diff options
Diffstat (limited to 'bundles/authelia')
| -rw-r--r-- | bundles/authelia/files/configuration.yml | 59 | ||||
| -rw-r--r-- | bundles/authelia/files/configuration_oidc.yml | 39 | ||||
| -rw-r--r-- | bundles/authelia/files/kube.yaml | 72 | ||||
| -rw-r--r-- | bundles/authelia/files/secret.yaml | 9 | ||||
| -rw-r--r-- | bundles/authelia/files/users.yml | 19 | ||||
| -rw-r--r-- | bundles/authelia/items.py | 29 | ||||
| -rw-r--r-- | bundles/authelia/metadata.py | 13 |
7 files changed, 240 insertions, 0 deletions
diff --git a/bundles/authelia/files/configuration.yml b/bundles/authelia/files/configuration.yml new file mode 100644 index 0000000..39cf40f --- /dev/null +++ b/bundles/authelia/files/configuration.yml @@ -0,0 +1,59 @@ + +log: + level: debug + +telemetry: + metrics: + enabled: true + +access_control: + default_policy: 'deny' + rules: + # bypass api endpoints + - domain: 'rss.gzr.im' + resources: ['^/v1/'] + policy: 'bypass' + - domain: 'paper.gzr.im' + resources: ['^/api/'] + policy: 'bypass' + # 1factor is fine + - domain: + - 'rss.gzr.im' + - 'paper.gzr.im' + - 'tv.gzr.im' + - 'photos.gzr.im' + policy: 'one_factor' + # 2factor is a sane default + - domain: + - 'gzr.im' + - '*.gzr.im' + policy: 'two_factor' + +# regulation: +# max_retries: 3 +# find_time: '2 minutes' +# ban_time: '5 minutes' + +session: + cookies: + - name: 'authelia_session' + domain: 'gzr.im' # Should match whatever your root protected domain is + authelia_url: 'https://login.gzr.im' + # relaxed expiry and inactivity + expiration: '3w' + inactivity: '3w' + # blank auth should go back to account page + default_redirection_url: 'https://login.gzr.im/authenticated' + +notifier: + filesystem: + filename: /notifier/message.txt + +totp: + issuer: 'login.gzr.im' + +webauthn: + enable_passkey_login: true + +duo_api: + disable: true diff --git a/bundles/authelia/files/configuration_oidc.yml b/bundles/authelia/files/configuration_oidc.yml new file mode 100644 index 0000000..34280d3 --- /dev/null +++ b/bundles/authelia/files/configuration_oidc.yml @@ -0,0 +1,39 @@ + +identity_providers: + oidc: + jwks: + - key: |- + ${repo.libs.util.indent(repo.vault.decrypt("encrypt$gAAAAABnOUxLHGPI8B_65SL7obl2v4_3E8J1i271tq-JfX2ohlz8PLydbQRI-wJlg-4kqm3Bp1jkH5BXa92KP9ZEseqadX7uLWU-9cVKj8WAUNlC3VoBFubNRb_crVKOavI3zCJd_9--CpTVCdR062EaR8AJUeiTLkTx8DU2CcaMFKLQ1nuUA4tpEk8dyVhvwtlbm8ItjCdvfl-CTBVE3LoczY6E_I35bKEcDvT_fS1Y6fDFV2S6PxRQSWLByfwsVFMkkHza1gNqvejaNggHxI-hjzlCHPdjlgpRBhd9Sd-Zs3u8PU5GhShhc2SlRv640QBzfrAcxckMDlYUcgvkcp38AiDF9rKgQiUfYSoHIg8dJJMP8pYHGYSIdCZQY7tw5Pdge_xVAEM3KIiIh6IPRm3iJ8ZG4HFq0Xjh42T86BCcYUsY_RGBBKaygf4UvDotlb3Np5v9mYc7jun8Z-DrGmEt6a5fHw9JlmFpbDaqp-pLzv9aq9TD9yGB-hisLTJbEjp3VzOc5GPhROH5qYxbeHqoisGeETNI575tOnS_MN-skJlWU2Uaglep1wH4gWyWRQqA-Xb5d2LZYenMldJ7DJhFCO8XgAcFgQrdma1MlmumEUmQYuM0IeOhq862rnO1UgQQ_gXOVyT4yYUSK3C0-s28slkN3b82tyyl7YzNKQpyUHGTIsKlDIpntX_TTy78wBJLjmF8C8RphZCixOFgrEvt8puBDvBLlJDkq4xgJTkExYsTsZaG-TJxXYtIR-yfWgTiMKnflFYK6um-JsaaIVfeKtcRdVao70V9vRaDER5DWE1XCCXWQru0BBMBbv_qpDeHYrjgZrkEhZZeXgveS-2f5PMlFFRhTkXRj-8qe9cO3qBsoZOBxLCCs_-ueyNH7jqw8_Yn8H-qrt5KI8MuKXTqwjQpbeW2JXiqusiqrVQElx3efNoCohdXtvSyTD7D-UriPij85he8sDJv_YouScHb3ItGbJrv0mPiAUO0iX_XA0I6Ck2jETlc6brzzmyKc23pdj-clkWZENouaiitoiYKECIlergumMmId0WjcMiXpA0Jwe8rfPT4S2QiemUsiM1u5SMkI6eSL8uQTUr_kavlUFV3r3yZqeQk1SpGT2hB_iMkqcNzliwk6J6n_ohqEzC8IP1yM4EzFKh2P2Q1n_Ro2MZsk7wjjLdm32895b_0o3FF-4pA4NSm0UZ-kvibebn-8TVhv2eRn-DsWgtzXDxWtAwBUtHKtQX6MZQVuswTZTSSuh6piQV4AnKaGpr7Gt1G0-VUG8QI9uuc-hBdwuZbS-q_d19UGabJxAw1Ssh3UOA__Bfhc9_2TZ2a6VKfzXih1-mxFQfA0EQJ4E4cktFfv6YEOlFsJ6ayfaCEJM4UhmuArKWLidaOnRVgO3qn-GG-p-q294O4Z1GSD8gddVrfdOymHRBjPbVMRvvQCUzvEdrt_oAqUWhG5ZenS6jF2aLZtDMVu-E87GKYKEDFSwybMRlEfiAS6GEySUB9MEGqrskf-u_esVv2U-luDV1GBhXi08n8RsLjOScEc59iZMC1CEFM0tG1kAPIE-57XK-Ja0tw3TofMXa6xauL8CnFMqYhdPTwUHeTwv7LM9n3kFksjAFcYAp8TeI-NPktswjFBsRaBc1-55BUJfhzKzL-DPJLHI_O7H9GhaSKlO0HGKcR7iUayR_GHfhdkAEZIdd5qXKOUIvd5o4n1klXrN1svBpRODlN3bmC6t9EmFYTSGSZNfNqrRrS7JNBioM0INuVQyqFXBqeavlTvSStEAaJxtCegt5bsqWNpuvQA06b7xyTcqiaQ8CaB9RzOx-xI7Vii0y-1gTjq35_rpndvNqVZC_hpPpTt-4ZQVJAmzYPZ6TIsiBcUTnOc1fRUEV1PtVJm0KhHWV_GNrHdkiHsmNtb759gKHo16-k2eyvOTUEXNwMRgQ3_U9PV2qXxoiAfiKFbgSDIy4qSdhsm2C4VREmlspkNEMgy6JB2QGygzrOs4uOS1p4lcbKvmhVllqqLyQ9nW_FkjkeibVQHvlKGX7V-NoFlWeyJ15XOupRb-3Wh8ibjOMD8IlX9vIhTJSJh54fy9DbrCo-UR8BIpP7JT0FeTKcbmjtmS7TuyRO8jpSqdiRys_rT-Ebgc-sq77uLpNBN1YBZU0VB848tSKM30Nl2wl-o9NBVh8tjGF8NsJyCoF0lR4w1rvVURNPj7dKsn6w_Qz4QKrTtUIo8jYkBy_VwbySJz6aN2CUM66_2h6_wxwopGaCYV18p3lhBe7u5WwqrCJ563b2VW7NBE5MD1AZbOCKmOWBSdnZud7Ee2U6nNr9jeAyDTCaut4NSS-ecDqnrDYxp9SSXVY="), " "*10, "not_first")} + + clients: + - client_id: jellyfin + client_name: 'Jellyfin' + client_secret: '${repo.libs.util.hash_bcrypt(repo.vault.cmd(f"rbw get authelia/client/jellyfin"), repo.vault.decrypt("encrypt$gAAAAABnOVCVoszwYPX_uTEIrMSyX94T_Mi8965InBlhKjkNBHMnN96ihiIt4yi8uYRl9DM70aPIwzXm2XVa_AXEEuIzbMJHBum6LTVDDE9CUYUErSFskMw="))}' + authorization_policy: one_factor + redirect_uris: + - https://tv.gzr.im/sso/OID/redirect/authelia + - https://tv.gzr.im/sso/OID/r/authelia + token_endpoint_auth_method: client_secret_post + + - client_id: paperless + client_name: 'Paperless-ngx' + client_secret: '${repo.libs.util.hash_bcrypt(repo.vault.cmd(f"rbw get authelia/client/paperless"), repo.vault.decrypt("encrypt$gAAAAABnOVCVoszwYPX_uTEIrMSyX94T_Mi8965InBlhKjkNBHMnN96ihiIt4yi8uYRl9DM70aPIwzXm2XVa_AXEEuIzbMJHBum6LTVDDE9CUYUErSFskMw="))}' + pkce_challenge_method: 'S256' + authorization_policy: one_factor + # consent_mode: implicit + redirect_uris: + - https://paper.gzr.im/accounts/oidc/authelia/login/callback/ + + - client_id: immich + client_name: 'Immich' + client_secret: '${repo.libs.util.hash_bcrypt(repo.vault.password_for("authelia_client_secret_immich"), repo.vault.decrypt("encrypt$gAAAAABnOVCVoszwYPX_uTEIrMSyX94T_Mi8965InBlhKjkNBHMnN96ihiIt4yi8uYRl9DM70aPIwzXm2XVa_AXEEuIzbMJHBum6LTVDDE9CUYUErSFskMw="))}' + authorization_policy: one_factor + token_endpoint_auth_method: client_secret_post + redirect_uris: + - https://photos.gzr.im/auth/login + - https://photos.gzr.im/user-settings + - https://photos.gzr.im/api/oauth/mobile-redirect + - app.immich:///oauth-callback # required since immich v1.113.0 + + # consent_mode: pre-configured + # pre_configured_consent_duration: 1w diff --git a/bundles/authelia/files/kube.yaml b/bundles/authelia/files/kube.yaml new file mode 100644 index 0000000..cda7d2c --- /dev/null +++ b/bundles/authelia/files/kube.yaml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: authelia +data: + X_AUTHELIA_CONFIG: /config/configuration.yml,/config/configuration_oidc.yml + X_AUTHELIA_CONFIG_FILTERS: template + AUTHELIA_AUTHENTICATION_BACKEND_FILE_PATH: /config/users.yml + AUTHELIA_STORAGE_LOCAL_PATH: /data/db.sqlite3 +--- +apiVersion: v1 +kind: Pod +metadata: + name: authelia + labels: + traefik.enable: true + traefik.http.routers.authelia.tls: true + traefik.http.routers.authelia.tls.certresolver: le + traefik.http.routers.authelia.entrypoints: http,https + traefik.http.routers.authelia.rule: Host(`login.gzr.im`) + traefik.http.routers.authelia.service: authelia + traefik.http.services.authelia.loadbalancer.server.port: 9091 + # metrics + traefik.http.routers.authelia-metrics.entrypoints: metrics + traefik.http.routers.authelia-metrics.rule: Path(`/metrics/authelia`) + traefik.http.routers.authelia-metrics.service: authelia-metrics + traefik.http.routers.authelia-metrics.middlewares: replacepath-metrics + traefik.http.services.authelia-metrics.loadbalancer.server.port: 9959 +spec: + restartPolicy: Never + dnsPolicy: Default + imagePullPolicy: Always + containers: + - name: authelia + image: ghcr.io/authelia/authelia:4.39.4 + envFrom: + - configMapRef: + name: authelia + - secretRef: + name: authelia + ports: + - containerPort: 9091 + protocol: TCP + - containerPort: 9959 + protocol: TCP + volumeMounts: + - name: config + mountPath: /config + - name: data + mountPath: /data + - name: notifier + mountPath: /notifier + livenessProbe: null + resources: + requests: + cpu: 50m + memory: 30Mi + limits: + cpu: 100m + memory: 250Mi + + volumes: + - name: config + hostPath: + path: /var/lib/authelia/config + type: DirectoryOrCreate + - name: data + hostPath: + path: /var/lib/authelia/data + type: DirectoryOrCreate + - name: notifier # TODO + emptyDir: {} diff --git a/bundles/authelia/files/secret.yaml b/bundles/authelia/files/secret.yaml new file mode 100644 index 0000000..aef62c7 --- /dev/null +++ b/bundles/authelia/files/secret.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: Secret +metadata: + name: authelia +data: + AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET: ${repo.vault.password_for("authelia_jwt").b64encode().value} + AUTHELIA_SESSION_SECRET: ${repo.vault.password_for("authelia_session_sec").b64encode().value} + AUTHELIA_STORAGE_ENCRYPTION_KEY: ${repo.vault.password_for("authelia_storage_encryption_key").b64encode().value} + AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET: ${repo.vault.password_for("authelia_oidc_hmac").b64encode().value} diff --git a/bundles/authelia/files/users.yml b/bundles/authelia/files/users.yml new file mode 100644 index 0000000..5788d6b --- /dev/null +++ b/bundles/authelia/files/users.yml @@ -0,0 +1,19 @@ +users: + robert: + disabled: false + displayname: "Robert" + password: '${repo.libs.util.hash_bcrypt(repo.vault.cmd(f"rbw get authelia/robert/pw"), repo.vault.decrypt("encrypt$gAAAAABnOVCVoszwYPX_uTEIrMSyX94T_Mi8965InBlhKjkNBHMnN96ihiIt4yi8uYRl9DM70aPIwzXm2XVa_AXEEuIzbMJHBum6LTVDDE9CUYUErSFskMw="))}' + email: robert@gnzler.de + groups: + - admins + - jellyfin + - jellyfin-anime + - jellyfin-misc + + gonca: + disabled: false + displayname: "Gonca" + password: '${repo.libs.util.hash_bcrypt(repo.vault.cmd(f"rbw get authelia/gonca/pw"), repo.vault.decrypt("encrypt$gAAAAABnOVCVoszwYPX_uTEIrMSyX94T_Mi8965InBlhKjkNBHMnN96ihiIt4yi8uYRl9DM70aPIwzXm2XVa_AXEEuIzbMJHBum6LTVDDE9CUYUErSFskMw="))}' + email: hi@gonca.me + groups: + - jellyfin diff --git a/bundles/authelia/items.py b/bundles/authelia/items.py new file mode 100644 index 0000000..0ac3a71 --- /dev/null +++ b/bundles/authelia/items.py @@ -0,0 +1,29 @@ +files = { + "/var/lib/authelia/config/configuration.yml": { + "content_type": "text", + "mode": "0600", + "triggers": {"svc_s6rc:authelia:restart"}, + }, + "/var/lib/authelia/config/configuration_oidc.yml": { + "content_type": "mako", + "mode": "0600", + "triggers": {"svc_s6rc:authelia:restart"}, + }, + "/var/lib/authelia/config/users.yml": { + "content_type": "mako", + "mode": "0600", + "triggers": {"svc_s6rc:authelia:restart"}, + }, + + "/etc/deployments/authelia/kube.yaml": { + "content_type": "mako", + "source": "kube.yaml", + "triggers": {"svc_s6rc:authelia:restart"}, + }, + "/etc/deployments/authelia/secret.yaml": { + "content_type": "mako", + "source": "secret.yaml", + "mode": "0600", + "triggers": {"svc_s6rc:authelia:restart"}, + }, +} diff --git a/bundles/authelia/metadata.py b/bundles/authelia/metadata.py new file mode 100644 index 0000000..294e295 --- /dev/null +++ b/bundles/authelia/metadata.py @@ -0,0 +1,13 @@ +defaults = { + "backup": { + "includes": { + "/var/lib/authelia/data", + } + }, + "containers": { + "authelia": {}, + }, + "metrics": { + "authelia": {}, + }, +} |