From c37f78182c52511838181cda1f4ae2c17164df91 Mon Sep 17 00:00:00 2001 From: L4RM4ND <21357789+l4rm4nd@users.noreply.github.com> Date: Thu, 2 Mar 2023 00:37:37 +0100 Subject: [PATCH] add authelia --- examples/authelia/README.md | 9 +++ examples/authelia/config/configuration.yml | 82 +++++++++++++++++++++ examples/authelia/config/users_database.yml | 19 +++++ examples/authelia/docker-compose.yml | 39 ++++++++++ examples/traefik/fileConfig.yml | 15 +++- 5 files changed, 162 insertions(+), 2 deletions(-) create mode 100644 examples/authelia/README.md create mode 100644 examples/authelia/config/configuration.yml create mode 100644 examples/authelia/config/users_database.yml create mode 100644 examples/authelia/docker-compose.yml diff --git a/examples/authelia/README.md b/examples/authelia/README.md new file mode 100644 index 0000000..b2d73c2 --- /dev/null +++ b/examples/authelia/README.md @@ -0,0 +1,9 @@ +# References + +- https://github.com/authelia/authelia +- https://www.youtube.com/watch?v=u6H-Qwf4nZA&t=1314s +- https://docs.technotim.live/posts/authelia-traefik/ + +# Notes + +You have to put the configuration files in the directory `config` to your Docker volume bind mount. diff --git a/examples/authelia/config/configuration.yml b/examples/authelia/config/configuration.yml new file mode 100644 index 0000000..d5b084b --- /dev/null +++ b/examples/authelia/config/configuration.yml @@ -0,0 +1,82 @@ +--- +############################################################### +# Authelia configuration # +############################################################### + +server: + host: 0.0.0.0 + port: 9091 +log: + level: debug + +theme: dark + +# This secret can also be set using the env variables AUTHELIA_JWT_SECRET_FILE +jwt_secret: a_very_important_secret +default_redirection_url: https://auth.example.com # replace with your domain name +totp: + issuer: authelia.com + +# duo_api: +# hostname: api-123456789.example.com +# integration_key: ABCDEF +# # This secret can also be set using the env variables AUTHELIA_DUO_API_SECRET_KEY_FILE +# secret_key: 1234567890abcdefghifjkl + +authentication_backend: + file: + path: /config/users_database.yml + password: + algorithm: argon2id + iterations: 1 + salt_length: 16 + parallelism: 8 + memory: 64 + +access_control: + default_policy: deny + rules: + # Rules applied to everyone + # chose from bypass, one_factor and two_factor + - domain: public.example.com + policy: bypass + - domain: subdomain1.example.com + policy: one_factor + - domain: subdomain2.example.com + policy: two_factor + +session: + name: authelia_session + # This secret can also be set using the env variables AUTHELIA_SESSION_SECRET_FILE + secret: unsecure_session_secret + expiration: 3600 # 1 hour + inactivity: 300 # 5 minutes + domain: example.com # Should match whatever your root protected domain is + + redis: + host: authelia-redis + port: 6379 + # This secret can also be set using the env variables AUTHELIA_SESSION_REDIS_PASSWORD_FILE + # password: authelia + +regulation: + max_retries: 3 + find_time: 120 + ban_time: 300 + +storage: + encryption_key: a_very_important_secret # Now required + local: + path: /config/db.sqlite3 + +notifier: + # smtp: + # username: test + # # This secret can also be set using the env variables AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE + # password: password + # host: mail.example.com + # port: 25 + # sender: admin@example.com + filesystem: + filename: /config/notifications.txt +... diff --git a/examples/authelia/config/users_database.yml b/examples/authelia/config/users_database.yml new file mode 100644 index 0000000..835e5f8 --- /dev/null +++ b/examples/authelia/config/users_database.yml @@ -0,0 +1,19 @@ +--- +############################################################### +# Users Database # +############################################################### + +# This file can be used if you do not have an LDAP set up. + +# List of users +users: + yourUsername: # define here your username + disabled: false + displayname: "My Authelia User" + # Password is authelia + password: "$argon2id$v=19$m=65536,t=3,p=4$mTOaOa3MOexX7JQ02BdXzw$OzAxTnSPEnahQgIi+y4QPP5/xYIQ8uEWDYW+vlupeTM" # generate a secure hash with: $ docker run authelia/authelia:latest authelia crypto hash generate argon2 --password 'password' + email: authelia@example.com + groups: + - admins + - dev +... diff --git a/examples/authelia/docker-compose.yml b/examples/authelia/docker-compose.yml new file mode 100644 index 0000000..3789102 --- /dev/null +++ b/examples/authelia/docker-compose.yml @@ -0,0 +1,39 @@ +version: '3.3' + +services: + authelia: + image: authelia/authelia + container_name: authelia + volumes: + - ${DOCKER_VOLUME_STORAGE:-/mnt/docker-volumes}/authelia/config:/config + networks: + - proxy + labels: + - 'traefik.enable=true' + - 'traefik.http.routers.authelia.rule=Host(`auth.example.com`)' # replace with your domain name + - 'traefik.http.routers.authelia.entrypoints=https' + - 'traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/authz/forward-auth?authelia_url=https://auth.example.com' # replace with your domain name + - 'traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true' + - 'traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email' # yamllint disable-line rule:line-length + expose: + - 9091 + restart: unless-stopped + environment: + - TZ=Europe/Berlin + + redis: + image: redis:alpine + container_name: authelia-redis + volumes: + - ${DOCKER_VOLUME_STORAGE:-/mnt/docker-volumes}/authelia/redis:/data + networks: + - proxy + expose: + - 6379 + restart: unless-stopped + environment: + - TZ=Europe/Berlin + +networks: + proxy: + external: true diff --git a/examples/traefik/fileConfig.yml b/examples/traefik/fileConfig.yml index 4d4345a..8c4bed6 100644 --- a/examples/traefik/fileConfig.yml +++ b/examples/traefik/fileConfig.yml @@ -44,7 +44,7 @@ http: # Only Allow Local networks local-ipwhitelist: ipWhiteList: - sourceRange: + sourceRange: - 127.0.0.1/32 # localhost - 10.0.0.0/8 # private class A - 172.16.0.0/12 # private class B @@ -77,7 +77,18 @@ http: stsSeconds: 63072000 # HTTP-Strict-Transport-Security (HSTS) stsPreload: true # HTTP-Strict-Transport-Security (HSTS) #contentSecurityPolicy: "block-all-mixed-content" # Content-Security-Policy (CSP) - + + # Authelia guard + authelia: + forwardauth: + address: http://authelia:9091/api/verify?rd=https://auth.example.com/ # replace example.com with your domain name + trustForwardHeader: true + authResponseHeaders: + - Remote-User + - Remote-Groups + - Remote-Name + - Remote-Email + # rate limiting rate-limit: rateLimit: