initial commit

Signed-off-by: Robert Günzler <r@gnzler.io>

7 files changed, 240 insertions, 0 deletions

diff --git a/bundles/authelia/files/configuration.yml b/bundles/authelia/files/configuration.yml
new file mode 100644
index 0000000..39cf40f
--- /dev/null
+++ b/bundles/authelia/files/configuration.yml
@@ -0,0 +1,59 @@
+
+log:
+  level: debug
+
+telemetry:
+  metrics:
+    enabled: true
+
+access_control:
+  default_policy: 'deny'
+  rules:
+    # bypass api endpoints
+    - domain: 'rss.gzr.im'
+      resources: ['^/v1/']
+      policy: 'bypass'
+    - domain: 'paper.gzr.im'
+      resources: ['^/api/']
+      policy: 'bypass'
+    # 1factor is fine
+    - domain:
+        - 'rss.gzr.im'
+        - 'paper.gzr.im'
+        - 'tv.gzr.im'
+        - 'photos.gzr.im'
+      policy: 'one_factor'
+    # 2factor is a sane default
+    - domain:
+        - 'gzr.im'
+        - '*.gzr.im'
+      policy: 'two_factor'
+
+# regulation:
+#   max_retries: 3
+#   find_time: '2 minutes'
+#   ban_time: '5 minutes'
+
+session:
+  cookies:
+    - name: 'authelia_session'
+      domain: 'gzr.im'  # Should match whatever your root protected domain is
+      authelia_url: 'https://login.gzr.im'
+      # relaxed expiry and inactivity
+      expiration: '3w'
+      inactivity: '3w'
+      # blank auth should go back to account page
+      default_redirection_url: 'https://login.gzr.im/authenticated'
+
+notifier:
+  filesystem:
+    filename: /notifier/message.txt
+
+totp:
+  issuer: 'login.gzr.im'
+
+webauthn:
+  enable_passkey_login: true
+
+duo_api:
+  disable: true
diff --git a/bundles/authelia/files/configuration_oidc.yml b/bundles/authelia/files/configuration_oidc.yml
new file mode 100644
index 0000000..34280d3
--- /dev/null
+++ b/bundles/authelia/files/configuration_oidc.yml
@@ -0,0 +1,39 @@
+
+identity_providers:
+  oidc:
+    jwks:
+      - key: |-
+          ${repo.libs.util.indent(repo.vault.decrypt("encrypt$gAAAAABnOUxLHGPI8B_65SL7obl2v4_3E8J1i271tq-JfX2ohlz8PLydbQRI-wJlg-4kqm3Bp1jkH5BXa92KP9ZEseqadX7uLWU-9cVKj8WAUNlC3VoBFubNRb_crVKOavI3zCJd_9--CpTVCdR062EaR8AJUeiTLkTx8DU2CcaMFKLQ1nuUA4tpEk8dyVhvwtlbm8ItjCdvfl-CTBVE3LoczY6E_I35bKEcDvT_fS1Y6fDFV2S6PxRQSWLByfwsVFMkkHza1gNqvejaNggHxI-hjzlCHPdjlgpRBhd9Sd-Zs3u8PU5GhShhc2SlRv640QBzfrAcxckMDlYUcgvkcp38AiDF9rKgQiUfYSoHIg8dJJMP8pYHGYSIdCZQY7tw5Pdge_xVAEM3KIiIh6IPRm3iJ8ZG4HFq0Xjh42T86BCcYUsY_RGBBKaygf4UvDotlb3Np5v9mYc7jun8Z-DrGmEt6a5fHw9JlmFpbDaqp-pLzv9aq9TD9yGB-hisLTJbEjp3VzOc5GPhROH5qYxbeHqoisGeETNI575tOnS_MN-skJlWU2Uaglep1wH4gWyWRQqA-Xb5d2LZYenMldJ7DJhFCO8XgAcFgQrdma1MlmumEUmQYuM0IeOhq862rnO1UgQQ_gXOVyT4yYUSK3C0-s28slkN3b82tyyl7YzNKQpyUHGTIsKlDIpntX_TTy78wBJLjmF8C8RphZCixOFgrEvt8puBDvBLlJDkq4xgJTkExYsTsZaG-TJxXYtIR-yfWgTiMKnflFYK6um-JsaaIVfeKtcRdVao70V9vRaDER5DWE1XCCXWQru0BBMBbv_qpDeHYrjgZrkEhZZeXgveS-2f5PMlFFRhTkXRj-8qe9cO3qBsoZOBxLCCs_-ueyNH7jqw8_Yn8H-qrt5KI8MuKXTqwjQpbeW2JXiqusiqrVQElx3efNoCohdXtvSyTD7D-UriPij85he8sDJv_YouScHb3ItGbJrv0mPiAUO0iX_XA0I6Ck2jETlc6brzzmyKc23pdj-clkWZENouaiitoiYKECIlergumMmId0WjcMiXpA0Jwe8rfPT4S2QiemUsiM1u5SMkI6eSL8uQTUr_kavlUFV3r3yZqeQk1SpGT2hB_iMkqcNzliwk6J6n_ohqEzC8IP1yM4EzFKh2P2Q1n_Ro2MZsk7wjjLdm32895b_0o3FF-4pA4NSm0UZ-kvibebn-8TVhv2eRn-DsWgtzXDxWtAwBUtHKtQX6MZQVuswTZTSSuh6piQV4AnKaGpr7Gt1G0-VUG8QI9uuc-hBdwuZbS-q_d19UGabJxAw1Ssh3UOA__Bfhc9_2TZ2a6VKfzXih1-mxFQfA0EQJ4E4cktFfv6YEOlFsJ6ayfaCEJM4UhmuArKWLidaOnRVgO3qn-GG-p-q294O4Z1GSD8gddVrfdOymHRBjPbVMRvvQCUzvEdrt_oAqUWhG5ZenS6jF2aLZtDMVu-E87GKYKEDFSwybMRlEfiAS6GEySUB9MEGqrskf-u_esVv2U-luDV1GBhXi08n8RsLjOScEc59iZMC1CEFM0tG1kAPIE-57XK-Ja0tw3TofMXa6xauL8CnFMqYhdPTwUHeTwv7LM9n3kFksjAFcYAp8TeI-NPktswjFBsRaBc1-55BUJfhzKzL-DPJLHI_O7H9GhaSKlO0HGKcR7iUayR_GHfhdkAEZIdd5qXKOUIvd5o4n1klXrN1svBpRODlN3bmC6t9EmFYTSGSZNfNqrRrS7JNBioM0INuVQyqFXBqeavlTvSStEAaJxtCegt5bsqWNpuvQA06b7xyTcqiaQ8CaB9RzOx-xI7Vii0y-1gTjq35_rpndvNqVZC_hpPpTt-4ZQVJAmzYPZ6TIsiBcUTnOc1fRUEV1PtVJm0KhHWV_GNrHdkiHsmNtb759gKHo16-k2eyvOTUEXNwMRgQ3_U9PV2qXxoiAfiKFbgSDIy4qSdhsm2C4VREmlspkNEMgy6JB2QGygzrOs4uOS1p4lcbKvmhVllqqLyQ9nW_FkjkeibVQHvlKGX7V-NoFlWeyJ15XOupRb-3Wh8ibjOMD8IlX9vIhTJSJh54fy9DbrCo-UR8BIpP7JT0FeTKcbmjtmS7TuyRO8jpSqdiRys_rT-Ebgc-sq77uLpNBN1YBZU0VB848tSKM30Nl2wl-o9NBVh8tjGF8NsJyCoF0lR4w1rvVURNPj7dKsn6w_Qz4QKrTtUIo8jYkBy_VwbySJz6aN2CUM66_2h6_wxwopGaCYV18p3lhBe7u5WwqrCJ563b2VW7NBE5MD1AZbOCKmOWBSdnZud7Ee2U6nNr9jeAyDTCaut4NSS-ecDqnrDYxp9SSXVY="), " "*10, "not_first")}
+
+    clients:
+      - client_id: jellyfin
+        client_name: 'Jellyfin'
+        client_secret: '${repo.libs.util.hash_bcrypt(repo.vault.cmd(f"rbw get authelia/client/jellyfin"), repo.vault.decrypt("encrypt$gAAAAABnOVCVoszwYPX_uTEIrMSyX94T_Mi8965InBlhKjkNBHMnN96ihiIt4yi8uYRl9DM70aPIwzXm2XVa_AXEEuIzbMJHBum6LTVDDE9CUYUErSFskMw="))}'
+        authorization_policy: one_factor
+        redirect_uris:
+          - https://tv.gzr.im/sso/OID/redirect/authelia
+          - https://tv.gzr.im/sso/OID/r/authelia
+        token_endpoint_auth_method: client_secret_post
+
+      - client_id: paperless
+        client_name: 'Paperless-ngx'
+        client_secret: '${repo.libs.util.hash_bcrypt(repo.vault.cmd(f"rbw get authelia/client/paperless"), repo.vault.decrypt("encrypt$gAAAAABnOVCVoszwYPX_uTEIrMSyX94T_Mi8965InBlhKjkNBHMnN96ihiIt4yi8uYRl9DM70aPIwzXm2XVa_AXEEuIzbMJHBum6LTVDDE9CUYUErSFskMw="))}'
+        pkce_challenge_method: 'S256'
+        authorization_policy: one_factor
+        # consent_mode: implicit
+        redirect_uris:
+          - https://paper.gzr.im/accounts/oidc/authelia/login/callback/
+
+      - client_id: immich
+        client_name: 'Immich'
+        client_secret: '${repo.libs.util.hash_bcrypt(repo.vault.password_for("authelia_client_secret_immich"), repo.vault.decrypt("encrypt$gAAAAABnOVCVoszwYPX_uTEIrMSyX94T_Mi8965InBlhKjkNBHMnN96ihiIt4yi8uYRl9DM70aPIwzXm2XVa_AXEEuIzbMJHBum6LTVDDE9CUYUErSFskMw="))}'
+        authorization_policy: one_factor
+        token_endpoint_auth_method: client_secret_post
