# yamllint disable rule:comments-indentation --- ############################################################################### # Authelia Configuration # ############################################################################### ## Note: the container by default expects to find this file at /config/configuration.yml. ## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to ## the system certificates store. ## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem. # certificates_directory: /config/certificates/ ## The theme to display: light, dark, grey, auto. theme: auto ## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be ## set using a secret: https://www.authelia.com/c/secrets {{ with secret "kv/data/authelia" -}} jwt_secret: {{ .Data.data.jwt_secret }} {{- end }} ## Default redirection URL ## ## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end ## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use ## in such a case. ## ## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication. default_redirection_url: https://authelia.thefij.rocks/ ## Set the default 2FA method for new users and for when a user has a preferred method configured that has been ## disabled. This setting must be a method that is enabled. ## Options are totp, webauthn, mobile_push. default_2fa_method: "" ## ## Server Configuration ## server: host: 0.0.0.0 port: 9091 ## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0. ## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist. disable_healthcheck: false ## ## Log Configuration ## log: ## Level of verbosity for logs: info, debug, trace. level: debug ## Format the logs are written as: json, text. format: json ## ## Telemetry Configuration ## telemetry: metrics: ## Enable Metrics. enabled: true ## The address to listen on for metrics. This should be on a different port to the main server.port value. address: '0.0.0.0:{{ env "NOMAD_PORT_metrics" }}' ## ## TOTP Configuration ## ## Parameters used for TOTP generation. totp: ## Disable TOTP. disable: false ## The issuer name displayed in the Authenticator application of your choice. issuer: {{ keyOrDefault "global/base_hostname" "Example.com" }} ## The TOTP algorithm to use. ## It is CRITICAL you read the documentation before changing this option: ## https://www.authelia.com/c/totp#algorithm algorithm: sha1 ## The number of digits a user has to input. Must either be 6 or 8. ## Changing this option only affects newly generated TOTP configurations. ## It is CRITICAL you read the documentation before changing this option: ## https://www.authelia.com/c/totp#digits digits: 6 ## ## WebAuthn Configuration ## ## Parameters used for WebAuthn. webauthn: ## Disable Webauthn. disable: false ## Adjust the interaction timeout for Webauthn dialogues. timeout: 60s ## The display name the browser should show the user for when using Webauthn to login/register. display_name: {{ keyOrDefault "global/base_hostname" "Example.com" }} ## User verification controls if the user must make a gesture or action to confirm they are present. ## Options are required, preferred, discouraged. user_verification: preferred ## ## Duo Push API Configuration ## ## Parameters used to contact the Duo API. Those are generated when you protect an application of type ## "Partner Auth API" in the management panel. {{ with secret "kv/data/duo" -}} duo_api: disable: false hostname: {{ .Data.data.hostname }} integration_key: {{ .Data.data.integration_key }} secret_key: {{ .Data.data.secret_key }} # enable_self_enrollment: false {{ else }} duo_api: disable: true {{- end }} ## ## Authentication Backend Provider Configuration ## ## Used for verifying user passwords and retrieve information such as email address and groups users belong to. ## ## The available providers are: `file`, `ldap`. You must use only one of these providers. authentication_backend: ## Disable both the HTML element and the API for reset password functionality. disable_reset_password: false ## Password Reset Options. password_reset: ## External reset password url that redirects the user to an external reset portal. This disables the internal reset ## functionality. custom_url: "" ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation. ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP. ## To force update on every request you can set this to '0' or 'always', this will increase processor demand. ## See the below documentation for more information. ## Duration Notation docs: https://www.authelia.com/c/common#duration-notation-format ## Refresh Interval docs: https://www.authelia.com/c/1fa#refresh-interval refresh_interval: 5m ## ## LDAP (Authentication Provider) ## ## This is the recommended Authentication Provider in production ## because it allows Authelia to offload the stateful operations ## onto the LDAP service. ldap: ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password. ## Acceptable options are as follows: ## - 'activedirectory' - For Microsoft Active Directory. ## - 'custom' - For custom specifications of attributes and filters. ## This currently defaults to 'custom' to maintain existing behaviour. ## ## Depending on the option here certain other values in this section have a default value, notably all of the ## attribute mappings have a default value that this config overrides, you can read more about these default values ## at https://www.authelia.com/c/ldap#defaults implementation: custom ## The url to the ldap server. Format: ://
[:]. ## Scheme can be ldap or ldaps in the format (port optional). url: ldap://{{ env "NOMAD_UPSTREAM_ADDR_ldap" }} ## The dial timeout for LDAP. timeout: 5s ## Use StartTLS with the LDAP connection. start_tls: false # tls: # ## Server Name for certificate validation (in case it's not set correctly in the URL). # # server_name: ldap.example.com # # ## Skip verifying the server certificate (to allow a self-signed certificate). # ## In preference to setting this we strongly recommend you add the public portion of the certificate to the # ## certificates directory which is defined by the `certificates_directory` option at the top of the config. # skip_verify: false # # ## Minimum TLS version for either Secure LDAP or LDAP StartTLS. # minimum_version: TLS1.2 ## The distinguished name of the container searched for objects in the directory information tree. ## See also: additional_users_dn, additional_groups_dn. base_dn: {{ keyOrDefault "global/ldap/base_dn" "dc=example,dc=com" }} ## The attribute holding the username of the user. This attribute is used to populate the username in the session ## information. It was introduced due to #561 to handle case insensitive search queries. For you information, ## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this ## attribute holds the unique identifiers for the users binding the user and the configuration stored in database. ## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user ## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also ## be used but we don't recommend using them, we instead advise to use the attributes mentioned above ## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt. username_attribute: uid ## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users. ## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users. additional_users_dn: ou=people ## The users filter used in search queries to find the user profile based on input filled in login form. ## Various placeholders are available in the user filter which you can read about in the documentation which can ## be found at: https://www.authelia.com/c/ldap#users-filter-replacements ## ## Recommended settings are as follows: ## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) ## - OpenLDAP: ## - (&({username_attribute}={input})(objectClass=person)) ## - (&({username_attribute}={input})(objectClass=inetOrgPerson)) ## ## To allow sign in both with username and email, one can use a filter like ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person)) users_filter: (&({username_attribute}={input})(objectClass=person)) ## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups. ## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups. additional_groups_dn: ou=groups ## The groups filter used in search queries to find the groups based on relevant authenticated user. ## Various placeholders are available in the groups filter which you can read about in the documentation which can ## be found at: https://www.authelia.com/c/ldap#groups-filter-replacements ## ## If your groups use the `groupOfUniqueNames` structure use this instead: ## (&(uniqueMember={dn})(objectClass=groupOfUniqueNames)) groups_filter: (member={dn}) ## The attribute holding the name of the group. group_name_attribute: cn ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the ## first one returned by the LDAP server is used. mail_attribute: mail ## The attribute holding the display name of the user. This will be used to greet an authenticated user. display_name_attribute: displayName ## Follow referrals returned by the server. ## This is especially useful for environments where read-only servers exist. Only implemented for write operations. # permit_referrals: false ## The username and password of the admin user. {{ with secret "kv/data/lldap" }} user: uid={{ .Data.data.admin_user }},ou=people,{{ key "global/ldap/base_dn" }} ## Password can also be set using a secret: https://www.authelia.com/c/secrets password: {{ .Data.data.admin_password }} {{ end -}} ## ## File (Authentication Provider) ## ## With this backend, the users database is stored in a file which is updated when users reset their passwords. ## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia ## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security ## implications it is highly recommended you leave the default values. Before considering changing these settings ## please read the docs page below: ## https://www.authelia.com/r/passwords#tuning ## ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness ## # file: # path: /config/users_database.yml # password: # algorithm: argon2id # iterations: 1 # key_length: 32 # salt_length: 16 # memory: 1024 # parallelism: 8 ## ## Password Policy Configuration. ## password_policy: ## The standard policy allows you to tune individual settings manually. standard: enabled: false ## Require a minimum length for passwords. min_length: 8 ## Require a maximum length for passwords. max_length: 0 ## Require uppercase characters. require_uppercase: true ## Require lowercase characters. require_lowercase: true ## Require numeric characters. require_number: true ## Require special characters. require_special: true ## zxcvbn is a well known and used password strength algorithm. It does not have tunable settings. zxcvbn: enabled: false ## Configures the minimum score allowed. min_score: 3 ## ## Access Control Configuration ## ## Access control is a list of rules defining the authorizations applied for one resource to users or group of users. ## ## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed ## to anyone. Otherwise restrictions follow the rules defined. ## ## Note: One can use the wildcard * to match any subdomain. ## It must stand at the beginning of the pattern. (example: *.mydomain.com) ## ## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct. ## ## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'. ## ## - 'domain' defines which domain or set of domains the rule applies to. ## ## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not ## provided. If provided, the parameter represents either a user or a group. It should be of the form ## 'user:' or 'group:'. ## ## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'. ## ## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter ## is optional and matches any resource if not provided. ## ## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies. access_control: ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any ## resource if there is no policy to be applied to the user. default_policy: deny networks: - name: internal networks: - 10.10.0.0/16 - 192.168.2.0/24 - name: VPN networks: 10.9.0.0/16 rules: ## Rules applied to everyone - domain: '*.thefij.rocks' policy: one_factor - domain: - 'secure.example.com' - 'private.example.com' policy: two_factor ## ## Session Provider Configuration ## ## The session cookies identify the user once logged in. ## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined. session: ## The name of the session cookie. name: authelia_session domain: {{ keyOrDefault "global/base_hostname" "example.com" }} ## The secret to encrypt the session data. This is only used with Redis / Redis Sentinel. ## Secret can also be set using a secret: https://www.authelia.com/c/secrets {{ with secret "kv/data/authelia" -}} secret: {{ .Data.data.session_secret }} {{- end }} ## The value for expiration, inactivity, and remember_me_duration are in seconds or the duration notation format. ## See: https://www.authelia.com/c/common#duration-notation-format ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure ## because a stolen cookie will last longer giving attackers more time to spy or attack. ## The time before the cookie expires and the session is destroyed if remember me IS NOT selected. expiration: 1h ## The inactivity time before the session is reset. If expiration is set to 1h, and this is set to 5m, if the user ## does not select the remember me option their session will get destroyed after 1h, or after 5m since the last time ## Authelia detected user activity. inactivity: 5m ## The time before the cookie expires and the session is destroyed if remember me IS selected. ## Value of -1 disables remember me. remember_me_duration: 1M ## ## Redis Provider ## ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness ## redis: host: {{ env "NOMAD_UPSTREAM_IP_redis" }} port: {{ env "NOMAD_UPSTREAM_PORT_redis" }} ## Username used for redis authentication. This is optional and a new feature in redis 6.0. # username: authelia ## Password can also be set using a secret: https://www.authelia.com/c/secrets # password: authelia ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc). database_index: 0 ## The maximum number of concurrent active connections to Redis. maximum_active_connections: 8 ## The target number of idle connections to have open ready for work. Useful when opening connections is slow. minimum_idle_connections: 0 ## ## Regulation Configuration ## ## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are made ## in a short period of time. regulation: ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation. max_retries: 3 ## The time range during which the user can attempt login before being banned. The user is banned if the ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation. ## See: https://www.authelia.com/c/common#duration-notation-format find_time: 2m ## The length of time before a banned user can login again. Ban Time accepts duration notation. ## See: https://www.authelia.com/c/common#duration-notation-format ban_time: 5m ## ## Storage Provider Configuration ## ## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers. storage: ## The encryption key that is used to encrypt sensitive information in the database. Must be a string with a minimum ## length of 20. Please see the docs if you configure this with an undesirable key and need to change it. encryption_key: you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this ## ## MySQL / MariaDB (Storage Provider) ## {{ with secret "kv/data/authelia" -}} mysql: host: {{ env "NOMAD_UPSTREAM_IP_mysql-server" }} port: {{ env "NOMAD_UPSTREAM_PORT_mysql-server" }} database: {{ .Data.data.db_name }} username: {{ .Data.data.db_user }} password: {{ .Data.data.db_pass }} timeout: 5s {{- end }} ## ## Notification Provider ## ## Notifications are sent to users when they require a password reset, a Webauthn registration or a TOTP registration. ## The available providers are: filesystem, smtp. You must use only one of these providers. notifier: ## You can disable the notifier startup check by setting this to true. disable_startup_check: false {{ with secret "kv/data/smtp" -}} smtp: host: {{ .Data.data.server }} port: {{ .Data.data.port}} username: {{ .Data.data.user }} password: {{ .Data.data.password }} ## The sender is used to is used for the MAIL FROM command and the FROM header. ## If this is not defined and the username is an email, we use the username as this value. This can either be just ## an email address or the RFC5322 'Name ' format. sender: "Authelia " ## Subject configuration of the emails sent. {title} is replaced by the text from the notifier. subject: "[Authelia] {title}" ## This address is used during the startup check to verify the email configuration is correct. ## It's not important what it is except if your email server only allows local delivery. startup_check_address: test@authelia.com {{- end }} ## ## Identity Providers ## # identity_providers: ## ## OpenID Connect (Identity Provider) ## ## It's recommended you read the documentation before configuration of this section: ## https://www.authelia.com/c/oidc # oidc: ## The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens). ## HMAC Secret can also be set using a secret: https://www.authelia.com/c/secrets # hmac_secret: this_is_a_secret_abc123abc123abc ## The issuer_private_key is used to sign the JWT forged by OpenID Connect. ## Issuer Private Key can also be set using a secret: https://www.authelia.com/c/secrets # issuer_private_key: | # --- KEY START # --- KEY END ## The lifespans configure the expiration for these token types. # access_token_lifespan: 1h # authorize_code_lifespan: 1m # id_token_lifespan: 1h # refresh_token_lifespan: 90m ## Enables additional debug messages. # enable_client_debug_messages: false ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for ## security reasons. # minimum_parameter_entropy: 8 ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it set to 'never' ## for security reasons. # enforce_pkce: public_clients_only ## Cross-Origin Resource Sharing (CORS) settings. # cors: ## List of endpoints in addition to the metadata endpoints to permit cross-origin requests on. # endpoints: # - authorization # - token # - revocation # - introspection # - userinfo ## List of allowed origins. ## Any origin with https is permitted unless this option is configured or the ## allowed_origins_from_client_redirect_uris option is enabled. # allowed_origins: # - https://example.com ## Automatically adds the origin portion of all redirect URI's on all clients to the list of allowed_origins, ## provided they have the scheme http or https and do not have the hostname of localhost. # allowed_origins_from_client_redirect_uris: false ## Clients is a list of known clients and their configuration. # clients: # - ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration. # id: myapp ## The description to show to users when they end up on the consent screen. Defaults to the ID above. # description: My Application ## The client secret is a shared secret between Authelia and the consumer of this client. # secret: this_is_a_secret ## Sector Identifiers are occasionally used to generate pairwise subject identifiers. In most cases this is not ## necessary. Read the documentation for more information. ## The subject identifier must be the host component of a URL, which is a domain name with an optional port. # sector_identifier: example.com ## Sets the client to public. This should typically not be set, please see the documentation for usage. # public: false ## The policy to require for this client; one_factor or two_factor. # authorization_policy: two_factor ## By default users cannot remember pre-configured consents. Setting this value to a period of time using a ## duration notation will enable users to remember consent for this client. The time configured is the amount ## of time the pre-configured consent is valid for granting new authorizations to the user. # pre_configured_consent_duration: ## Audience this client is allowed to request. # audience: [] ## Scopes this client is allowed to request. # scopes: # - openid # - groups # - email # - profile ## Redirect URI's specifies a list of valid case-sensitive callbacks for this client. # redirect_uris: # - https://oidc.example.com:8080/oauth2/callback ## Grant Types configures which grants this client can obtain. ## It's not recommended to define this unless you know what you're doing. # grant_types: # - refresh_token # - authorization_code ## Response Types configures which responses this client can be sent. ## It's not recommended to define this unless you know what you're doing. # response_types: # - code ## Response Modes configures which response modes this client supports. # response_modes: # - form_post # - query # - fragment ## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256. # userinfo_signing_algorithm: none