###
# Authelia configuration
# https://www.authelia.com/configuration/prologue/introduction/
#
# This file ships with placeholder secrets. Authelia will NOT start until
# the CHANGE_ME values, the session cookie domain and the user database
# are configured.
#
# Generate secrets with:
#   authelia crypto rand --length 64 --charset alphanumeric
# (container install:
#   sudo -u authelia podman exec authelia authelia crypto rand --length 64 --charset alphanumeric)
###

theme: 'auto'

server:
  ## Bind address. The container publishes only 127.0.0.1:9091 on the host;
  ## the native service overrides this to 127.0.0.1 via AUTHELIA_SERVER_ADDRESS
  ## in authelia.service.
  address: 'tcp://0.0.0.0:9091/'

log:
  level: 'info'

identity_validation:
  reset_password:
    jwt_secret: 'CHANGE_ME_jwt_secret'

authentication_backend:
  file:
    path: '/etc/authelia/users_database.yml'

access_control:
  default_policy: 'one_factor'

session:
  secret: 'CHANGE_ME_session_secret'
  cookies:
    - domain: 'example.com'
      authelia_url: 'https://auth.example.com'

regulation:
  max_retries: 3
  find_time: '2m'
  ban_time: '5m'

storage:
  encryption_key: 'CHANGE_ME_storage_encryption_key'
  ## SQLite (default). When using the authelia-postgresql subpackage,
  ## comment out the `local:` block below and uncomment the
  ## AUTHELIA_STORAGE_POSTGRES_* environment in the database.conf drop-in
  ## (/etc/containers/systemd/authelia.container.d/database.conf for the
  ## container, /etc/systemd/system/authelia.service.d/database.conf for
  ## the native service).
  local:
    path: '/var/lib/authelia/data/db.sqlite3'

notifier:
  ## File-based notifier for initial setup. Replace with `smtp:` in
  ## production so users receive password reset / identity emails.
  filesystem:
    filename: '/var/lib/authelia/data/notification.txt'