+        redirect_uris:
+          - https://photos.gzr.im/auth/login
+          - https://photos.gzr.im/user-settings
+          - https://photos.gzr.im/api/oauth/mobile-redirect
+          - app.immich:///oauth-callback # required since immich v1.113.0
+
+        # consent_mode: pre-configured
+        # pre_configured_consent_duration: 1w
diff --git a/bundles/authelia/files/kube.yaml b/bundles/authelia/files/kube.yaml
new file mode 100644
index 0000000..cda7d2c
--- /dev/null
+++ b/bundles/authelia/files/kube.yaml
@@ -0,0 +1,72 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authelia
+data:
+  X_AUTHELIA_CONFIG: /config/configuration.yml,/config/configuration_oidc.yml
+  X_AUTHELIA_CONFIG_FILTERS: template
+  AUTHELIA_AUTHENTICATION_BACKEND_FILE_PATH: /config/users.yml
+  AUTHELIA_STORAGE_LOCAL_PATH: /data/db.sqlite3
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: authelia
+  labels:
+    traefik.enable: true
+    traefik.http.routers.authelia.tls: true
+    traefik.http.routers.authelia.tls.certresolver: le
+    traefik.http.routers.authelia.entrypoints: http,https
+    traefik.http.routers.authelia.rule: Host(`login.gzr.im`)
+    traefik.http.routers.authelia.service: authelia
+    traefik.http.services.authelia.loadbalancer.server.port: 9091
+    # metrics
+    traefik.http.routers.authelia-metrics.entrypoints: metrics
+    traefik.http.routers.authelia-metrics.rule: Path(`/metrics/authelia`)
+    traefik.http.routers.authelia-metrics.service: authelia-metrics
+    traefik.http.routers.authelia-metrics.middlewares: replacepath-metrics
+    traefik.http.services.authelia-metrics.loadbalancer.server.port: 9959
+spec:
+  restartPolicy: Never
+  dnsPolicy: Default
+  imagePullPolicy: Always
+  containers:
+    - name: authelia
+      image: ghcr.io/authelia/authelia:4.39.4
+      envFrom:
+        - configMapRef:
+            name: authelia
+        - secretRef:
+            name: authelia
+      ports:
+        - containerPort: 9091
+          protocol: TCP
+        - containerPort: 9959
+          protocol: TCP
+      volumeMounts:
+        - name: config
+          mountPath: /config
+        - name: data
+          mountPath: /data
+        - name: notifier
+          mountPath: /notifier
+      livenessProbe: null
+      resources:
+        requests:
+          cpu: 50m
+          memory: 30Mi
+        limits:
+          cpu: 100m
+          memory: 250Mi
+
+  volumes:
+    - name: config
+      hostPath:
+        path: /var/lib/authelia/config
+        type: DirectoryOrCreate
+    - name: data
+      hostPath:
+        path: /var/lib/authelia/data
+        type: DirectoryOrCreate
+    - name: notifier # TODO
+      emptyDir: {}
diff --git a/bundles/authelia/files/secret.yaml b/bundles/authelia/files/secret.yaml
new file mode 100644
index 0000000..aef62c7
--- /dev/null
+++ b/bundles/authelia/files/secret.yaml
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: authelia
