1
authelia/
2
├── configuration.yml
3
├── users.yml
4
├── docker-compose.yml
5
└── secrets

1
services:
2
    authelia:
3
        image: "authelia/authelia"
4
        container_name: "authelia"
5
        volumes:
6
            - "./secrets:/secrets:ro"
7
            - "./config:/config"
8
            - "./logs:/var/log/authelia/"
9
        networks:
10
            proxy:
11
        labels:
12
            - "traefik.enable=true"
13
            - "traefik.http.routers.authelia.rule=Host(`authelia.domain.ru`)"
14
            - "traefik.http.routers.authelia.entrypoints=https"
15
            - "traefik.http.routers.authelia.tls=true"
16
            - "traefik.http.middlewares.authelia.forwardAuth.address=http://authelia:9091/api/verify?rd=https://authelia.stilicho.ru"
17
            - "traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader=true"
18
            - "traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email"
19
            - "traefik.http.services.authelia.loadbalancer.server.port=9091"
20
        environment:
21
            TZ: "Europe/Moscow"
22
            AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE: "/secrets/JWT_SECRET" # tr -cd '[:alnum:]' < /dev/urandom | fold -w 64 | head -n 1 > ./secrets/JWT_SECRET
23
            AUTHELIA_SESSION_SECRET_FILE: "/secrets/SESSION_SECRET" # tr -cd '[:alnum:]' < /dev/urandom | fold -w 64 | head -n 1 > ./secrets/SESSION_SECRET
24
            AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: "/secrets/STORAGE_ENCRYPTION_KEY" # tr -cd '[:alnum:]' < /dev/urandom | fold -w 64 | head -n 1 > ./secrets/STORAGE_ENCRYPTION_KEY
25

26
    #whoami-secure:
27
    #    image: "traefik/whoami"
28
    #    restart: "unless-stopped"
29
    #    container_name: "whoami-secure"
30
    #    labels:
31
    #        - "traefik.enable=true"
32
    #        - "traefik.http.routers.whoami-secure.rule=Host(`whoami-secure.stilicho.ru`)"
33
    #        - "traefik.http.routers.whoami-secure.entrypoints=https"
34
    #        - "traefik.http.routers.whoami-secure.middlewares=authelia@docker"
35
    #    networks:
36
    #        proxy:
37

38
networks:
39
    proxy:
40
        external: true

1
users:
2
    stilicho: ## Username
3
        displayname: "stilicho"
4
        ## WARNING: This is a default password for testing only!
5
        ## IMPORTANT: Change this password before deploying to production!
6
        ## Generate a new hash using the instructions at:
7
        ## https://www.authelia.com/reference/guides/passwords/#passwords
8
        ## Password is 'authelia'
9
        password: "$argon2id$v=19$m=65536,t=3,p=4$uSPUUUh/a5U7pNso6g2cMA$YJECeQHkv/qXZDB3W9ADkWj7DMSJRWcn/pVHTUvCbtI"
10
        email: "authelia@authelia.com"
11
        groups:
12
            - "admin"
13
            - "dev"

1
server:
2
    address: tcp://0.0.0.0:9091/
3
log:
4
    level: debug
5
theme: dark
6
# This secret can also be set using the env variables AUTHELIA_JWT_SECRET_FILE
7
#jwt_secret:
8
default_redirection_url: https://authelia.stilicho.ru
9
totp:
10
    issuer: authelia.com
11

12
# duo_api:
13
#  hostname: api-123456789.example.com
14
#  integration_key: ABCDEF
15
#  # This secret can also be set using the env variables AUTHELIA_DUO_API_SECRET_KEY_FILE
16
#  secret_key: 1234567890abcdefghifjkl
17

18
authentication_backend:
19
    file:
20
        path: /config/users.yml
21
        password:
22
            algorithm: argon2
23
            # Recommended Parameters
24
            # Uses 2 GiB memory, then immediately releases it.
25
            # See https://www.authelia.com/reference/guides/passwords/#recommended-parameters-argon2
26
            # See https://www.rfc-editor.org/rfc/rfc9106.html#section-4 for details on tuning the parameters for your hardware.
27
            # After saving configuration file, password hash can be generated by running: docker run -v ./configuration.yml:/configuration.yml --rm authelia/authelia:latest authelia crypto hash generate --config /configuration.yml --password 'yourpassword'
28
            argon2:
29
                variant: argon2id
30
                iterations: 1
31
                memory: 2097152
32
                parallelism: 4
33
                key_length: 32
34
                salt_length: 16
35
            # Recommended Parameters when constrained by low memory or low powered hardware. Uses 64 KiB memory, then immediately releases it.
36
            # argon2:
37
            #   variant: argon2id
38
            #   iterations: 3
39
            #   memory: 65536
40
            #   parallelism: 4
41
            #   key_length: 32
42
            #   salt_length: 16
43

44
access_control:
45
    default_policy: deny
46
    rules:
47
        # Rules applied to everyone
48
        - domain: traefik-dashboard.stilicho.ru
49
          policy: two_factor
50
        #- domain: portainer.stilicho.ru #для portainer есть oidc
51
        #  policy: two_factor
52
        - domain: nginx.stilicho.ru
53
          policy: two_factor
54

55
session:
56
    name: authelia_session
57
    # This secret can also be set using the env variables AUTHELIA_SESSION_SECRET_FILE
58
    #secret:
59
    expiration: 14400 # 4 hour
60
    inactivity: 14400 # 4 hour
61
    domain: stilicho.ru # Should match whatever your root protected domain is
62

63
    # redis:
64
    #   host: redis
65
    #   port: 6379
66
    #   # This secret can also be set using the env variables AUTHELIA_SESSION_REDIS_PASSWORD_FILE
67
    #   # password: authelia
68

69
regulation:
70
    max_retries: 3
71
    find_time: 120
72
    ban_time: 300
73

74
storage:
75
    #encryption_key: /secrets/STORAGE_ENCRYPTION_KEY # Now required
76
    local:
77
        path: /config/db.sqlite3
78

79
#password_policy:
80
#  zxcvbn:
81
#    enabled: true
82
#    min_score: 4
83

84
#identity_providers:
85
#  oidc:
86
## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
87
## See: https://www.authelia.com/c/oidc
88
#    clients:
89
#      - client_id: 'portainer'
90
#        client_name: 'Portainer'
91
#        client_secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
92
#        public: false
93
#        authorization_policy: 'two_factor'
94
#        require_pkce: false
95
#        pkce_challenge_method: ''
96
#        redirect_uris:
97
#          - 'https://portainer.stilicho.ru'
98
#        scopes:
99
#         - 'openid'
100
#          - 'profile'
101
#          - 'groups'
102
#          - 'email'
103
#        response_types:
104
#          - 'code'
105
#        grant_types:
106
#          - 'authorization_code'
107
#        access_token_signed_response_alg: 'none'
108
#        userinfo_signed_response_alg: 'none'
109
#        token_endpoint_auth_method: 'client_secret_post'
110

111
#log:
112
#  level: info
113
#  format: text
114
#  file_path: /logs/authelia.log
115
#  keep_stdout: false
116

117
notifier:
118
    # smtp:
119
    #   username: test
120
    #   # This secret can also be set using the env variables AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE
121
    #   password: password
122
    #   host: mail.example.com
123
    #   port: 25
124
    #   sender: admin@example.com
125
    filesystem:
126
        filename: /config/notification.txt