: true

examples/traefik/fileConfig.yml

@@ -44,7 +44,7 @@ http:
     # Only Allow Local networks
     local-ipwhitelist:
       ipWhiteList:
-        sourceRange: 
+        sourceRange:
           - 127.0.0.1/32 # localhost
           - 10.0.0.0/8 # private class A
           - 172.16.0.0/12 # private class B
@@ -77,7 +77,18 @@ http:
         stsSeconds: 63072000 # HTTP-Strict-Transport-Security (HSTS)
         stsPreload: true # HTTP-Strict-Transport-Security (HSTS)
         #contentSecurityPolicy: "block-all-mixed-content" # Content-Security-Policy (CSP)
-        
+
+    # Authelia guard
+    authelia:
+      forwardauth:
+        address: http://authelia:9091/api/verify?rd=https://auth.example.com/  # replace example.com with your domain name
+        trustForwardHeader: true
+        authResponseHeaders:
+          - Remote-User
+          - Remote-Groups
+          - Remote-Name
+          - Remote-Email
+
     # rate limiting
     rate-limit:
       rateLimit: