WIP: Support for authelia

.secrets-baseline

@@ -211,7 +211,97 @@
         "line_number": 159,
         "is_secret": false
       }
+    ],
+    "services/authelia.yml": [
+      {
+        "type": "Secret Keyword",
+        "filename": "services/authelia.yml",
+        "hashed_secret": "d16a67474cca598880e37d64557f1264586386bd",
+        "is_verified": false,
+        "line_number": 18,
+        "is_secret": false
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "services/authelia.yml",
+        "hashed_secret": "1d8c6259d656cf71d6f60fe5577be56d8546e324",
+        "is_verified": false,
+        "line_number": 19,
+        "is_secret": false
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "services/authelia.yml",
+        "hashed_secret": "07d80ed2f78aa8ce991060b176dfb44232c2b755",
+        "is_verified": false,
+        "line_number": 186,
+        "is_secret": false
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "services/authelia.yml",
+        "hashed_secret": "7cb6efb98ba5972a9b5090dc2e517fe14d12cb04",
+        "is_verified": false,
+        "line_number": 220,
+        "is_secret": false
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "services/authelia.yml",
+        "hashed_secret": "67826082ce8df739f6a99f14c51b590c54e23647",
+        "is_verified": false,
+        "line_number": 535,
+        "is_secret": false
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "services/authelia.yml",
+        "hashed_secret": "a32b08d97b1615dc27f58b6b17f67624c04e2c4f",
+        "is_verified": false,
+        "line_number": 569,
+        "is_secret": false
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "services/authelia.yml",
+        "hashed_secret": "be721ee537c54e5514543649a6781308db765290",
+        "is_verified": false,
+        "line_number": 603,
+        "is_secret": false
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "services/authelia.yml",
+        "hashed_secret": "91dfd9ddb4198affc5c194cd8ce6d338fde470e2",
+        "is_verified": false,
+        "line_number": 667,
+        "is_secret": false
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "services/authelia.yml",
+        "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
+        "is_verified": false,
+        "line_number": 730,
+        "is_secret": false
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "services/authelia.yml",
+        "hashed_secret": "7e1f5e63ab2c1f926e5fb81cc004dc24af411376",
+        "is_verified": false,
+        "line_number": 778,
+        "is_secret": false
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "services/authelia.yml",
+        "hashed_secret": "0bb90d739912b79b54b811fec298da9f59008a26",
+        "is_verified": false,
+        "line_number": 833,
+        "is_secret": false
+      }
     ]
   },
-  "generated_at": "2022-11-11T21:26:53Z"
+  "generated_at": "2022-11-15T19:42:58Z"
 }

core/lldap.nomad

@@ -25,7 +25,7 @@ job "lldap" {
     }
 
     service {
-      name = "lldap"
+      name = "ldap"
       port = "ldap"
 
       connect {
@@ -92,6 +92,13 @@ job "lldap" {
           source = "secrets/lldap_config.toml"
           target = "/lldap_config.toml"
         }
+
+      }
+
+      env = {
+        "LLDAP_VERBOSE" = "true"
+        "LLDAP_LDAP_PORT" = "${NOMAD_PORT_ldap}"
+        "LLDAP_HTTP_PORT" = "${NOMAD_PORT_web}"
       }
 
       vault {

core/main.tf

@@ -134,3 +134,19 @@ resource "consul_config_entry" "global_access" {
     ]
   })
 }
+
+resource "consul_config_entry" "ldap_intents" {
+  name = "ldap"
+  kind = "service-intentions"
+
+  config_json = jsonencode({
+    Sources = [
+      {
+        Action     = "allow"
+        Name       = "authelia"
+        Precedence = 9
+        Type       = "consul"
+      },
+    ]
+  })
+}

databases/mysql.tf

@@ -60,6 +60,12 @@ resource "consul_config_entry" "mysql_intents" {
         Precedence = 9
         Type       = "consul"
       },
+      {
+        Action     = "allow"
+        Name       = "authelia"
+        Precedence = 9
+        Type       = "consul"
+      },
     ]
   })
 }

services/authelia.nomad

@@ -0,0 +1,113 @@
+variable "config_data" {
+  type = string
+  description = "Authelia YAML config"
+}
+
+job "authelia" {
+  datacenters = ["dc1"]
+
+  type = "service"
+
+  group "authelia" {
+    count = 1
+
+    network  {
+      mode = "bridge"
+
+      port "main" {
+        host_network = "loopback"
+        to = 9091
+      }
+
+      port "metrics" {
+        to = 9959
+      }
+    }
+
+    service {
+      name = "authelia"
+      port = "main"
+
+      meta {
+        metrics_addr = "${NOMAD_ADDR_metrics}"
+      }
+
+      connect {
+        sidecar_service {
+          proxy {
+            local_service_port = 9091
+
+            expose {
+              path {
+                path = "/metrics"
+                protocol = "http"
+                local_path_port = 9959
+                listener_port = "metrics"
+              }
+            }
+
+            upstreams {
+              destination_name = "ldap"
+              local_bind_port = 4820
+            }
+
+            upstreams {
+              destination_name = "redis"
+              local_bind_port = 6379
+            }
+          }
+        }
+
+        sidecar_task {
+          resources {
+            cpu    = 50
+            memory = 50
+          }
+        }
+      }
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.http.middlewares.authelia.forwardAuth.address=http://authelia.service.consul/api/verify?rd=https%3A%2F%2Fauthelia.thefij.rocks%2F",
+        "traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader=true",
+        "traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email",
+        "traefik.http.middlewares.authelia-basic.forwardAuth.address=http://authelia.service.consul/api/verify?auth=basic",
+        "traefik.http.middlewares.authelia-basic.forwardAuth.trustForwardHeader=true",
+        "traefik.http.middlewares.authelia-basic.forwardAuth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email",
+      ]
+    }
+
+    task "authelia" {
+      driver = "docker"
+
+      config {
+        image = "authelia/authelia"
+
+        ports = ["main"]
+
+        mount {
+          type = "bind"
+          target = "/config"
+          source = "config"
+        }
+      }
+
+      vault {
+        policies = [
+          "access-tables",
+          "nomad-task",
+        ]
+      }
+
+      template {
+        data = var.config_data
+        destination = "/config/configuration.yml"
+      }
+
+      resources {
+        cpu = 50
+        memory = 50
+      }
+    }
+  }
+}

services/authelia.tf

@@ -0,0 +1,54 @@
+module "authelia" {
+  source = "./service"
+
+  name         = "authelia"
+  image        = "authelia/authelia:latest"
+  service_port = 9091
+  ports = [
+    {
+      name = "metrics"
+    }
+  ]
+  metrics_port_name = "metrics"
+
+  templates = [
+    {
+      data        = file("${path.module}/authelia.yml")
+      dest_prefix = "local/"
+      dest        = "/config/configuration.yml"
+    },
+  ]
+
+  service_tags = [
+    "traefik.http.middlewares.authelia.forwardAuth.address=http://authelia.service.consul/api/verify?rd=https%3A%2F%2Fauthelia.thefij.rocks%2F",
+    "traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader=true",
+    "traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email",
+    "traefik.http.middlewares.authelia-basic.forwardAuth.address=http://authelia.service.consul/api/verify?auth=basic",
+    "traefik.http.middlewares.authelia-basic.forwardAuth.trustForwardHeader=true",
+    "traefik.http.middlewares.authelia-basic.forwardAuth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email",
+  ]
+
+  use_vault = true
+  use_ldap  = true
+  use_redis = true
+  use_mysql = true
+}
+
+# locals {
+#   authelia_config = templatefile(
+#     "${path.module}/authelia.yml",
+#     {
+#     }
+#   )
+# }
+
+# resource "nomad_job" "authelia" {
+#   hcl2 {
+#     enabled = true
+#     vars = {
+#       config_data = "${local.authelia_config}",
+#     }
+#   }
+#
+#   jobspec = file("${path.module}/authelia.nomad")
+# }

services/authelia.yml

@@ -0,0 +1,883 @@
+# yamllint disable rule:comments-indentation
+---
+###############################################################################
+#                           Authelia Configuration                            #
+###############################################################################
+
+## Note: the container by default expects to find this file at /config/configuration.yml.
+
+## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to
+## the system certificates store.
+## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem.
+# certificates_directory: /config/certificates/
+
+## The theme to display: light, dark, grey, auto.
+theme: auto
+
+## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be
+## set using a secret: https://www.authelia.com/c/secrets
+jwt_secret: a_very_important_secret
+
+## Default redirection URL
+##
+## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end
+## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use
+## in such a case.
+##
+## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
+default_redirection_url: https://home.example.com/
+
+## Set the default 2FA method for new users and for when a user has a preferred method configured that has been
+## disabled. This setting must be a method that is enabled.
+## Options are totp, webauthn, mobile_push.
+default_2fa_method: ""
+
+##
+## Server Configuration
+##
+server:
+
+  ## The address to listen on.
+  host: 0.0.0.0
+
+  ## The port to listen on.
+  port: 9091
+
+  ## Set the single level path Authelia listens on.
+  ## Must be alphanumeric chars and should not contain any slashes.
+  path: ""
+
+  ## Set the path on disk to Authelia assets.
+  ## Useful to allow overriding of specific static assets.
+  # asset_path: /config/assets/
+
+  ## Buffers usually should be configured to be the same value.
+  ## Explanation at https://www.authelia.com/c/server#buffer-sizes
+  ## Read buffer size adjusts the server's max incoming request size in bytes.
+  ## Write buffer size does the same for outgoing responses.
+  read_buffer_size: 4096
+  write_buffer_size: 4096
+
+  ## Enables the pprof endpoint.
+  enable_pprof: false
+
+  ## Enables the expvars endpoint.
+  enable_expvars: false
+
+  ## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0.
+  ## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist.
+  disable_healthcheck: false
+
+  ## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour.
+  tls:
+    ## The path to the DER base64/PEM format private key.
+    key: ""
+
+    ## The path to the DER base64/PEM format public certificate.
+    certificate: ""
+
+    ## The list of certificates for client authentication.
+    client_certificates: []
+
+  ## Server headers configuration/customization.
+  headers:
+
+    ## The CSP Template. Read the docs.
+    csp_template: ""
+
+##
+## Log Configuration
+##
+log:
+  ## Level of verbosity for logs: info, debug, trace.
+  level: debug
+
+  ## Format the logs are written as: json, text.
+  # format: json
+
+  ## File path where the logs will be written. If not set logs are written to stdout.
+  # file_path: /config/authelia.log
+
+  ## Whether to also log to stdout when a log_file_path is defined.
+  # keep_stdout: false
+
+##
+## Telemetry Configuration
+##
+telemetry:
+
+  ##
+  ## Metrics Configuration
+  ##
+  metrics:
+    ## Enable Metrics.
+    enabled: true
+
+    ## The address to listen on for metrics. This should be on a different port to the main server.port value.
+    address: '0.0.0.0:{{ env "NOMAD_PORT_metrics" }}'
+
+##
+## TOTP Configuration
+##
+## Parameters used for TOTP generation.
+totp:
+  ## Disable TOTP.
+  disable: false
+
+  ## The issuer name displayed in the Authenticator application of your choice.
+  issuer: authelia.com
+
+  ## The TOTP algorithm to use.
+  ## It is CRITICAL you read the documentation before changing this option:
+  ## https://www.authelia.com/c/totp#algorithm
+  algorithm: sha1
+
+  ## The number of digits a user has to input. Must either be 6 or 8.
+  ## Changing this option only affects newly generated TOTP configurations.
+  ## It is CRITICAL you read the documentation before changing this option:
+  ## https://www.authelia.com/c/totp#digits
+  digits: 6
+
+  ## The period in seconds a one-time password is valid for.
+  ## Changing this option only affects newly generated TOTP configurations.
+  period: 30
+
+  ## The skew controls number of one-time passwords either side of the current one that are valid.
+  ## Warning: before changing skew read the docs link below.
+  skew: 1
+  ## See: https://www.authelia.com/c/totp#input-validation to read
+  ## the documentation.
+
+  ## The size of the generated shared secrets. Default is 32 and is sufficient in most use cases, minimum is 20.
+  secret_size: 32
+
+##
+## WebAuthn Configuration
+##
+## Parameters used for WebAuthn.
+webauthn:
+  ## Disable Webauthn.
+  disable: false
+
+  ## Adjust the interaction timeout for Webauthn dialogues.
+  timeout: 60s
+
+  ## The display name the browser should show the user for when using Webauthn to login/register.
+  display_name: Authelia
+
+  ## Conveyance preference controls if we collect the attestation statement including the AAGUID from the device.
+  ## Options are none, indirect, direct.
+  attestation_conveyance_preference: indirect
+
+  ## User verification controls if the user must make a gesture or action to confirm they are present.
+  ## Options are required, preferred, discouraged.
+  user_verification: preferred
+
+##
+## Duo Push API Configuration
+##
+## Parameters used to contact the Duo API. Those are generated when you protect an application of type
+## "Partner Auth API" in the management panel.
+duo_api:
+  disable: false
+  hostname: api-123456789.example.com
+  integration_key: ABCDEF
+  ## Secret can also be set using a secret: https://www.authelia.com/c/secrets
+  secret_key: 1234567890abcdefghifjkl
+  enable_self_enrollment: false
+
+##
+## NTP Configuration
+##
+## This is used to validate the servers time is accurate enough to validate TOTP.
+ntp:
+  ## NTP server address.
+  address: "time.cloudflare.com:123"
+
+  ## NTP version.
+  version: 4
+
+  ## Maximum allowed time offset between the host and the NTP server.
+  max_desync: 3s
+
+  ## Disables the NTP check on startup entirely. This means Authelia will not contact a remote service at all if you
