# Miscellaneous https://www.authelia.com/configuration/miscellaneous/introduction/
# Set also AUTHELIA_JWT_SECRET_FILE
theme: auto

# First Factor https://www.authelia.com/configuration/first-factor/file/
authentication_backend:
  file:
    path: /config/data/users_database.yml

# Second Factor https://www.authelia.com/configuration/second-factor/introduction/
totp:
  issuer: 64815139.xyz

# Security https://www.authelia.com/configuration/security/access-control/
access_control:
  default_policy: "deny"
  rules:
    - domain: "*.64815139.xyz"
      policy: "two_factor"

# Session https://www.authelia.com/configuration/session/introduction/
# Set also AUTHELIA_SESSION_SECRET_FILE
session:
  cookies:
    - domain: "64815139.xyz"
      authelia_url: "https://auth.64815139.xyz"

  # https://www.authelia.com/configuration/session/redis/
  # Set also AUTHELIA_SESSION_REDIS_PASSWORD_FILE if appropriate
  redis:
    host: redis
    port: 6379

# Storage https://www.authelia.com/configuration/storage/postgres/
# Set also AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE
# Set also AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE
storage:
  postgres:
    address: "tcp://postgres:5432"
    database: "authelia"
    username: "authelia"

server:
  endpoints:
    authz:
      forward-auth:
        implementation: "ForwardAuth"

# SMTP Notifier https://www.authelia.com/configuration/notifications/smtp/
# Set also AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE
notifier:
  smtp:
    address: "smtp://in-v3.mailjet.com:587"
    username: '{{ secret "/run/secrets/SMTP_USERNAME" }}'
    sender: "Authelia <authelia@64815139.xyz>"

identity_providers:
  oidc:
    jwks:
      - key_id: "authelia"
        algorithm: "RS256"
        use: "sig"
        certificate_chain: {{ secret "/run/secrets/OIDC_JWKS_AUTHELIA_PEM" | mindent 10 "|" | msquote }}
        key: {{ secret "/run/secrets/OIDC_JWKS_AUTHELIA_CERT" | mindent 10 "|" | msquote }}
    enable_client_debug_messages: false
    minimum_parameter_entropy: 8
    enforce_pkce: "public_clients_only"
    enable_pkce_plain_challenge: false
    enable_jwt_access_token_stateless_introspection: false
    discovery_signed_response_alg: "none"
    discovery_signed_response_key_id: ""
    require_pushed_authorization_requests: false
    lifespans:
      access_token: "1h"
      authorize_code: "1m"
      id_token: "1h"
      refresh_token: "90m"
    cors:
      endpoints:
        - "authorization"
        - "token"
        - "revocation"
        - "introspection"
      allowed_origins:
        - "https://immich.64815139.xyz"
        - "https://gitea.64815139.xyz"
        - "https://stirling-pdf.64815139.xyz"
      allowed_origins_from_client_redirect_uris: false
    clients:
      - client_id: T0kYrFHTASAXGCV-rUOlQLDGsW0HFJRx_eAQ1dx9mo-vTgilubJMU46Ud1oRexmtZBjgAsEp
        client_name: Gitea
        client_secret: {{ secret "/run/secrets/GITEA_CLIENT_SECRET" }} 
        public: false
        authorization_policy: "two_factor"
        consent_mode: pre-configured
        token_endpoint_auth_method: "client_secret_post"
        pre_configured_consent_duration: 1w
        scopes:
          - "openid"
          - "email"
          - "profile"
        redirect_uris:
          - https://gitea.64815139.xyz/user/oauth2/Authelia/callback
      - client_id: Qzmj9S-sJi0bDpUFhuJgqwJPiiGqEBtUGLmjqcZxFpLfQzb7Y9LxnmvZ2K1YoZT2vAXDqWi5
        client_name: Immich
        client_secret: {{ secret "/run/secrets/IMMICH_CLIENT_SECRET" }} 
        public: false
        authorization_policy: two_factor
        consent_mode: pre-configured
        token_endpoint_auth_method: "client_secret_post"
        pre_configured_consent_duration: 1w
        scopes:
          - openid
          - groups
          - email
          - profile
          - offline_access
        redirect_uris:
          - https://auth.64815139.xyz/
          - https://auth.64815139.xyz/oauth2/callback
          - https://immich.64815139.xyz/oauth2/callback
          - https://immich.64815139.xyz/auth/login
          - https://immich.64815139.xyz/user-settings
          - https://immich.64815139.xyz
          - app.immich:/
          - app.immich:///oauth-callback
          - https://immich.64815139.xyz/api/oauth/mobile-redirect
        grant_types:
          - refresh_token
          - authorization_code
        response_types:
          - code
        response_modes:
          - form_post
          - query
          - fragment
      - client_id: 'GXbZWCII_iRwoQAjtpP6WzXDKagzYZC~dRSq3QMgJyb3RrvcPG0n.Elm3NnEpq8LLh_uZktw'
        client_name: 'Stirling-PDF'
        client_secret: {{ secret "/run/secrets/STIRLING_PDF_CLIENT_SECRET" }}
        public: false
        authorization_policy: 'two_factor'
        require_pkce: false
        pkce_challenge_method: ''
        redirect_uris:
          - 'https://stirling-pdf.64815139.xyz/login/oauth2/code/oidc'
        scopes:
          - 'openid'
          - 'profile'
          - 'groups'
          - 'email'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_basic'