Running, but untested
This commit is contained in:
parent
2f660829fb
commit
adb005b9e6
|
|
@ -9,8 +9,11 @@
|
|||
"healthCheckPath": "/",
|
||||
"httpPort": 3000,
|
||||
"addons": {
|
||||
"ldap": {},
|
||||
"localstorage": {},
|
||||
"ldap": {}
|
||||
"mongodb": {},
|
||||
"redis": {},
|
||||
"sendmail": {}
|
||||
},
|
||||
"manifestVersion": 1,
|
||||
"website": "https://www.authelia.com/",
|
||||
|
|
|
|||
|
|
@ -0,0 +1,94 @@
|
|||
############################################
|
||||
# Cloudron users
|
||||
#
|
||||
# Add additional customizations in this file.
|
||||
# Certain features, such as Access Control *must* be done in this file.
|
||||
############################################
|
||||
|
||||
|
||||
# Access Control
|
||||
#
|
||||
# Access control is a list of rules defining the authorizations applied for one
|
||||
# resource to users or group of users.
|
||||
#
|
||||
# If 'access_control' is not defined, ACL rules are disabled and the `bypass`
|
||||
# rule is applied, i.e., access is allowed to anyone. Otherwise restrictions follow
|
||||
# the rules defined.
|
||||
#
|
||||
# Note: One can use the wildcard * to match any subdomain.
|
||||
# It must stand at the beginning of the pattern. (example: *.mydomain.com)
|
||||
#
|
||||
# Note: You must put patterns containing wildcards between simple quotes for the YAML
|
||||
# to be syntaxically correct.
|
||||
#
|
||||
# Definition: A `rule` is an object with the following keys: `domain`, `subject`,
|
||||
# `policy` and `resources`.
|
||||
#
|
||||
# - `domain` defines which domain or set of domains the rule applies to.
|
||||
#
|
||||
# - `subject` defines the subject to apply authorizations to. This parameter is
|
||||
# optional and matching any user if not provided. If provided, the parameter
|
||||
# represents either a user or a group. It should be of the form 'user:<username>'
|
||||
# or 'group:<groupname>'.
|
||||
#
|
||||
# - `policy` is the policy to apply to resources. It must be either `bypass`,
|
||||
# `one_factor`, `two_factor` or `deny`.
|
||||
#
|
||||
# - `resources` is a list of regular expressions that matches a set of resources to
|
||||
# apply the policy to. This parameter is optional and matches any resource if not
|
||||
# provided.
|
||||
#
|
||||
# Note: the order of the rules is important. The first policy matching
|
||||
# (domain, resource, subject) applies.
|
||||
access_control:
|
||||
# Default policy can either be `bypass`, `one_factor`, `two_factor` or `deny`.
|
||||
# It is the policy applied to any resource if there is no policy to be applied
|
||||
# to the user.
|
||||
default_policy: deny
|
||||
|
||||
rules:
|
||||
# Rules applied to everyone
|
||||
- domain: public.example.com
|
||||
policy: two_factor
|
||||
- domain: single_factor.example.com
|
||||
policy: one_factor
|
||||
|
||||
# Rules applied to 'admin' group
|
||||
- domain: 'mx2.mail.example.com'
|
||||
subject: 'group:admin'
|
||||
policy: deny
|
||||
- domain: '*.example.com'
|
||||
subject: 'group:admin'
|
||||
policy: two_factor
|
||||
|
||||
# Rules applied to 'dev' group
|
||||
- domain: dev.example.com
|
||||
resources:
|
||||
- '^/groups/dev/.*$'
|
||||
subject: 'group:dev'
|
||||
policy: two_factor
|
||||
|
||||
# Rules applied to user 'john'
|
||||
- domain: dev.example.com
|
||||
resources:
|
||||
- '^/users/john/.*$'
|
||||
subject: 'user:john'
|
||||
policy: two_factor
|
||||
|
||||
|
||||
# Rules applied to user 'harry'
|
||||
- domain: dev.example.com
|
||||
resources:
|
||||
- '^/users/harry/.*$'
|
||||
subject: 'user:harry'
|
||||
policy: two_factor
|
||||
|
||||
# Rules applied to user 'bob'
|
||||
- domain: '*.mail.example.com'
|
||||
subject: 'user:bob'
|
||||
policy: two_factor
|
||||
- domain: 'dev.example.com'
|
||||
resources:
|
||||
- '^/users/bob/.*$'
|
||||
subject: 'user:bob'
|
||||
policy: two_factor
|
||||
|
|
@ -27,7 +27,7 @@ default_redirection_url: ##DEFAULT_REDIRECT_URL
|
|||
# This will be the issuer name displayed in Google Authenticator
|
||||
# See: https://github.com/google/google-authenticator/wiki/Key-Uri-Format for more info on issuer names
|
||||
totp:
|
||||
issuer: ##TOTP_ISSUER
|
||||
issuer: ##APP_DOMAIN
|
||||
|
||||
# The authentication backend to use for verifying user passwords
|
||||
# and retrieve information such as email address and groups
|
||||
|
|
@ -45,10 +45,11 @@ authentication_backend:
|
|||
url: ##LDAP_URL
|
||||
|
||||
# The base dn for every entries
|
||||
base_dn: ''
