From adb005b9e6ad7007432105686427cedd6ef7a638 Mon Sep 17 00:00:00 2001 From: Ian Fijolek Date: Thu, 7 Mar 2019 02:27:34 +0000 Subject: [PATCH] Running, but untested --- CloudronManifest.json | 5 +- config.custom_template.yml | 94 ++++++++++++++++++++++ config.template.yml | 156 ++++++------------------------------- start.sh | 27 ++++++- yaml-override.js | 4 +- 5 files changed, 148 insertions(+), 138 deletions(-) create mode 100644 config.custom_template.yml diff --git a/CloudronManifest.json b/CloudronManifest.json index 34378fa..9f1e8b5 100644 --- a/CloudronManifest.json +++ b/CloudronManifest.json @@ -9,8 +9,11 @@ "healthCheckPath": "/", "httpPort": 3000, "addons": { + "ldap": {}, "localstorage": {}, - "ldap": {} + "mongodb": {}, + "redis": {}, + "sendmail": {} }, "manifestVersion": 1, "website": "https://www.authelia.com/", diff --git a/config.custom_template.yml b/config.custom_template.yml new file mode 100644 index 0000000..41d2562 --- /dev/null +++ b/config.custom_template.yml @@ -0,0 +1,94 @@ +############################################ +# Cloudron users +# +# Add additional customizations in this file. +# Certain features, such as Access Control *must* be done in this file. +############################################ + + +# Access Control +# +# Access control is a list of rules defining the authorizations applied for one +# resource to users or group of users. +# +# If 'access_control' is not defined, ACL rules are disabled and the `bypass` +# rule is applied, i.e., access is allowed to anyone. Otherwise restrictions follow +# the rules defined. +# +# Note: One can use the wildcard * to match any subdomain. +# It must stand at the beginning of the pattern. (example: *.mydomain.com) +# +# Note: You must put patterns containing wildcards between simple quotes for the YAML +# to be syntaxically correct. +# +# Definition: A `rule` is an object with the following keys: `domain`, `subject`, +# `policy` and `resources`. +# +# - `domain` defines which domain or set of domains the rule applies to. +# +# - `subject` defines the subject to apply authorizations to. This parameter is +# optional and matching any user if not provided. If provided, the parameter +# represents either a user or a group. It should be of the form 'user:' +# or 'group:'. +# +# - `policy` is the policy to apply to resources. It must be either `bypass`, +# `one_factor`, `two_factor` or `deny`. +# +# - `resources` is a list of regular expressions that matches a set of resources to +#  apply the policy to. This parameter is optional and matches any resource if not +# provided. +# +# Note: the order of the rules is important. The first policy matching +# (domain, resource, subject) applies. +access_control: + # Default policy can either be `bypass`, `one_factor`, `two_factor` or `deny`. + # It is the policy applied to any resource if there is no policy to be applied + # to the user. + default_policy: deny + + rules: + # Rules applied to everyone + - domain: public.example.com + policy: two_factor + - domain: single_factor.example.com + policy: one_factor + + # Rules applied to 'admin' group + - domain: 'mx2.mail.example.com' + subject: 'group:admin' + policy: deny + - domain: '*.example.com' + subject: 'group:admin' + policy: two_factor + + # Rules applied to 'dev' group + - domain: dev.example.com + resources: + - '^/groups/dev/.*$' + subject: 'group:dev' + policy: two_factor + + # Rules applied to user 'john' + - domain: dev.example.com + resources: + - '^/users/john/.*$' + subject: 'user:john' + policy: two_factor + + + # Rules applied to user 'harry' + - domain: dev.example.com + resources: + - '^/users/harry/.*$' + subject: 'user:harry' + policy: two_factor + + # Rules applied to user 'bob' + - domain: '*.mail.example.com' + subject: 'user:bob' + policy: two_factor + - domain: 'dev.example.com' + resources: + - '^/users/bob/.*$' + subject: 'user:bob' + policy: two_factor diff --git a/config.template.yml b/config.template.yml index ac62457..be3d7e9 100644 --- a/config.template.yml +++ b/config.template.yml @@ -27,7 +27,7 @@ default_redirection_url: ##DEFAULT_REDIRECT_URL # This will be the issuer name displayed in Google Authenticator # See: https://github.com/google/google-authenticator/wiki/Key-Uri-Format for more info on issuer names totp: - issuer: ##TOTP_ISSUER + issuer: ##APP_DOMAIN # The authentication backend to use for verifying user passwords # and retrieve information such as email address and groups @@ -45,10 +45,11 @@ authentication_backend: url: ##LDAP_URL # The base dn for every entries - base_dn: '' + base_dn: dc=cloudron # An additional dn to define the scope to all users - additional_users_dn: ##LDAP_USERS_BASE_DN + # additional_users_dn: ##LDAP_USERS_BASE_DN + additional_users_dn: ou=users # The users filter used to find the user DN # {0} is a matcher replaced by username. @@ -56,13 +57,15 @@ authentication_backend: users_filter: (&(objectclass=user)(|(username={0})(mail={0}))) # An additional dn to define the scope of groups - additional_groups_dn: ##LDAP_GROUPS_BASE_DN + # additional_groups_dn: ##LDAP_GROUPS_BASE_DN + additional_groups_dn: ou=groups # The groups filter used for retrieving groups of a given user. # {0} is a matcher replaced by username. # {dn} is a matcher replaced by user DN. + # {uid} is a matcher replaced by user uid. # 'member={dn}' by default. - groups_filter: (&(member={dn})(objectclass=groupOfNames)) + groups_filter: (&(memberuid={uid})(objectclass=group)) # The attribute holding the name of the group group_name_attribute: cn @@ -74,104 +77,9 @@ authentication_backend: user: ##LDAP_BIND_DN password: ##LDAP_BIND_PASSWORD - # File backend configuration. - # - # With this backend, the users database is stored in a file - # which is updated when users reset their passwords. - # Therefore, this backend is meant to be used in a dev environment - # and not in production since it prevents Authelia to be scaled to - # more than one instance. - # - ## file: - ## path: ./users_database.yml - -# Access Control -# -# Access control is a list of rules defining the authorizations applied for one -# resource to users or group of users. -# -# If 'access_control' is not defined, ACL rules are disabled and the `bypass` -# rule is applied, i.e., access is allowed to anyone. Otherwise restrictions follow -# the rules defined. -# -# Note: One can use the wildcard * to match any subdomain. -# It must stand at the beginning of the pattern. (example: *.mydomain.com) -# -# Note: You must put patterns containing wildcards between simple quotes for the YAML -# to be syntaxically correct. -# -# Definition: A `rule` is an object with the following keys: `domain`, `subject`, -# `policy` and `resources`. -# -# - `domain` defines which domain or set of domains the rule applies to. -# -# - `subject` defines the subject to apply authorizations to. This parameter is -# optional and matching any user if not provided. If provided, the parameter -# represents either a user or a group. It should be of the form 'user:' -# or 'group:'. -# -# - `policy` is the policy to apply to resources. It must be either `bypass`, -# `one_factor`, `two_factor` or `deny`. -# -# - `resources` is a list of regular expressions that matches a set of resources to -#  apply the policy to. This parameter is optional and matches any resource if not -# provided. -# -# Note: the order of the rules is important. The first policy matching -# (domain, resource, subject) applies. -access_control: - # Default policy can either be `bypass`, `one_factor`, `two_factor` or `deny`. - # It is the policy applied to any resource if there is no policy to be applied - # to the user. - default_policy: deny - - rules: - # Rules applied to everyone - - domain: public.example.com - policy: two_factor - - domain: single_factor.example.com - policy: one_factor - - # Rules applied to 'admin' group - - domain: 'mx2.mail.example.com' - subject: 'group:admin' - policy: deny - - domain: '*.example.com' - subject: 'group:admin' - policy: two_factor - - # Rules applied to 'dev' group - - domain: dev.example.com - resources: - - '^/groups/dev/.*$' - subject: 'group:dev' - policy: two_factor - - # Rules applied to user 'john' - - domain: dev.example.com - resources: - - '^/users/john/.*$' - subject: 'user:john' - policy: two_factor - - - # Rules applied to user 'harry' - - domain: dev.example.com - resources: - - '^/users/harry/.*$' - subject: 'user:harry' - policy: two_factor - - # Rules applied to user 'bob' - - domain: '*.mail.example.com' - subject: 'user:bob' - policy: two_factor - - domain: 'dev.example.com' - resources: - - '^/users/bob/.*$' - subject: 'user:bob' - policy: two_factor +# Access Control must be customized in /app/data/config.yml +# access_control: # Configuration of session cookies @@ -182,7 +90,7 @@ session: name: authelia_session # The secret to encrypt the session cookie. - secret: unsecure_session_secret + secret: ##SESSION_SECRET # The time in ms before the cookie expires and session is reset. expiration: 3600000 # 1 hour @@ -193,13 +101,13 @@ session: # The domain to protect. # Note: the authenticator must also be in that domain. If empty, the cookie # is restricted to the subdomain of the issuer. - domain: example.com + domain: ##APP_DOMAIN # The redis connection details redis: - host: redis - port: 6379 - password: authelia + host: ##REDIS_HOST + port: ##REDIS_PORT + password: ##REDIS_PASSWORD # Configuration of the authentication regulation mechanism. # @@ -222,17 +130,13 @@ regulation: # # You must use only an available configuration: local, mongo storage: - # The directory where the DB files will be saved - ## local: - ## path: /var/lib/authelia/store - # Settings to connect to mongo server mongo: - url: mongodb://mongo - database: authelia + url: ##MONGODB_URL + database: ##MONGODB_DATABASE auth: - username: authelia - password: authelia + username: ##MONGODB_USERNAME + password: ##MONGODB_PASSWORD # Configuration of the notification system. # @@ -240,23 +144,11 @@ storage: # registration or a TOTP registration. # Use only an available configuration: filesystem, gmail notifier: - # For testing purpose, notifications can be sent in a file - ## filesystem: - ## filename: /tmp/authelia/notification.txt - - # Use your email account to send the notifications. You can use an app password. - # List of valid services can be found here: https://nodemailer.com/smtp/well-known/ - ## email: - ## username: user@example.com - ## password: yourpassword - ## sender: admin@example.com - ## service: gmail - # Use a SMTP server for sending notifications smtp: - username: test - password: password + username: ##MAIL_SMTP_USERNAME + password: ##MAIL_SMTP_PASSWORD secure: false - host: 'smtp' - port: 1025 - sender: admin@example.com + host: ##MAIL_SMTP_SERVER + port: ##MAIL_SMTP_PORT + sender: ##MAIL_FROM diff --git a/start.sh b/start.sh index b259eb9..87f5a35 100755 --- a/start.sh +++ b/start.sh @@ -4,18 +4,39 @@ set -eu mkdir -p /run/authelia +# Generate session secret if it doesn't exist +if [[ ! -f /app/data/session_secret ]]; then + pwgen -1 -s > /app/data/session_secret +fi +SESSION_SECRET=$(cat /app/data/session_secret) + # Generate base config from template -sed -e "s/##DEFAULT_REDIRECT_URL/${REDIRECT_URL}/" \ - -e "s/##TOTP_ISSUER/${}/"\ - -e "s/##LDAP_URL/${LDAP_URL}/"\ +sed -e "s|##DEFAULT_REDIRECT_URL|${WEBADMIN_ORIGIN}|" \ + -e "s|##LDAP_URL|${LDAP_URL}|"\ -e "s/##LDAP_USERS_BASE_DN/${LDAP_USERS_BASE_DN}/"\ -e "s/##LDAP_GROUPS_BASE_DN/${LDAP_GROUPS_BASE_DN}/"\ -e "s/##LDAP_BIND_DN/${LDAP_BIND_DN}/"\ -e "s/##LDAP_BIND_PASSWORD/${LDAP_BIND_PASSWORD}/"\ + -e "s/##SESSION_SECRET/${SESSION_SECRET}/"\ + -e "s/##APP_DOMAIN/${APP_DOMAIN}/"\ + -e "s|##APP_ORIGIN|${APP_ORIGIN}|"\ + -e "s/##REDIS_HOST/${REDIS_HOST}/"\ + -e "s/##REDIS_PORT/${REDIS_PORT}/"\ + -e "s/##REDIS_PASSWORD/${REDIS_PASSWORD}/"\ + -e "s|##MONGODB_URL|${MONGODB_URL}|"\ + -e "s/##MONGODB_DATABASE/${MONGODB_DATABASE}/"\ + -e "s/##MONGODB_USERNAME/${MONGODB_USERNAME}/"\ + -e "s/##MONGODB_PASSWORD/${MONGODB_PASSWORD}/"\ + -e "s/##MAIL_SMTP_USERNAME/${MAIL_SMTP_USERNAME}/"\ + -e "s/##MAIL_SMTP_PASSWORD/${MAIL_SMTP_PASSWORD}/"\ + -e "s/##MAIL_SMTP_SERVER/${MAIL_SMTP_SERVER}/"\ + -e "s/##MAIL_SMTP_PORT/${MAIL_SMTP_PORT}/"\ + -e "s/##MAIL_FROM/${MAIL_FROM}/"\ /app/code/config.template.yml > /run/authelia/config.yml # Create override config.yml file if not exists if [[ ! -f /app/data/config.yml ]]; then + cp /app/code/config.custom_template.yml > /app/data/config.yml echo "# Add additional customizations in this file" > /app/data/config.yml fi diff --git a/yaml-override.js b/yaml-override.js index 96190e1..122064c 100755 --- a/yaml-override.js +++ b/yaml-override.js @@ -5,7 +5,7 @@ var fs = require('fs'), yaml = require('yamljs'); -var target = yaml.load(fs.readFileSync(process.argv[2] ,'utf8')); -var source = yaml.load(fs.readFileSync(process.argv[3], 'utf8')); +var target = yaml.load(process.argv[2]); +var source = yaml.load(process.argv[3]); target = Object.assign(target, source); fs.writeFileSync(process.argv[2], yaml.dump(target));