1 files changed, 59 insertions, 0 deletions
diff --git a/bundles/authelia/files/configuration.yml b/bundles/authelia/files/configuration.yml
new file mode 100644
index 0000000..39cf40f
--- /dev/null
+++ b/bundles/authelia/files/configuration.yml
@@ -0,0 +1,59 @@
+
+log:
+  level: debug
+
+telemetry:
+  metrics:
+    enabled: true
+
+access_control:
+  default_policy: 'deny'
+  rules:
+    # bypass api endpoints
+    - domain: 'rss.gzr.im'
+      resources: ['^/v1/']
+      policy: 'bypass'
+    - domain: 'paper.gzr.im'
+      resources: ['^/api/']
+      policy: 'bypass'
+    # 1factor is fine
+    - domain:
+        - 'rss.gzr.im'
+        - 'paper.gzr.im'
+        - 'tv.gzr.im'
+        - 'photos.gzr.im'
+      policy: 'one_factor'
+    # 2factor is a sane default
+    - domain:
+        - 'gzr.im'
+        - '*.gzr.im'
+      policy: 'two_factor'
+
+# regulation:
+#   max_retries: 3
+#   find_time: '2 minutes'
+#   ban_time: '5 minutes'
+
+session:
+  cookies:
+    - name: 'authelia_session'
+      domain: 'gzr.im'  # Should match whatever your root protected domain is
+      authelia_url: 'https://login.gzr.im'
+      # relaxed expiry and inactivity
+      expiration: '3w'
+      inactivity: '3w'
+      # blank auth should go back to account page
+      default_redirection_url: 'https://login.gzr.im/authenticated'
+
+notifier:
+  filesystem:
+    filename: /notifier/message.txt
+
+totp:
+  issuer: 'login.gzr.im'
+
+webauthn:
+  enable_passkey_login: true
+
+duo_api:
+  disable: true