136 lines
4.3 KiB
YAML
136 lines
4.3 KiB
YAML
# Miscellaneous https://www.authelia.com/configuration/miscellaneous/introduction/
|
|
# Set also AUTHELIA_JWT_SECRET_FILE
|
|
theme: auto
|
|
|
|
# First Factor https://www.authelia.com/configuration/first-factor/file/
|
|
authentication_backend:
|
|
file:
|
|
path: /config/data/users_database.yml
|
|
|
|
# Second Factor https://www.authelia.com/configuration/second-factor/introduction/
|
|
totp:
|
|
issuer: 64815139.xyz
|
|
|
|
# Security https://www.authelia.com/configuration/security/access-control/
|
|
access_control:
|
|
default_policy: "deny"
|
|
rules:
|
|
- domain: "*.64815139.xyz"
|
|
policy: "two_factor"
|
|
|
|
# Session https://www.authelia.com/configuration/session/introduction/
|
|
# Set also AUTHELIA_SESSION_SECRET_FILE
|
|
session:
|
|
cookies:
|
|
- domain: "64815139.xyz"
|
|
authelia_url: "https://auth.64815139.xyz"
|
|
|
|
# https://www.authelia.com/configuration/session/redis/
|
|
# Set also AUTHELIA_SESSION_REDIS_PASSWORD_FILE if appropriate
|
|
redis:
|
|
host: redis
|
|
port: 6379
|
|
|
|
# Storage https://www.authelia.com/configuration/storage/postgres/
|
|
# Set also AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE
|
|
# Set also AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE
|
|
storage:
|
|
postgres:
|
|
address: "tcp://postgres:5432"
|
|
database: "authelia"
|
|
username: "authelia"
|
|
|
|
server:
|
|
endpoints:
|
|
authz:
|
|
forward-auth:
|
|
implementation: 'ForwardAuth'
|
|
|
|
# SMTP Notifier https://www.authelia.com/configuration/notifications/smtp/
|
|
# Set also AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE
|
|
notifier:
|
|
smtp:
|
|
address: "smtp://in-v3.mailjet.com:587"
|
|
username: '{{ secret "/run/secrets/SMTP_USERNAME" }}'
|
|
sender: "Authelia <authelia@64815139.xyz>"
|
|
|
|
identity_providers:
|
|
oidc:
|
|
jwks:
|
|
- key_id: "authelia"
|
|
algorithm: "RS256"
|
|
use: "sig"
|
|
certificate_chain: {{ secret "/run/secrets/OIDC_JWKS_AUTHELIA_PEM" | mindent 10 "|" | msquote }}
|
|
key: {{ secret "/run/secrets/OIDC_JWKS_AUTHELIA_CERT" | mindent 10 "|" | msquote }}
|
|
enable_client_debug_messages: false
|
|
minimum_parameter_entropy: 8
|
|
enforce_pkce: "public_clients_only"
|
|
enable_pkce_plain_challenge: false
|
|
enable_jwt_access_token_stateless_introspection: false
|
|
discovery_signed_response_alg: "none"
|
|
discovery_signed_response_key_id: ""
|
|
require_pushed_authorization_requests: false
|
|
lifespans:
|
|
access_token: "1h"
|
|
authorize_code: "1m"
|
|
id_token: "1h"
|
|
refresh_token: "90m"
|
|
cors:
|
|
endpoints:
|
|
- "authorization"
|
|
- "token"
|
|
- "revocation"
|
|
- "introspection"
|
|
allowed_origins:
|
|
- "https://immich.64815139.xyz"
|
|
- "https://gitea.64815139.xyz"
|
|
allowed_origins_from_client_redirect_uris: false
|
|
clients:
|
|
- client_id: T0kYrFHTASAXGCV-rUOlQLDGsW0HFJRx_eAQ1dx9mo-vTgilubJMU46Ud1oRexmtZBjgAsEp
|
|
client_name: Gitea
|
|
client_secret: {{ secret "/run/secrets/GITEA_CLIENT_SECRET" }}
|
|
public: false
|
|
authorization_policy: 'two_factor'
|
|
consent_mode: pre-configured
|
|
token_endpoint_auth_method: 'client_secret_basic'
|
|
pre_configured_consent_duration: 1w
|
|
scopes:
|
|
- 'openid'
|
|
- 'email'
|
|
- 'profile'
|
|
redirect_uris:
|
|
- https://gitea.64815139.xyz/user/oauth2/Authelia/callback
|
|
- client_id: Qzmj9S-sJi0bDpUFhuJgqwJPiiGqEBtUGLmjqcZxFpLfQzb7Y9LxnmvZ2K1YoZT2vAXDqWi5
|
|
client_name: Immich
|
|
client_secret: {{ secret "/run/secrets/IMMICH_CLIENT_SECRET" }}
|
|
public: false
|
|
authorization_policy: two_factor
|
|
consent_mode: pre-configured
|
|
token_endpoint_auth_method: 'client_secret_basic'
|
|
pre_configured_consent_duration: 1w
|
|
scopes:
|
|
- openid
|
|
- groups
|
|
- email
|
|
- profile
|
|
- offline_access
|
|
redirect_uris:
|
|
- https://auth.64815139.xyz/
|
|
- https://auth.64815139.xyz/oauth2/callback
|
|
- https://immich.64815139.xyz/oauth2/callback
|
|
- https://immich.64815139.xyz/auth/login
|
|
- https://immich.64815139.xyz/user-settings
|
|
- https://immich.64815139.xyz
|
|
- app.immich:/
|
|
- app.immich:///oauth-callback
|
|
- https://immich.64815139.xyz/api/oauth/mobile-redirect
|
|
grant_types:
|
|
- refresh_token
|
|
- authorization_code
|
|
response_types:
|
|
- code
|
|
response_modes:
|
|
- form_post
|
|
- query
|
|
- fragment
|