+  ## set this to true, and can operate in a truly offline mode.
+  disable_startup_check: false
+
+  ## The default of false will prevent startup only if we can contact the NTP server and the time is out of sync with
+  ## the NTP server more than the configured max_desync. If you set this to true, an error will be logged but startup
+  ## will continue regardless of results.
+  disable_failure: false
+
+##
+## Authentication Backend Provider Configuration
+##
+## Used for verifying user passwords and retrieve information such as email address and groups users belong to.
+##
+## The available providers are: `file`, `ldap`. You must use only one of these providers.
+authentication_backend:
+  ## Disable both the HTML element and the API for reset password functionality.
+  disable_reset_password: false
+
+  ## Password Reset Options.
+  password_reset:
+
+    ## External reset password url that redirects the user to an external reset portal. This disables the internal reset
+    ## functionality.
+    custom_url: ""
+
+  ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation.
+  ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
+  ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
+  ## To force update on every request you can set this to '0' or 'always', this will increase processor demand.
+  ## See the below documentation for more information.
+  ## Duration Notation docs:  https://www.authelia.com/c/common#duration-notation-format
+  ## Refresh Interval docs: https://www.authelia.com/c/1fa#refresh-interval
+  refresh_interval: 5m
+
+  ##
+  ## LDAP (Authentication Provider)
+  ##
+  ## This is the recommended Authentication Provider in production
+  ## because it allows Authelia to offload the stateful operations
+  ## onto the LDAP service.
+  ldap:
+    ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
+    ## Acceptable options are as follows:
+    ## - 'activedirectory' - For Microsoft Active Directory.
+    ## - 'custom' - For custom specifications of attributes and filters.
+    ## This currently defaults to 'custom' to maintain existing behaviour.
+    ##
+    ## Depending on the option here certain other values in this section have a default value, notably all of the
+    ## attribute mappings have a default value that this config overrides, you can read more about these default values
+    ## at https://www.authelia.com/c/ldap#defaults
+    implementation: custom
+
+    ## The url to the ldap server. Format: <scheme>://<address>[:<port>].
+    ## Scheme can be ldap or ldaps in the format (port optional).
+    url: ldap://{{ env "NOMAD_UPSTREAM_ADDR_ldap" }}
+
+    ## The dial timeout for LDAP.
+    timeout: 5s
+
+    ## Use StartTLS with the LDAP connection.
+    start_tls: false
+
+    # tls:
+    #   ## Server Name for certificate validation (in case it's not set correctly in the URL).
+    #   # server_name: ldap.example.com
+    #
+    #   ## Skip verifying the server certificate (to allow a self-signed certificate).
+    #   ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
+    #   ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
+    #   skip_verify: false
+    #
+    #   ## Minimum TLS version for either Secure LDAP or LDAP StartTLS.
+    #   minimum_version: TLS1.2
+
+    ## The distinguished name of the container searched for objects in the directory information tree.
+    ## See also: additional_users_dn, additional_groups_dn.
+    base_dn: {{ keyOrDefault "global/ldap/base_dn" "dc=example,dc=com" }}
+
+    ## The attribute holding the username of the user. This attribute is used to populate the username in the session
+    ## information. It was introduced due to #561 to handle case insensitive search queries. For you information,
+    ## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this
+    ## attribute holds the unique identifiers for the users binding the user and the configuration stored in database.
+    ## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user
+    ## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also
+    ## be used but we don't recommend using them, we instead advise to use the attributes mentioned above
+    ## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt.
+    username_attribute: uid
+
+    ## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users.
+    ## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users.
+    additional_users_dn: ou=people
+
+    ## The users filter used in search queries to find the user profile based on input filled in login form.
+    ## Various placeholders are available in the user filter which you can read about in the documentation which can
+    ## be found at: https://www.authelia.com/c/ldap#users-filter-replacements
+    ##
+    ## Recommended settings are as follows:
+    ## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
+    ## - OpenLDAP:
+    ##   - (&({username_attribute}={input})(objectClass=person))
+    ##   - (&({username_attribute}={input})(objectClass=inetOrgPerson))
+    ##
+    ## To allow sign in both with username and email, one can use a filter like
+    ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
+    users_filter: (&({username_attribute}={input})(objectClass=person))
+
+    ## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups.
+    ## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups.
+    additional_groups_dn: ou=groups
+
+    ## The groups filter used in search queries to find the groups based on relevant authenticated user.
+    ## Various placeholders are available in the groups filter which you can read about in the documentation which can
+    ## be found at: https://www.authelia.com/c/ldap#groups-filter-replacements
+    ##
+    ## If your groups use the `groupOfUniqueNames` structure use this instead:
+    ##    (&(uniqueMember={dn})(objectClass=groupOfUniqueNames))
+    groups_filter: (member={dn})
+
+    ## The attribute holding the name of the group.
+    group_name_attribute: cn
+
+    ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
+    ## first one returned by the LDAP server is used.
+    mail_attribute: mail
+
+    ## The attribute holding the display name of the user. This will be used to greet an authenticated user.
+    display_name_attribute: displayName
+
+    ## Follow referrals returned by the server.
+    ## This is especially useful for environments where read-only servers exist. Only implemented for write operations.