|
||||
base_dn: dc=cloudron
|
||||
|
||||
# An additional dn to define the scope to all users
|
||||
additional_users_dn: ##LDAP_USERS_BASE_DN
|
||||
# additional_users_dn: ##LDAP_USERS_BASE_DN
|
||||
additional_users_dn: ou=users
|
||||
|
||||
# The users filter used to find the user DN
|
||||
# {0} is a matcher replaced by username.
|
||||
|
|
@ -56,13 +57,15 @@ authentication_backend:
|
|||
users_filter: (&(objectclass=user)(|(username={0})(mail={0})))
|
||||
|
||||
# An additional dn to define the scope of groups
|
||||
additional_groups_dn: ##LDAP_GROUPS_BASE_DN
|
||||
# additional_groups_dn: ##LDAP_GROUPS_BASE_DN
|
||||
additional_groups_dn: ou=groups
|
||||
|
||||
# The groups filter used for retrieving groups of a given user.
|
||||
# {0} is a matcher replaced by username.
|
||||
# {dn} is a matcher replaced by user DN.
|
||||
# {uid} is a matcher replaced by user uid.
|
||||
# 'member={dn}' by default.
|
||||
groups_filter: (&(member={dn})(objectclass=groupOfNames))
|
||||
groups_filter: (&(memberuid={uid})(objectclass=group))
|
||||
|
||||
# The attribute holding the name of the group
|
||||
group_name_attribute: cn
|
||||
|
|
@ -74,104 +77,9 @@ authentication_backend:
|
|||
user: ##LDAP_BIND_DN
|
||||
password: ##LDAP_BIND_PASSWORD
|
||||
|
||||
# File backend configuration.
|
||||
#
|
||||
# With this backend, the users database is stored in a file
|
||||
# which is updated when users reset their passwords.
|
||||
# Therefore, this backend is meant to be used in a dev environment
|
||||
# and not in production since it prevents Authelia to be scaled to
|
||||
# more than one instance.
|
||||
#
|
||||
## file:
|
||||
## path: ./users_database.yml
|
||||
|
||||
|
||||
# Access Control
|
||||
#
|
||||
# Access control is a list of rules defining the authorizations applied for one
|
||||
# resource to users or group of users.
|
||||
#
|
||||
# If 'access_control' is not defined, ACL rules are disabled and the `bypass`
|
||||
# rule is applied, i.e., access is allowed to anyone. Otherwise restrictions follow
|
||||
# the rules defined.
|
||||
#
|
||||
# Note: One can use the wildcard * to match any subdomain.
|
||||
# It must stand at the beginning of the pattern. (example: *.mydomain.com)
|
||||
#
|
||||
# Note: You must put patterns containing wildcards between simple quotes for the YAML
|
||||
# to be syntaxically correct.
|
||||
#
|
||||
# Definition: A `rule` is an object with the following keys: `domain`, `subject`,
|
||||
# `policy` and `resources`.
|
||||
#
|
||||
# - `domain` defines which domain or set of domains the rule applies to.
|
||||
#
|
||||
# - `subject` defines the subject to apply authorizations to. This parameter is
|
||||
# optional and matching any user if not provided. If provided, the parameter
|
||||
# represents either a user or a group. It should be of the form 'user:<username>'
|
||||
# or 'group:<groupname>'.
|
||||
#
|
||||
# - `policy` is the policy to apply to resources. It must be either `bypass`,
|
||||
# `one_factor`, `two_factor` or `deny`.
|
||||
#
|
||||
# - `resources` is a list of regular expressions that matches a set of resources to
|
||||
# apply the policy to. This parameter is optional and matches any resource if not
|
||||
# provided.
|
||||
#
|
||||
# Note: the order of the rules is important. The first policy matching
|
||||
# (domain, resource, subject) applies.
|
||||
access_control:
|
||||
# Default policy can either be `bypass`, `one_factor`, `two_factor` or `deny`.
|
||||
# It is the policy applied to any resource if there is no policy to be applied
|
||||
# to the user.
|
||||
default_policy: deny
|
||||
|
||||
rules:
|
||||
# Rules applied to everyone
|
||||
- domain: public.example.com
|
||||
policy: two_factor
|
||||
- domain: single_factor.example.com
|
||||
policy: one_factor
|
||||
|
||||
# Rules applied to 'admin' group
|
||||
- domain: 'mx2.mail.example.com'
|
||||
subject: 'group:admin'
|
||||
policy: deny
|
||||
- domain: '*.example.com'
|
||||
subject: 'group:admin'
|
||||
policy: two_factor
|
||||
|
||||
# Rules applied to 'dev' group
|
||||
- domain: dev.example.com
|
||||
resources:
|
||||
- '^/groups/dev/.*$'
|
||||
subject: 'group:dev'
|
||||
policy: two_factor
|
||||
|
||||
# Rules applied to user 'john'
|
||||
- domain: dev.example.com
|
||||
resources:
|
||||
- '^/users/john/.*$'
|
||||
subject: 'user:john'
|
||||
policy: two_factor
|
||||
|
||||
|
||||
# Rules applied to user 'harry'
|
||||
- domain: dev.example.com
|
||||
resources:
|
||||
- '^/users/harry/.*$'
|
||||
subject: 'user:harry'
|
||||
policy: two_factor
|
||||
|
||||
# Rules applied to user 'bob'
|
||||
- domain: '*.mail.example.com'
|
||||
subject: 'user:bob'
|
||||
policy: two_factor
|
||||
- domain: 'dev.example.com'
|
||||
resources:
|
||||
- '^/users/bob/.*$'
|
||||
subject: 'user:bob'
|
||||
policy: two_factor
|
||||
# Access Control must be customized in /app/data/config.yml
|
||||
# access_control:
|
||||
|
||||
|
||||
# Configuration of session cookies
|
||||
|
|
@ -182,7 +90,7 @@ session:
|
|||
name: authelia_session
|
||||
|
||||
# The secret to encrypt the session cookie.
|
||||
secret: unsecure_session_secret
|
||||
secret: ##SESSION_SECRET
|
||||
|
||||
# The time in ms before the cookie expires and session is reset.
|
||||
expiration: 3600000 # 1 hour
|
||||
|
|
@ -193,13 +101,13 @@ session:
|
|||
# The domain to protect.
|
||||
# Note: the authenticator must also be in that domain. If empty, the cookie
|
||||
# is restricted to the subdomain of the issuer.
|
||||
domain: example.com
|
||||
domain: ##APP_DOMAIN
|
||||
|
||||
# The redis connection details
|
||||
redis:
|
||||
host: redis
|
||||
port: 6379
|
||||
password: authelia
|
||||
host: ##REDIS_HOST
|
||||
port: ##REDIS_PORT
|
||||
password: ##REDIS_PASSWORD
|
||||
|
||||
# Configuration of the authentication regulation mechanism.
|
||||
#
|
||||
|
|
@ -222,17 +130,13 @@ regulation:
|
|||
#
|
||||
# You must use only an available configuration: local, mongo
|
||||
storage:
|
||||
# The directory where the DB files will be saved
|
||||
## local:
|
||||
## path: /var/lib/authelia/store
|
||||
|
||||
# Settings to connect to mongo server
|
||||
mongo:
|
||||
url: mongodb://mongo
|
||||
database: authelia
|
||||
url: ##MONGODB_URL
|
||||
database: ##MONGODB_DATABASE
|
||||
auth:
|
||||
username: authelia
|
||||
password: authelia
|
||||
username: ##MONGODB_USERNAME
|
||||
password: ##MONGODB_PASSWORD
|
||||
|
||||
# Configuration of the notification system.
|
||||
#
|
||||
|
|
@ -240,23 +144,11 @@ storage:
|
|||
# registration or a TOTP registration.
|
||||
# Use only an available configuration: filesystem, gmail
|
||||
notifier:
|
||||
# For testing purpose, notifications can be sent in a file
|
||||
## filesystem:
|
||||
## filename: /tmp/authelia/notification.txt
|
||||
|
||||
# Use your email account to send the notifications. You can use an app password.
|
||||
# List of valid services can be found here: https://nodemailer.com/smtp/well-known/
|
||||
## email:
|
||||
## username: user@example.com
|
||||
## password: yourpassword
|
||||
## sender: admin@example.com
|
||||
## service: gmail
|
||||
|
||||
# Use a SMTP server for sending notifications
|
||||
smtp:
|
||||
username: test
|
||||
password: password
|
||||
username: ##MAIL_SMTP_USERNAME
|
||||
password: ##MAIL_SMTP_PASSWORD
|
||||
secure: false
|
||||
host: 'smtp'
|
||||
port: 1025
|
||||
sender: admin@example.com
|
||||
host: ##MAIL_SMTP_SERVER
|
||||
port: ##MAIL_SMTP_PORT
|
||||
sender: ##MAIL_FROM
|
||||
|
|
|
|||
27
start.sh
27
start.sh
|
|
@ -4,18 +4,39 @@ set -eu
|
|||
|
||||
mkdir -p /run/authelia
|
||||
|
||||
# Generate session secret if it doesn't exist
|
||||
if [[ ! -f /app/data/session_secret ]]; then
|
||||
pwgen -1 -s > /app/data/session_secret
|
||||
fi
|
||||
SESSION_SECRET=$(cat /app/data/session_secret)
|
||||
|
||||
# Generate base config from template
|
||||
sed -e "s/##DEFAULT_REDIRECT_URL/${REDIRECT_URL}/" \
|
||||
-e "s/##TOTP_ISSUER/${}/"\
|
||||
-e "s/##LDAP_URL/${LDAP_URL}/"\
|
||||
sed -e "s|##DEFAULT_REDIRECT_URL|${WEBADMIN_ORIGIN}|" \
|
||||
-e "s|##LDAP_URL|${LDAP_URL}|"\
|
||||
-e "s/##LDAP_USERS_BASE_DN/${LDAP_USERS_BASE_DN}/"\
|
||||
-e "s/##LDAP_GROUPS_BASE_DN/${LDAP_GROUPS_BASE_DN}/"\
|
||||
-e "s/##LDAP_BIND_DN/${LDAP_BIND_DN}/"\
|
||||
-e "s/##LDAP_BIND_PASSWORD/${LDAP_BIND_PASSWORD}/"\
|
||||
-e "s/##SESSION_SECRET/${SESSION_SECRET}/"\
|
||||
-e "s/##APP_DOMAIN/${APP_DOMAIN}/"\
|
||||
-e "s|##APP_ORIGIN|${APP_ORIGIN}|"\
|
||||
-e "s/##REDIS_HOST/${REDIS_HOST}/"\
|
||||
-e "s/##REDIS_PORT/${REDIS_PORT}/"\
|
||||
-e "s/##REDIS_PASSWORD/${REDIS_PASSWORD}/"\
|
||||
-e "s|##MONGODB_URL|${MONGODB_URL}|"\
|
||||
-e "s/##MONGODB_DATABASE/${MONGODB_DATABASE}/"\
|
||||
-e "s/##MONGODB_USERNAME/${MONGODB_USERNAME}/"\
|
||||
-e "s/##MONGODB_PASSWORD/${MONGODB_PASSWORD}/"\
|
||||
-e "s/##MAIL_SMTP_USERNAME/${MAIL_SMTP_USERNAME}/"\
|
||||
-e "s/##MAIL_SMTP_PASSWORD/${MAIL_SMTP_PASSWORD}/"\
|
||||
-e "s/##MAIL_SMTP_SERVER/${MAIL_SMTP_SERVER}/"\
|
||||
-e "s/##MAIL_SMTP_PORT/${MAIL_SMTP_PORT}/"\
|
||||
-e "s/##MAIL_FROM/${MAIL_FROM}/"\
|
||||
/app/code/config.template.yml > /run/authelia/config.yml
|
||||
|
||||
# Create override config.yml file if not exists
|
||||
if [[ ! -f /app/data/config.yml ]]; then
|
||||
cp /app/code/config.custom_template.yml > /app/data/config.yml
|
||||
echo "# Add additional customizations in this file" > /app/data/config.yml
|
||||
fi
|
||||
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
var fs = require('fs'),
|
||||
yaml = require('yamljs');
|
||||
|
||||
var target = yaml.load(fs.readFileSync(process.argv[2] ,'utf8'));
|
||||
var source = yaml.load(fs.readFileSync(process.argv[3], 'utf8'));
|
||||
var target = yaml.load(process.argv[2]);
|
||||
var source = yaml.load(process.argv[3]);
|
||||
target = Object.assign(target, source);
|
||||
fs.writeFileSync(process.argv[2], yaml.dump(target));
|
||||
|
|
|
|||
Loading…
Reference in New Issue