Compare commits

...

7 Commits

Author SHA1 Message Date
e8c49ad8d6 WIP: Lots more authelia
It was working before adding the secrets and db
2022-11-22 10:04:31 -08:00
3aeac1a0f2 Expose traefik metrics 2022-11-22 09:59:53 -08:00
0c7f88d1ff Remove dupe env in lldap 2022-11-22 09:59:40 -08:00
ee67a2976c Increase priority of auth tasks 2022-11-22 09:59:18 -08:00
ced58c24bd More authelia hacking 2022-11-21 14:26:33 -08:00
0a335eab4a Authelia use full ldap dn 2022-11-21 14:26:33 -08:00
dd40bed332 WIP: Support for authelia 2022-11-21 14:26:30 -08:00
13 changed files with 908 additions and 10 deletions

View File

@ -211,7 +211,49 @@
"line_number": 159, "line_number": 159,
"is_secret": false "is_secret": false
} }
],
"services/authelia.yml": [
{
"type": "Secret Keyword",
"filename": "services/authelia.yml",
"hashed_secret": "d16a67474cca598880e37d64557f1264586386bd",
"is_verified": false,
"line_number": 18,
"is_secret": false
},
{
"type": "Secret Keyword",
"filename": "services/authelia.yml",
"hashed_secret": "7cb6efb98ba5972a9b5090dc2e517fe14d12cb04",
"is_verified": false,
"line_number": 134,
"is_secret": false
},
{
"type": "Secret Keyword",
"filename": "services/authelia.yml",
"hashed_secret": "a32b08d97b1615dc27f58b6b17f67624c04e2c4f",
"is_verified": false,
"line_number": 409,
"is_secret": false
},
{
"type": "Secret Keyword",
"filename": "services/authelia.yml",
"hashed_secret": "7e1f5e63ab2c1f926e5fb81cc004dc24af411376",
"is_verified": false,
"line_number": 502,
"is_secret": false
},
{
"type": "Secret Keyword",
"filename": "services/authelia.yml",
"hashed_secret": "0bb90d739912b79b54b811fec298da9f59008a26",
"is_verified": false,
"line_number": 557,
"is_secret": false
}
] ]
}, },
"generated_at": "2022-11-11T21:26:53Z" "generated_at": "2022-11-22T18:04:17Z"
} }

View File

@ -1,6 +1,7 @@
job "lldap" { job "lldap" {
datacenters = ["dc1"] datacenters = ["dc1"]
type = "service" type = "service"
priority = 80
group "lldap" { group "lldap" {
@ -25,7 +26,7 @@ job "lldap" {
} }
service { service {
name = "lldap" name = "ldap"
port = "ldap" port = "ldap"
connect { connect {
@ -92,6 +93,13 @@ job "lldap" {
source = "secrets/lldap_config.toml" source = "secrets/lldap_config.toml"
target = "/lldap_config.toml" target = "/lldap_config.toml"
} }
}
env = {
"LLDAP_VERBOSE" = "true"
"LLDAP_LDAP_PORT" = "${NOMAD_PORT_ldap}"
"LLDAP_HTTP_PORT" = "${NOMAD_PORT_web}"
} }
vault { vault {
@ -101,11 +109,6 @@ job "lldap" {
] ]
} }
env = {
"LLDAP_LDAP_PORT" = "${NOMAD_PORT_ldap}"
"LLDAP_HTTP_PORT" = "${NOMAD_PORT_web}"
}
template { template {
data = <<EOH data = <<EOH
database_url = "sqlite:///data/users.db?mode=rwc" database_url = "sqlite:///data/users.db?mode=rwc"

View File

@ -134,3 +134,19 @@ resource "consul_config_entry" "global_access" {
] ]
}) })
} }
resource "consul_config_entry" "ldap_intents" {
name = "ldap"
kind = "service-intentions"
config_json = jsonencode({
Sources = [
{
Action = "allow"
Name = "authelia"
Precedence = 9
Type = "consul"
},
]
})
}

View File

@ -40,6 +40,10 @@ job "traefik" {
port "syslog" { port "syslog" {
static = 514 static = 514
} }
port "metrics" {
to = 8989
}
} }
ephemeral_disk { ephemeral_disk {
@ -51,6 +55,10 @@ job "traefik" {
name = "traefik" name = "traefik"
port = "web" port = "web"
meta {
metrics_addr = "${NOMAD_ADDR_metrics}"
}
check { check {
type = "http" type = "http"
path = "/ping" path = "/ping"
@ -125,6 +133,15 @@ job "traefik" {
[entryPoints.metrics] [entryPoints.metrics]
address = ":8989" address = ":8989"
[entryPoints.auth]
# TODO: Narrow this from all interfaces to localhost only
address = ":8999"
# TODO: Narrow this from insecure to possibly localhost only
[entryPoints.auth.forwardedHeaders]
insecure = true
[entryPoints.auth.proxyProtocol]
insecure = true
[entryPoints.syslogtcp] [entryPoints.syslogtcp]
address = ":514" address = ":514"

View File

@ -60,6 +60,12 @@ resource "consul_config_entry" "mysql_intents" {
Precedence = 9 Precedence = 9
Type = "consul" Type = "consul"
}, },
{
Action = "allow"
Name = "authelia"
Precedence = 9
Type = "consul"
},
] ]
}) })
} }

View File

@ -1,7 +1,7 @@
job "redis" { job "redis" {
datacenters = ["dc1"] datacenters = ["dc1"]
type = "service" type = "service"
priority = 60 priority = 80
group "cache" { group "cache" {
count = 1 count = 1

114
services/authelia.nomad Normal file
View File

@ -0,0 +1,114 @@
variable "config_data" {
type = string
description = "Authelia YAML config"
}
job "authelia" {
datacenters = ["dc1"]
type = "service"
priority = 80
group "authelia" {
count = 1
network {
mode = "bridge"
port "main" {
host_network = "loopback"
to = 9091
}
port "metrics" {
to = 9959
}
}
service {
name = "authelia"
port = "main"
meta {
metrics_addr = "${NOMAD_ADDR_metrics}"
}
connect {
sidecar_service {
proxy {
local_service_port = 9091
expose {
path {
path = "/metrics"
protocol = "http"
local_path_port = 9959
listener_port = "metrics"
}
}
upstreams {
destination_name = "ldap"
local_bind_port = 4820
}
upstreams {
destination_name = "redis"
local_bind_port = 6379
}
}
}
sidecar_task {
resources {
cpu = 50
memory = 50
}
}
}
tags = [
"traefik.enable=true",
"traefik.http.routers.authelia.entryPoints=websecure,auth",
"traefik.http.middlewares.authelia.forwardAuth.address=http://localhost:8999/api/verify?rd=https%3A%2F%2Fauthelia.thefij.rocks%2F",
"traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader=true",
"traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email",
"traefik.http.middlewares.authelia-basic.forwardAuth.address=http://http://localhost:8999/api/verify?auth=basic",
"traefik.http.middlewares.authelia-basic.forwardAuth.trustForwardHeader=true",
"traefik.http.middlewares.authelia-basic.forwardAuth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email",
]
}
task "authelia" {
driver = "docker"
config {
image = "authelia/authelia"
ports = ["main"]
mount {
type = "bind"
target = "/config"
source = "config"
}
}
vault {
policies = [
"access-tables",
"nomad-task",
]
}
template {
data = var.config_data
destination = "/config/configuration.yml"
}
resources {
cpu = 50
memory = 50
}
}
}
}

61
services/authelia.tf Normal file
View File

@ -0,0 +1,61 @@
module "authelia" {
source = "./service"
name = "authelia"
image = "authelia/authelia:latest"
ingress = true
service_port = 9091
ports = [
{
name = "metrics"
}
]
metrics_port_name = "metrics"
templates = [
{
data = file("${path.module}/authelia.yml")
dest_prefix = "local/"
dest = "/config/configuration.yml"
},
]
service_tags = [
"traefik.http.routers.authelia-internal.entryPoints=auth",
"traefik.http.routers.authelia-internal.rule=Path(`/api/verify`)",
"traefik.http.middlewares.authelia.forwardAuth.address=http://localhost:8999/api/verify?rd=https%3A%2F%2Fauthelia.thefij.rocks%2F",
"traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader=true",
"traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email",
"traefik.http.middlewares.authelia-basic.forwardAuth.address=http://localhost:8999/api/verify?auth=basic",
"traefik.http.middlewares.authelia-basic.forwardAuth.trustForwardHeader=true",
"traefik.http.middlewares.authelia-basic.forwardAuth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email",
]
use_vault = true
use_ldap = true
use_redis = true
use_mysql = true
mysql_bootstrap = {
vault_key = "kv/data/authelia"
}
}
# locals {
# authelia_config = templatefile(
# "${path.module}/authelia.yml",
# {
# }
# )
# }
# resource "nomad_job" "authelia" {
# hcl2 {
# enabled = true
# vars = {
# config_data = "${local.authelia_config}",
# }
# }
#
# jobspec = file("${path.module}/authelia.nomad")
# }

607
services/authelia.yml Normal file
View File

@ -0,0 +1,607 @@
# yamllint disable rule:comments-indentation
---
###############################################################################
# Authelia Configuration #
###############################################################################
## Note: the container by default expects to find this file at /config/configuration.yml.
## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to
## the system certificates store.
## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem.
# certificates_directory: /config/certificates/
## The theme to display: light, dark, grey, auto.
theme: auto
## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be
## set using a secret: https://www.authelia.com/c/secrets
{{ with secret "kv/data/authelia" -}}
jwt_secret: {{ .Data.data.jwt_secret }}
{{- end }}
## Default redirection URL
##
## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end
## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use
## in such a case.
##
## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
default_redirection_url: https://authelia.thefij.rocks/
## Set the default 2FA method for new users and for when a user has a preferred method configured that has been
## disabled. This setting must be a method that is enabled.
## Options are totp, webauthn, mobile_push.
default_2fa_method: ""
##
## Server Configuration
##
server:
host: 0.0.0.0
port: 9091
## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0.
## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist.
disable_healthcheck: false
##
## Log Configuration
##
log:
## Level of verbosity for logs: info, debug, trace.
level: debug
## Format the logs are written as: json, text.
format: json
##
## Telemetry Configuration
##
telemetry:
metrics:
## Enable Metrics.
enabled: true
## The address to listen on for metrics. This should be on a different port to the main server.port value.
address: '0.0.0.0:{{ env "NOMAD_PORT_metrics" }}'
##
## TOTP Configuration
##
## Parameters used for TOTP generation.
totp:
## Disable TOTP.
disable: false
## The issuer name displayed in the Authenticator application of your choice.
issuer: {{ keyOrDefault "global/base_hostname" "Example.com" }}
## The TOTP algorithm to use.
## It is CRITICAL you read the documentation before changing this option:
## https://www.authelia.com/c/totp#algorithm
algorithm: sha1
## The number of digits a user has to input. Must either be 6 or 8.
## Changing this option only affects newly generated TOTP configurations.
## It is CRITICAL you read the documentation before changing this option:
## https://www.authelia.com/c/totp#digits
digits: 6
##
## WebAuthn Configuration
##
## Parameters used for WebAuthn.
webauthn:
## Disable Webauthn.
disable: false
## Adjust the interaction timeout for Webauthn dialogues.
timeout: 60s
## The display name the browser should show the user for when using Webauthn to login/register.
display_name: {{ keyOrDefault "global/base_hostname" "Example.com" }}
## User verification controls if the user must make a gesture or action to confirm they are present.
## Options are required, preferred, discouraged.
user_verification: preferred
##
## Duo Push API Configuration
##
## Parameters used to contact the Duo API. Those are generated when you protect an application of type
## "Partner Auth API" in the management panel.
{{ with secret "kv/data/duo" -}}
duo_api:
disable: false
hostname: {{ .Data.data.hostname }}
integration_key: {{ .Data.data.integration_key }}
secret_key: {{ .Data.data.secret_key }}
# enable_self_enrollment: false
{{ else }}
duo_api:
disable: true
{{- end }}
##
## Authentication Backend Provider Configuration
##
## Used for verifying user passwords and retrieve information such as email address and groups users belong to.
##
## The available providers are: `file`, `ldap`. You must use only one of these providers.
authentication_backend:
## Disable both the HTML element and the API for reset password functionality.
disable_reset_password: false
## Password Reset Options.
password_reset:
## External reset password url that redirects the user to an external reset portal. This disables the internal reset
## functionality.
custom_url: ""
## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation.
## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
## To force update on every request you can set this to '0' or 'always', this will increase processor demand.
## See the below documentation for more information.
## Duration Notation docs: https://www.authelia.com/c/common#duration-notation-format
## Refresh Interval docs: https://www.authelia.com/c/1fa#refresh-interval
refresh_interval: 5m
##
## LDAP (Authentication Provider)
##
## This is the recommended Authentication Provider in production
## because it allows Authelia to offload the stateful operations
## onto the LDAP service.
ldap:
## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
## Acceptable options are as follows:
## - 'activedirectory' - For Microsoft Active Directory.
## - 'custom' - For custom specifications of attributes and filters.
## This currently defaults to 'custom' to maintain existing behaviour.
##
## Depending on the option here certain other values in this section have a default value, notably all of the
## attribute mappings have a default value that this config overrides, you can read more about these default values
## at https://www.authelia.com/c/ldap#defaults
implementation: custom
## The url to the ldap server. Format: <scheme>://<address>[:<port>].
## Scheme can be ldap or ldaps in the format (port optional).
url: ldap://{{ env "NOMAD_UPSTREAM_ADDR_ldap" }}
## The dial timeout for LDAP.
timeout: 5s
## Use StartTLS with the LDAP connection.
start_tls: false
# tls:
# ## Server Name for certificate validation (in case it's not set correctly in the URL).
# # server_name: ldap.example.com
#
# ## Skip verifying the server certificate (to allow a self-signed certificate).
# ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
# ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
# skip_verify: false
#
# ## Minimum TLS version for either Secure LDAP or LDAP StartTLS.
# minimum_version: TLS1.2
## The distinguished name of the container searched for objects in the directory information tree.
## See also: additional_users_dn, additional_groups_dn.
base_dn: {{ keyOrDefault "global/ldap/base_dn" "dc=example,dc=com" }}
## The attribute holding the username of the user. This attribute is used to populate the username in the session
## information. It was introduced due to #561 to handle case insensitive search queries. For you information,
## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this
## attribute holds the unique identifiers for the users binding the user and the configuration stored in database.
## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user
## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also
## be used but we don't recommend using them, we instead advise to use the attributes mentioned above
## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt.
username_attribute: uid
## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users.
## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users.
additional_users_dn: ou=people
## The users filter used in search queries to find the user profile based on input filled in login form.
## Various placeholders are available in the user filter which you can read about in the documentation which can
## be found at: https://www.authelia.com/c/ldap#users-filter-replacements
##
## Recommended settings are as follows:
## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
## - OpenLDAP:
## - (&({username_attribute}={input})(objectClass=person))
## - (&({username_attribute}={input})(objectClass=inetOrgPerson))
##
## To allow sign in both with username and email, one can use a filter like
## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
users_filter: (&({username_attribute}={input})(objectClass=person))
## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups.
## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups.
additional_groups_dn: ou=groups
## The groups filter used in search queries to find the groups based on relevant authenticated user.
## Various placeholders are available in the groups filter which you can read about in the documentation which can
## be found at: https://www.authelia.com/c/ldap#groups-filter-replacements
##
## If your groups use the `groupOfUniqueNames` structure use this instead:
## (&(uniqueMember={dn})(objectClass=groupOfUniqueNames))
groups_filter: (member={dn})
## The attribute holding the name of the group.
group_name_attribute: cn
## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
## first one returned by the LDAP server is used.
mail_attribute: mail
## The attribute holding the display name of the user. This will be used to greet an authenticated user.
display_name_attribute: displayName
## Follow referrals returned by the server.
## This is especially useful for environments where read-only servers exist. Only implemented for write operations.
# permit_referrals: false
## The username and password of the admin user.
{{ with secret "kv/data/lldap" }}
user: uid={{ .Data.data.admin_user }},ou=people,{{ key "global/ldap/base_dn" }}
## Password can also be set using a secret: https://www.authelia.com/c/secrets
password: {{ .Data.data.admin_password }}
{{ end -}}
##
## File (Authentication Provider)
##
## With this backend, the users database is stored in a file which is updated when users reset their passwords.
## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia
## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security
## implications it is highly recommended you leave the default values. Before considering changing these settings
## please read the docs page below:
## https://www.authelia.com/r/passwords#tuning
##
## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
##
# file:
# path: /config/users_database.yml
# password:
# algorithm: argon2id
# iterations: 1
# key_length: 32
# salt_length: 16
# memory: 1024
# parallelism: 8
##
## Password Policy Configuration.
##
password_policy:
## The standard policy allows you to tune individual settings manually.
standard:
enabled: false
## Require a minimum length for passwords.
min_length: 8
## Require a maximum length for passwords.
max_length: 0
## Require uppercase characters.
require_uppercase: true
## Require lowercase characters.
require_lowercase: true
## Require numeric characters.
require_number: true
## Require special characters.
require_special: true
## zxcvbn is a well known and used password strength algorithm. It does not have tunable settings.
zxcvbn:
enabled: false
## Configures the minimum score allowed.
min_score: 3
##
## Access Control Configuration
##
## Access control is a list of rules defining the authorizations applied for one resource to users or group of users.
##
## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed
## to anyone. Otherwise restrictions follow the rules defined.
##
## Note: One can use the wildcard * to match any subdomain.
## It must stand at the beginning of the pattern. (example: *.mydomain.com)
##
## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct.
##
## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'.
##
## - 'domain' defines which domain or set of domains the rule applies to.
##
## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not
## provided. If provided, the parameter represents either a user or a group. It should be of the form
## 'user:<username>' or 'group:<groupname>'.
##
## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'.
##
## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter
## is optional and matches any resource if not provided.
##
## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies.
access_control:
## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
## resource if there is no policy to be applied to the user.
default_policy: deny
networks:
- name: internal
networks:
- 10.10.0.0/16
- 192.168.2.0/24
- name: VPN
networks: 10.9.0.0/16
rules:
## Rules applied to everyone
- domain: '*.thefij.rocks'
policy: one_factor
- domain:
- 'secure.example.com'
- 'private.example.com'
policy: two_factor
##
## Session Provider Configuration
##
## The session cookies identify the user once logged in.
## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined.
session:
## The name of the session cookie.
name: authelia_session
domain: {{ keyOrDefault "global/base_hostname" "example.com" }}
## The secret to encrypt the session data. This is only used with Redis / Redis Sentinel.
## Secret can also be set using a secret: https://www.authelia.com/c/secrets
{{ with secret "kv/data/authelia" -}}
secret: {{ .Data.data.session_secret }}
{{- end }}
## The value for expiration, inactivity, and remember_me_duration are in seconds or the duration notation format.
## See: https://www.authelia.com/c/common#duration-notation-format
## All three of these values affect the cookie/session validity period. Longer periods are considered less secure
## because a stolen cookie will last longer giving attackers more time to spy or attack.
## The time before the cookie expires and the session is destroyed if remember me IS NOT selected.
expiration: 1h
## The inactivity time before the session is reset. If expiration is set to 1h, and this is set to 5m, if the user
## does not select the remember me option their session will get destroyed after 1h, or after 5m since the last time
## Authelia detected user activity.
inactivity: 5m
## The time before the cookie expires and the session is destroyed if remember me IS selected.
## Value of -1 disables remember me.
remember_me_duration: 1M
##
## Redis Provider
##
## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
##
redis:
host: {{ env "NOMAD_UPSTREAM_IP_redis" }}
port: {{ env "NOMAD_UPSTREAM_PORT_redis" }}
## Username used for redis authentication. This is optional and a new feature in redis 6.0.
# username: authelia
## Password can also be set using a secret: https://www.authelia.com/c/secrets
# password: authelia
## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
database_index: 0
## The maximum number of concurrent active connections to Redis.
maximum_active_connections: 8
## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
minimum_idle_connections: 0
##
## Regulation Configuration
##
## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are made
## in a short period of time.
regulation:
## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
max_retries: 3
## The time range during which the user can attempt login before being banned. The user is banned if the
## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.
## See: https://www.authelia.com/c/common#duration-notation-format
find_time: 2m
## The length of time before a banned user can login again. Ban Time accepts duration notation.
## See: https://www.authelia.com/c/common#duration-notation-format
ban_time: 5m
##
## Storage Provider Configuration
##
## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.
storage:
## The encryption key that is used to encrypt sensitive information in the database. Must be a string with a minimum
## length of 20. Please see the docs if you configure this with an undesirable key and need to change it.
encryption_key: you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this
##
## MySQL / MariaDB (Storage Provider)
##
{{ with secret "kv/data/authelia" -}}
mysql:
host: {{ env "NOMAD_UPSTREAM_IP_mysql-server" }}
port: {{ env "NOMAD_UPSTREAM_PORT_mysql-server" }}
database: {{ .Data.data.db_name }}
username: {{ .Data.data.db_user }}
password: {{ .Data.data.db_pass }}
timeout: 5s
{{- end }}
##
## Notification Provider
##
## Notifications are sent to users when they require a password reset, a Webauthn registration or a TOTP registration.
## The available providers are: filesystem, smtp. You must use only one of these providers.
notifier:
## You can disable the notifier startup check by setting this to true.
disable_startup_check: false
{{ with secret "kv/data/smtp" -}}
smtp:
host: {{ .Data.data.server }}
port: {{ .Data.data.port}}
username: {{ .Data.data.user }}
password: {{ .Data.data.password }}
## The sender is used to is used for the MAIL FROM command and the FROM header.
## If this is not defined and the username is an email, we use the username as this value. This can either be just
## an email address or the RFC5322 'Name <email address>' format.
sender: "Authelia <admin@thefij.rocks>"
## Subject configuration of the emails sent. {title} is replaced by the text from the notifier.
subject: "[Authelia] {title}"
## This address is used during the startup check to verify the email configuration is correct.
## It's not important what it is except if your email server only allows local delivery.
startup_check_address: test@authelia.com
{{- end }}
##
## Identity Providers
##
# identity_providers:
##
## OpenID Connect (Identity Provider)
##
## It's recommended you read the documentation before configuration of this section:
## https://www.authelia.com/c/oidc
# oidc:
## The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens).
## HMAC Secret can also be set using a secret: https://www.authelia.com/c/secrets
# hmac_secret: this_is_a_secret_abc123abc123abc
## The issuer_private_key is used to sign the JWT forged by OpenID Connect.
## Issuer Private Key can also be set using a secret: https://www.authelia.com/c/secrets
# issuer_private_key: |
# --- KEY START
# --- KEY END
## The lifespans configure the expiration for these token types.
# access_token_lifespan: 1h
# authorize_code_lifespan: 1m
# id_token_lifespan: 1h
# refresh_token_lifespan: 90m
## Enables additional debug messages.
# enable_client_debug_messages: false
## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for
## security reasons.
# minimum_parameter_entropy: 8
## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it set to 'never'
## for security reasons.
# enforce_pkce: public_clients_only
## Cross-Origin Resource Sharing (CORS) settings.
# cors:
## List of endpoints in addition to the metadata endpoints to permit cross-origin requests on.
# endpoints:
# - authorization
# - token
# - revocation
# - introspection
# - userinfo
## List of allowed origins.
## Any origin with https is permitted unless this option is configured or the
## allowed_origins_from_client_redirect_uris option is enabled.
# allowed_origins:
# - https://example.com
## Automatically adds the origin portion of all redirect URI's on all clients to the list of allowed_origins,
## provided they have the scheme http or https and do not have the hostname of localhost.
# allowed_origins_from_client_redirect_uris: false
## Clients is a list of known clients and their configuration.
# clients:
# -
## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
# id: myapp
## The description to show to users when they end up on the consent screen. Defaults to the ID above.
# description: My Application
## The client secret is a shared secret between Authelia and the consumer of this client.
# secret: this_is_a_secret
## Sector Identifiers are occasionally used to generate pairwise subject identifiers. In most cases this is not
## necessary. Read the documentation for more information.
## The subject identifier must be the host component of a URL, which is a domain name with an optional port.
# sector_identifier: example.com
## Sets the client to public. This should typically not be set, please see the documentation for usage.
# public: false
## The policy to require for this client; one_factor or two_factor.
# authorization_policy: two_factor
## By default users cannot remember pre-configured consents. Setting this value to a period of time using a
## duration notation will enable users to remember consent for this client. The time configured is the amount
## of time the pre-configured consent is valid for granting new authorizations to the user.
# pre_configured_consent_duration:
## Audience this client is allowed to request.
# audience: []
## Scopes this client is allowed to request.
# scopes:
# - openid
# - groups
# - email
# - profile
## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
# redirect_uris:
# - https://oidc.example.com:8080/oauth2/callback
## Grant Types configures which grants this client can obtain.
## It's not recommended to define this unless you know what you're doing.
# grant_types:
# - refresh_token
# - authorization_code
## Response Types configures which responses this client can be sent.
## It's not recommended to define this unless you know what you're doing.
# response_types:
# - code
## Response Modes configures which response modes this client supports.
# response_modes:
# - form_post
# - query
# - fragment
## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
# userinfo_signing_algorithm: none

View File

@ -6,8 +6,10 @@ resource "nomad_job" "service" {
env = var.env env = var.env
service_port = var.service_port service_port = var.service_port
ports = var.ports
sticky_disk = var.sticky_disk sticky_disk = var.sticky_disk
resources = var.resources resources = var.resources
service_tags = var.service_tags
ingress = var.ingress ingress = var.ingress
ingress_rule = var.ingress_rule ingress_rule = var.ingress_rule

View File

@ -15,6 +15,13 @@ job "${name}" {
to = ${service_port} to = ${service_port}
} }
%{ endif ~} %{ endif ~}
%{ for port in ports ~}
port "${port.name}" {
%{ if port.host_network != null }host_network = "${port.host_network}"%{ endif ~}
%{ if port.to != null }to = ${port.to}%{ endif ~}
%{ if port.static != null }static = ${port.static}%{ endif ~}
}
%{ endfor }
} }
%{ if sticky_disk ~} %{ if sticky_disk ~}
@ -56,7 +63,7 @@ job "${name}" {
%{ endif ~} %{ endif ~}
%{ if use_ldap } %{ if use_ldap }
upstreams { upstreams {
destination_name = "lldap" destination_name = "ldap"
local_bind_port = 3890 local_bind_port = 3890
} }
%{ endif ~} %{ endif ~}
@ -105,6 +112,9 @@ job "${name}" {
%{ for middleware in ingress_middlewares ~} %{ for middleware in ingress_middlewares ~}
"traefik.http.routers.${name}.middlewares=${middleware}", "traefik.http.routers.${name}.middlewares=${middleware}",
%{ endfor ~} %{ endfor ~}
%{ for tag in service_tags ~}
"${tag}",
%{ endfor ~}
%{ endif ~} %{ endif ~}
] ]
} }

View File

@ -70,6 +70,23 @@ variable "ingress_middlewares" {
description = "Traefik middlewares that should be used" description = "Traefik middlewares that should be used"
} }
variable "service_tags" {
type = list(string)
default = []
description = "Additional tags to be added to the service."
}
variable "ports" {
type = list(object({
name = string
host_network = optional(string)
to = optional(number)
static = optional(number)
}))
default = []
description = "Additional ports (not service_port) to be bound."
}
variable "templates" { variable "templates" {
type = list(object({ type = list(object({
data = string data = string

View File

@ -50,7 +50,10 @@ job "whoami" {
tags = [ tags = [
"traefik.enable=true", "traefik.enable=true",
"traefik.http.routers.whoami.entryPoints=websecure", "traefik.http.routers.whoami.entryPoints=websecure",
"traefik.http.routers.whoami.middlewares=basic-auth@file", # "traefik.http.routers.whoami.middlewares=basic-auth@file",
"traefik.http.routers.whoami.middlewares=authelia@consulcatalog",
# "traefik.http.routers.whoami.middlewares=authelia-basic@consulcatalog",
# "traefik.http.routers.whoami.middlewares=authelia@file",
] ]
} }