+    # permit_referrals: false
+
+    ## The username and password of the admin user.
+    {{ with secret "kv/data/lldap" }}
+    user: {{ .Data.data.admin_user }}
+    ## Password can also be set using a secret: https://www.authelia.com/c/secrets
+    password: {{ .Data.data.admin_password }}
+    {{ end -}}
+
+  ##
+  ## File (Authentication Provider)
+  ##
+  ## With this backend, the users database is stored in a file which is updated when users reset their passwords.
+  ## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia
+  ## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security
+  ## implications it is highly recommended you leave the default values. Before considering changing these settings
+  ## please read the docs page below:
+  ## https://www.authelia.com/r/passwords#tuning
+  ##
+  ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
+  ##
+  # file:
+  #   path: /config/users_database.yml
+  #   password:
+  #     algorithm: argon2id
+  #     iterations: 1
+  #     key_length: 32
+  #     salt_length: 16
+  #     memory: 1024
+  #     parallelism: 8
+
+##
+## Password Policy Configuration.
+##
+password_policy:
+
+  ## The standard policy allows you to tune individual settings manually.
+  standard:
+    enabled: false
+
+    ## Require a minimum length for passwords.
+    min_length: 8
+
+    ## Require a maximum length for passwords.
+    max_length: 0
+
+    ## Require uppercase characters.
+    require_uppercase: true
+
+    ## Require lowercase characters.
+    require_lowercase: true
+
+    ## Require numeric characters.
+    require_number: true
+
+    ## Require special characters.
+    require_special: true
+
+  ## zxcvbn is a well known and used password strength algorithm. It does not have tunable settings.
+  zxcvbn:
+    enabled: false
+
+    ## Configures the minimum score allowed.
+    min_score: 3
+
+##
+## Access Control Configuration
+##
+## Access control is a list of rules defining the authorizations applied for one resource to users or group of users.
+##
+## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed
+## to anyone. Otherwise restrictions follow the rules defined.
+##
+## Note: One can use the wildcard * to match any subdomain.
+## It must stand at the beginning of the pattern. (example: *.mydomain.com)
+##
+## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct.
+##
+## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'.
+##
+## - 'domain' defines which domain or set of domains the rule applies to.
+##
+## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not
+##    provided. If provided, the parameter represents either a user or a group. It should be of the form
+##    'user:<username>' or 'group:<groupname>'.
+##
+## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'.
+##
+## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter
+##   is optional and matches any resource if not provided.
+##
+## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies.
+access_control:
+  ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
+  ## resource if there is no policy to be applied to the user.
+  default_policy: deny
+
+  networks:
+    - name: internal
+      networks:
+        - 10.10.0.0/16
+        - 192.168.2.0/24
+    - name: VPN
+      networks: 10.9.0.0/16
+
+  rules:
+    ## Rules applied to everyone
+    - domain: 'public.example.com'
+      policy: bypass
+
+    ## Domain Regex examples. Generally we recommend just using a standard domain.
+    # - domain_regex: '^(?P<User>\w+)\.example\.com$'
+    #   policy: one_factor
+    # - domain_regex: '^(?P<Group>\w+)\.example\.com$'
+    #   policy: one_factor
+    # - domain_regex:
+    #    - '^appgroup-.*\.example\.com$'
+    #    - '^appgroup2-.*\.example\.com$'
+    #   policy: one_factor
+    # - domain_regex: '^.*\.example\.com$'
+    #   policy: two_factor
+
+    - domain: 'secure.example.com'
+      policy: one_factor
+      ## Network based rule, if not provided any network matches.
+      networks:
+        - internal
+        - VPN
+        - 192.168.1.0/24
+        - 10.0.0.1
+
+    - domain:
+        - 'secure.example.com'
+        - 'private.example.com'
+      policy: two_factor
+
+    - domain: 'singlefactor.example.com'
+      policy: one_factor
+
+    ## Rules applied to 'admins' group
+    - domain: 'mx2.mail.example.com'
+      subject: 'group:admins'
+      policy: deny
+
+    - domain: '*.example.com'
+      subject:
+        - 'group:admins'
+        - 'group:moderators'
+      policy: two_factor
+
+    ## Rules applied to 'dev' group
+    - domain: 'dev.example.com'
+      resources:
+        - '^/groups/dev/.*$'
+      subject: 'group:dev'
+      policy: two_factor
+
+    ## Rules applied to user 'john'
+    - domain: 'dev.example.com'
+      resources:
+        - '^/users/john/.*$'
+      subject: 'user:john'
+      policy: two_factor
+
+    ## Rules applied to user 'harry'
+    - domain: 'dev.example.com'
+      resources:
+        - '^/users/harry/.*$'
+      subject: 'user:harry'
+      policy: two_factor
+
+    ## Rules applied to user 'bob'
+    - domain: '*.mail.example.com'
+      subject: 'user:bob'
+      policy: two_factor
+    - domain: 'dev.example.com'
+      resources:
+        - '^/users/bob/.*$'
+      subject: 'user:bob'
+      policy: two_factor
+
+##
+## Session Provider Configuration
+##
+## The session cookies identify the user once logged in.
+## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined.
+session:
+  ## The name of the session cookie.
+  name: authelia_session
+
+  ## The domain to protect.
+  ## Note: the authenticator must also be in that domain.
+  ## If empty, the cookie is restricted to the subdomain of the issuer.
+  domain: example.com
+
+  ## Sets the Cookie SameSite value. Possible options are none, lax, or strict.
+  ## Please read https://www.authelia.com/c/session#same_site
+  same_site: lax
+
+  ## The secret to encrypt the session data. This is only used with Redis / Redis Sentinel.
+  ## Secret can also be set using a secret: https://www.authelia.com/c/secrets
+  secret: insecure_session_secret
+
+  ## The value for expiration, inactivity, and remember_me_duration are in seconds or the duration notation format.
+  ## See: https://www.authelia.com/c/common#duration-notation-format
+  ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure
+  ## because a stolen cookie will last longer giving attackers more time to spy or attack.
+
+  ## The time before the cookie expires and the session is destroyed if remember me IS NOT selected.
+  expiration: 1h
+
+  ## The inactivity time before the session is reset. If expiration is set to 1h, and this is set to 5m, if the user
+  ## does not select the remember me option their session will get destroyed after 1h, or after 5m since the last time
+  ## Authelia detected user activity.
+  inactivity: 5m
+
+  ## The time before the cookie expires and the session is destroyed if remember me IS selected.
+  ## Value of -1 disables remember me.
+  remember_me_duration: 1M
+
+  ##
+  ## Redis Provider
+  ##
+  ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
+  ##
+  redis:
+    host: {{ env "NOMAD_UPSTREAM_IP_redis" }}
+    port: {{ env "NOMAD_UPSTREAM_PORT_redis" }}
+    ## Use a unix socket instead
+    # host: /var/run/redis/redis.sock
+
+    ## Username used for redis authentication. This is optional and a new feature in redis 6.0.
+    # username: authelia
+
+    ## Password can also be set using a secret: https://www.authelia.com/c/secrets
+    # password: authelia
+
+    ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
+    database_index: 0
+
+    ## The maximum number of concurrent active connections to Redis.
+    maximum_active_connections: 8
+
+    ## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
+    minimum_idle_connections: 0
+
+    ## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s).
+    # tls:
+      ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
+      # server_name: myredis.example.com
+
+      ## Skip verifying the server certificate (to allow a self-signed certificate).
+      ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
+      ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
+      # skip_verify: false
+
+      ## Minimum TLS version for the connection.
+      # minimum_version: TLS1.2
+
+    ## The Redis HA configuration options.
+    ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
+    # high_availability:
+      ## Sentinel Name / Master Name.
+      # sentinel_name: mysentinel
+
+      ## Specific username for Redis Sentinel. The node username and password is configured above.
+      # sentinel_username: sentinel_specific_user
+
+      ## Specific password for Redis Sentinel. The node username and password is configured above.
+      # sentinel_password: sentinel_specific_pass
+
+      ## The additional nodes to pre-seed the redis provider with (for sentinel).
+      ## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
+      ## For high availability to be used you must have either defined; the host above or at least one node below.
+      # nodes:
+      #   - host: sentinel-node1
+      #     port: 6379
+      #   - host: sentinel-node2
+      #     port: 6379
+
+      ## Choose the host with the lowest latency.
+      # route_by_latency: false
+
+      ## Choose the host randomly.
+      # route_randomly: false
+
+##
+## Regulation Configuration
+##
+## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are made
+## in a short period of time.
+regulation:
+  ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
+  max_retries: 3
+
+  ## The time range during which the user can attempt login before being banned. The user is banned if the
+  ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.
+  ## See: https://www.authelia.com/c/common#duration-notation-format
+  find_time: 2m
+
+  ## The length of time before a banned user can login again. Ban Time accepts duration notation.
+  ## See: https://www.authelia.com/c/common#duration-notation-format
+  ban_time: 5m
+
+##
+## Storage Provider Configuration
+##
+## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.
+storage:
+  ## The encryption key that is used to encrypt sensitive information in the database. Must be a string with a minimum
+  ## length of 20. Please see the docs if you configure this with an undesirable key and need to change it.
+  encryption_key: you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this
+
+  ##
+  ## Local (Storage Provider)
+  ##
+  ## This stores the data in a SQLite3 Database.
+  ## This is only recommended for lightweight non-stateful installations.
+  ##
+  ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
+  ##
+  local:
+    path: /config/db.sqlite3
+
+  ##
+  ## MySQL / MariaDB (Storage Provider)
+  ##
+  # mysql:
+  #   host: 127.0.0.1
+  #   port: 3306
+  #   database: authelia
+  #   username: authelia
+  #   ## Password can also be set using a secret: https://www.authelia.com/c/secrets
+  #   password: mypassword
+  #   timeout: 5s
+
+  ##
+  ## PostgreSQL (Storage Provider)
+  ##
+  # postgres:
+  #   host: 127.0.0.1
+  #   port: 5432
+  #   database: authelia
+  #   schema: public
+  #   username: authelia
+  #   ## Password can also be set using a secret: https://www.authelia.com/c/secrets
+  #   password: mypassword
+  #   timeout: 5s
+  #   ssl:
+  #     mode: disable
+  #     root_certificate: disable
+  #     certificate: disable
+  #     key: disable
+
+##
+## Notification Provider
+##
+## Notifications are sent to users when they require a password reset, a Webauthn registration or a TOTP registration.
+## The available providers are: filesystem, smtp. You must use only one of these providers.
+notifier:
+  ## You can disable the notifier startup check by setting this to true.
+  disable_startup_check: false
+
+  ##
+  ## File System (Notification Provider)
+  ##
+  ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
+  ##
+  filesystem:
+    filename: /config/notification.txt
+
+  ##
+  ## SMTP (Notification Provider)
+  ##
+  ## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate.
+  ## [Security] By default Authelia will:
+  ##   - force all SMTP connections over TLS including unauthenticated connections
+  ##      - use the disable_require_tls boolean value to disable this requirement
+  ##        (only works for unauthenticated connections)
+  ##   - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates
+  ##     (configure in tls section)
+  # smtp:
+  #   ## The SMTP host to connect to.
+  #   host: 127.0.0.1
+  #
+  #   ## The port to connect to the SMTP host on.
+  #   port: 1025
+  #
+  #   ## The connection timeout.
+  #   timeout: 5s
+  #
+  #   ## The username used for SMTP authentication.
+  #   username: test
