zpericic
755fe4e81e
- Base + service (native binary), container (rootless quadlet), postgresql and redis subpackages - Fixed UID/GID 126 for the authelia user - Rootless pod publishing 127.0.0.1:9091; db and redis join the pod (container) or publish on localhost (service) - Container images pinned by digest - Native -service subpackage built conditionally (--without service)
64 lines
1.8 KiB
YAML
64 lines
1.8 KiB
YAML
###
|
|
# Authelia configuration
|
|
# https://www.authelia.com/configuration/prologue/introduction/
|
|
#
|
|
# This file ships with placeholder secrets. Authelia will NOT start until
|
|
# the CHANGE_ME values, the session cookie domain and the user database
|
|
# are configured.
|
|
#
|
|
# Generate secrets with:
|
|
# authelia crypto rand --length 64 --charset alphanumeric
|
|
# (container install:
|
|
# sudo -u authelia podman exec authelia authelia crypto rand --length 64 --charset alphanumeric)
|
|
###
|
|
|
|
theme: 'auto'
|
|
|
|
server:
|
|
## Bind address. The container publishes only 127.0.0.1:9091 on the host;
|
|
## the native service overrides this to 127.0.0.1 via AUTHELIA_SERVER_ADDRESS
|
|
## in authelia.service.
|
|
address: 'tcp://0.0.0.0:9091/'
|
|
|
|
log:
|
|
level: 'info'
|
|
|
|
identity_validation:
|
|
reset_password:
|
|
jwt_secret: 'CHANGE_ME_jwt_secret'
|
|
|
|
authentication_backend:
|
|
file:
|
|
path: '/etc/authelia/users_database.yml'
|
|
|
|
access_control:
|
|
default_policy: 'one_factor'
|
|
|
|
session:
|
|
secret: 'CHANGE_ME_session_secret'
|
|
cookies:
|
|
- domain: 'example.com'
|
|
authelia_url: 'https://auth.example.com'
|
|
|
|
regulation:
|
|
max_retries: 3
|
|
find_time: '2m'
|
|
ban_time: '5m'
|
|
|
|
storage:
|
|
encryption_key: 'CHANGE_ME_storage_encryption_key'
|
|
## SQLite (default). When using the authelia-postgresql subpackage,
|
|
## comment out the `local:` block below and uncomment the
|
|
## AUTHELIA_STORAGE_POSTGRES_* environment in the database.conf drop-in
|
|
## (/etc/containers/systemd/authelia.container.d/database.conf for the
|
|
## container, /etc/systemd/system/authelia.service.d/database.conf for
|
|
## the native service).
|
|
local:
|
|
path: '/var/lib/authelia/data/db.sqlite3'
|
|
|
|
notifier:
|
|
## File-based notifier for initial setup. Replace with `smtp:` in
|
|
## production so users receive password reset / identity emails.
|
|
filesystem:
|
|
filename: '/var/lib/authelia/data/notification.txt'
|