Set up gateway, gitea & immich

2024-10-03 22:52:55 +01:00
commit 5014282769
15 changed files with 797 additions and 0 deletions
@@ -0,0 +1,135 @@
+# Miscellaneous https://www.authelia.com/configuration/miscellaneous/introduction/
+# Set also AUTHELIA_JWT_SECRET_FILE
+theme: auto
+
+# First Factor https://www.authelia.com/configuration/first-factor/file/
+authentication_backend:
+  file:
+    path: /config/data/users_database.yml
+
+# Second Factor https://www.authelia.com/configuration/second-factor/introduction/
+totp:
+  issuer: 64815139.xyz
+
+# Security https://www.authelia.com/configuration/security/access-control/
+access_control:
+  default_policy: "deny"
+  rules:
+    - domain: "*.64815139.xyz"
+      policy: "two_factor"
+
+# Session https://www.authelia.com/configuration/session/introduction/
+# Set also AUTHELIA_SESSION_SECRET_FILE
+session:
+  cookies:
+    - domain: "64815139.xyz"
+      authelia_url: "https://auth.64815139.xyz"
+
+  # https://www.authelia.com/configuration/session/redis/
+  # Set also AUTHELIA_SESSION_REDIS_PASSWORD_FILE if appropriate
+  redis:
+    host: redis
+    port: 6379
+
+# Storage https://www.authelia.com/configuration/storage/postgres/
+# Set also AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE
+# Set also AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE
+storage:
+  postgres:
+    address: "tcp://postgres:5432"
+    database: "authelia"
+    username: "authelia"
+
+server:
+  endpoints:
+    authz:
+      forward-auth:
+        implementation: 'ForwardAuth'
+
+# SMTP Notifier https://www.authelia.com/configuration/notifications/smtp/
+# Set also AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE
+notifier:
+  smtp:
+    address: "smtp://in-v3.mailjet.com:587"
+    username: '{{ secret "/run/secrets/SMTP_USERNAME" }}'
+    sender: "Authelia <authelia@64815139.xyz>"
+
+identity_providers:
+  oidc:
+    jwks:
+      - key_id: "authelia"
+        algorithm: "RS256"
+        use: "sig"
+        certificate_chain: {{ secret "/run/secrets/OIDC_JWKS_AUTHELIA_PEM" | mindent 10 "|" | msquote }}
+        key: {{ secret "/run/secrets/OIDC_JWKS_AUTHELIA_CERT" | mindent 10 "|" | msquote }}
+    enable_client_debug_messages: false
+    minimum_parameter_entropy: 8
+    enforce_pkce: "public_clients_only"
+    enable_pkce_plain_challenge: false
+    enable_jwt_access_token_stateless_introspection: false
+    discovery_signed_response_alg: "none"
+    discovery_signed_response_key_id: ""
+    require_pushed_authorization_requests: false
+    lifespans:
+      access_token: "1h"
+      authorize_code: "1m"
+      id_token: "1h"
+      refresh_token: "90m"
+    cors:
+      endpoints:
+        - "authorization"
+        - "token"
+        - "revocation"
+        - "introspection"
+      allowed_origins:
+        - "https://immich.64815139.xyz"
+        - "https://gitea.64815139.xyz"
+      allowed_origins_from_client_redirect_uris: false
+    clients:
+      - client_id: T0kYrFHTASAXGCV-rUOlQLDGsW0HFJRx_eAQ1dx9mo-vTgilubJMU46Ud1oRexmtZBjgAsEp
+        client_name: Gitea
+        client_secret: {{ secret "/run/secrets/GITEA_CLIENT_SECRET" }} 
+        public: false
+        authorization_policy: 'two_factor'
+        consent_mode: pre-configured
+        token_endpoint_auth_method: 'client_secret_basic'
+        pre_configured_consent_duration: 1w
+        scopes:
+          - 'openid'
+          - 'email'
+          - 'profile'
+        redirect_uris:
+          - https://gitea.64815139.xyz/user/oauth2/Authelia/callback
+      - client_id: Qzmj9S-sJi0bDpUFhuJgqwJPiiGqEBtUGLmjqcZxFpLfQzb7Y9LxnmvZ2K1YoZT2vAXDqWi5
+        client_name: Immich
+        client_secret: {{ secret "/run/secrets/IMMICH_CLIENT_SECRET" }} 
+        public: false
+        authorization_policy: two_factor
+        consent_mode: pre-configured
+        token_endpoint_auth_method: 'client_secret_basic'
+        pre_configured_consent_duration: 1w
+        scopes:
+          - openid
+          - groups
+          - email
+          - profile
+          - offline_access
+        redirect_uris:
+          - https://auth.64815139.xyz/
+          - https://auth.64815139.xyz/oauth2/callback
+          - https://immich.64815139.xyz/oauth2/callback
+          - https://immich.64815139.xyz/auth/login
+          - https://immich.64815139.xyz/user-settings
+          - https://immich.64815139.xyz
+          - app.immich:/
+          - app.immich:///oauth-callback
+          - https://immich.64815139.xyz/api/oauth/mobile-redirect
+        grant_types:
+          - refresh_token
+          - authorization_code
+        response_types:
+          - code
+        response_modes:
+          - form_post
+          - query
+          - fragment