+  #
+  #   ## The password used for SMTP authentication.
+  #   ## Can also be set using a secret: https://www.authelia.com/c/secrets
+  #   password: password
+  #
+  #   ## The sender is used to is used for the MAIL FROM command and the FROM header.
+  #   ## If this is not defined and the username is an email, we use the username as this value. This can either be just
+  #   ## an email address or the RFC5322 'Name <email address>' format.
+  #   sender: "Authelia <admin@example.com>"
+  #
+  #   ## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost.
+  #   identifier: localhost
+  #
+  #   ## Subject configuration of the emails sent. {title} is replaced by the text from the notifier.
+  #   subject: "[Authelia] {title}"
+  #
+  #   ## This address is used during the startup check to verify the email configuration is correct.
+  #   ## It's not important what it is except if your email server only allows local delivery.
+  #   startup_check_address: test@authelia.com
+  #
+  #   ## By default we require some form of TLS. This disables this check though is not advised.
+  #   disable_require_tls: false
+  #
+  #   ## Disables sending HTML formatted emails.
+  #   disable_html_emails: false
+  #
+  #   tls:
+  #     ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
+  #     # server_name: smtp.example.com
+  #
+  #     ## Skip verifying the server certificate (to allow a self-signed certificate).
+  #     ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
+  #     ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
+  #     skip_verify: false
+  #
+  #     ## Minimum TLS version for either StartTLS or SMTPS.
+  #     minimum_version: TLS1.2
+
+##
+## Identity Providers
+##
+# identity_providers:
+
+  ##
+  ## OpenID Connect (Identity Provider)
+  ##
+  ## It's recommended you read the documentation before configuration of this section:
+  ## https://www.authelia.com/c/oidc
+  # oidc:
+    ## The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens).
+    ## HMAC Secret can also be set using a secret: https://www.authelia.com/c/secrets
+    # hmac_secret: this_is_a_secret_abc123abc123abc
+
+    ## The issuer_private_key is used to sign the JWT forged by OpenID Connect.
+    ## Issuer Private Key can also be set using a secret: https://www.authelia.com/c/secrets
+    # issuer_private_key: |
+    #   --- KEY START
+    #   --- KEY END
+
+    ## The lifespans configure the expiration for these token types.
+    # access_token_lifespan: 1h
+    # authorize_code_lifespan: 1m
+    # id_token_lifespan: 1h
+    # refresh_token_lifespan: 90m
+
+    ## Enables additional debug messages.
+    # enable_client_debug_messages: false
+
+    ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for
+    ## security reasons.
+    # minimum_parameter_entropy: 8
+
+    ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it set to 'never'
+    ## for security reasons.
+    # enforce_pkce: public_clients_only
+
+    ## Cross-Origin Resource Sharing (CORS) settings.
+    # cors:
+      ## List of endpoints in addition to the metadata endpoints to permit cross-origin requests on.
+      # endpoints:
+      #    - authorization
+      #    - token
+      #    - revocation
+      #    - introspection
+      #    - userinfo
+
+      ## List of allowed origins.
+      ## Any origin with https is permitted unless this option is configured or the
+      ## allowed_origins_from_client_redirect_uris option is enabled.
+      # allowed_origins:
+      #   - https://example.com
+
+      ## Automatically adds the origin portion of all redirect URI's on all clients to the list of allowed_origins,
+      ## provided they have the scheme http or https and do not have the hostname of localhost.
+      # allowed_origins_from_client_redirect_uris: false
+
+    ## Clients is a list of known clients and their configuration.
+    # clients:
+      # -
+        ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
+        # id: myapp
+
+        ## The description to show to users when they end up on the consent screen. Defaults to the ID above.
+        # description: My Application
+
+        ## The client secret is a shared secret between Authelia and the consumer of this client.
+        # secret: this_is_a_secret
+
+        ## Sector Identifiers are occasionally used to generate pairwise subject identifiers. In most cases this is not
+        ## necessary. Read the documentation for more information.
+        ## The subject identifier must be the host component of a URL, which is a domain name with an optional port.
+        # sector_identifier: example.com
+
+        ## Sets the client to public. This should typically not be set, please see the documentation for usage.
+        # public: false
+
+        ## The policy to require for this client; one_factor or two_factor.
+        # authorization_policy: two_factor
+
+        ## By default users cannot remember pre-configured consents. Setting this value to a period of time using a
+        ## duration notation will enable users to remember consent for this client. The time configured is the amount
+        ## of time the pre-configured consent is valid for granting new authorizations to the user.
+        # pre_configured_consent_duration:
+
+        ## Audience this client is allowed to request.
+        # audience: []
+
+        ## Scopes this client is allowed to request.
+        # scopes:
+          # - openid
+          # - groups
+          # - email
+          # - profile
+
+        ## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
+        # redirect_uris:
+        # - https://oidc.example.com:8080/oauth2/callback
+
+        ## Grant Types configures which grants this client can obtain.
+        ## It's not recommended to define this unless you know what you're doing.
+        # grant_types:
+          # - refresh_token
+          # - authorization_code
+
+        ## Response Types configures which responses this client can be sent.
+        ## It's not recommended to define this unless you know what you're doing.
+        # response_types:
+          # - code
+
+        ## Response Modes configures which response modes this client supports.
+        # response_modes:
+          # - form_post
+          # - query
+          # - fragment
+
+        ## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
+        # userinfo_signing_algorithm: none