+data:
+  AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET: ${repo.vault.password_for("authelia_jwt").b64encode().value}
+  AUTHELIA_SESSION_SECRET: ${repo.vault.password_for("authelia_session_sec").b64encode().value}
+  AUTHELIA_STORAGE_ENCRYPTION_KEY: ${repo.vault.password_for("authelia_storage_encryption_key").b64encode().value}
+  AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET: ${repo.vault.password_for("authelia_oidc_hmac").b64encode().value}
diff --git a/bundles/authelia/files/users.yml b/bundles/authelia/files/users.yml
new file mode 100644
index 0000000..5788d6b
--- /dev/null
+++ b/bundles/authelia/files/users.yml
@@ -0,0 +1,19 @@
+users:
+  robert:
+    disabled: false
+    displayname: "Robert"
+    password: '${repo.libs.util.hash_bcrypt(repo.vault.cmd(f"rbw get authelia/robert/pw"), repo.vault.decrypt("encrypt$gAAAAABnOVCVoszwYPX_uTEIrMSyX94T_Mi8965InBlhKjkNBHMnN96ihiIt4yi8uYRl9DM70aPIwzXm2XVa_AXEEuIzbMJHBum6LTVDDE9CUYUErSFskMw="))}'
+    email: robert@gnzler.de
+    groups:
+      - admins
+      - jellyfin
+      - jellyfin-anime
+      - jellyfin-misc
+
+  gonca:
+    disabled: false
+    displayname: "Gonca"
+    password: '${repo.libs.util.hash_bcrypt(repo.vault.cmd(f"rbw get authelia/gonca/pw"), repo.vault.decrypt("encrypt$gAAAAABnOVCVoszwYPX_uTEIrMSyX94T_Mi8965InBlhKjkNBHMnN96ihiIt4yi8uYRl9DM70aPIwzXm2XVa_AXEEuIzbMJHBum6LTVDDE9CUYUErSFskMw="))}'
+    email: hi@gonca.me
+    groups:
+      - jellyfin
diff --git a/bundles/authelia/items.py b/bundles/authelia/items.py
new file mode 100644
index 0000000..0ac3a71
--- /dev/null
+++ b/bundles/authelia/items.py
@@ -0,0 +1,29 @@
+files = {
+    "/var/lib/authelia/config/configuration.yml": {
+        "content_type": "text",
+        "mode": "0600",
+        "triggers": {"svc_s6rc:authelia:restart"},
+    },
+    "/var/lib/authelia/config/configuration_oidc.yml": {
+        "content_type": "mako",
+        "mode": "0600",
+        "triggers": {"svc_s6rc:authelia:restart"},
+    },
+    "/var/lib/authelia/config/users.yml": {
+        "content_type": "mako",
+        "mode": "0600",
+        "triggers": {"svc_s6rc:authelia:restart"},
+    },
+
+    "/etc/deployments/authelia/kube.yaml": {
+        "content_type": "mako",
+        "source": "kube.yaml",
+        "triggers": {"svc_s6rc:authelia:restart"},
+    },
+    "/etc/deployments/authelia/secret.yaml": {
+        "content_type": "mako",
+        "source": "secret.yaml",
+        "mode": "0600",
+        "triggers": {"svc_s6rc:authelia:restart"},
+    },
+}
diff --git a/bundles/authelia/metadata.py b/bundles/authelia/metadata.py
new file mode 100644
index 0000000..294e295
--- /dev/null
+++ b/bundles/authelia/metadata.py
@@ -0,0 +1,13 @@
+defaults = {
+    "backup": {
+        "includes": {
+            "/var/lib/authelia/data",
+        }
+    },
+    "containers": {
+        "authelia": {},
+    },
+    "metrics": {
+        "authelia": {},
+    },
+}