services/service/main.tf

@@ -6,8 +6,10 @@ resource "nomad_job" "service" {
     env   = var.env
 
     service_port = var.service_port
+    ports        = var.ports
     sticky_disk  = var.sticky_disk
     resources    = var.resources
+    service_tags = var.service_tags
 
     ingress             = var.ingress
     ingress_rule        = var.ingress_rule

services/service/service_template.nomad

@@ -15,6 +15,13 @@ job "${name}" {
         to = ${service_port}
       }
       %{ endif ~}
+      %{ for port in ports ~}
+      port "${port.name}" {
+        %{ if port.host_network != null }host_network = "${port.host_network}"%{ endif ~}
+        %{ if port.to != null }to = ${port.to}%{ endif ~}
+        %{ if port.static != null }static = ${port.static}%{ endif ~}
+      }
+      %{ endfor }
     }
 
     %{ if sticky_disk ~}
@@ -56,7 +63,7 @@ job "${name}" {
             %{ endif ~}
             %{ if use_ldap }
             upstreams {
-              destination_name = "lldap"
+              destination_name = "ldap"
               local_bind_port = 3890
             }
             %{ endif ~}
@@ -105,6 +112,9 @@ job "${name}" {
         %{ for middleware in ingress_middlewares ~}
         "traefik.http.routers.${name}.middlewares=${middleware}",
         %{ endfor ~}
+        %{ for tag in service_tags ~}
+        "${tag}",
+        %{ endfor ~}
         %{ endif ~}
       ]
     }

services/service/vars.tf

@@ -70,6 +70,23 @@ variable "ingress_middlewares" {
   description = "Traefik middlewares that should be used"
 }
 
+variable "service_tags" {
+  type        = list(string)
+  default     = []
+  description = "Additional tags to be added to the service."
+}
+
+variable "ports" {
+  type = list(object({
+    name         = string
+    host_network = optional(string)
+    to           = optional(number)
+    static       = optional(number)
+  }))
+  default     = []
+  description = "Additional ports (not service_port) to be bound."
+}
+
 variable "templates" {
   type = list(object({
     data            = string