From 82bf37339cd01640a9c66702a4275de6180851cb Mon Sep 17 00:00:00 2001 From: Robert Günzler Date: Wed, 22 Apr 2026 14:30:48 +0900 Subject: authelia: use acl MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Robert Günzler --- bundles/authelia/files/configuration.yml | 30 ++++++++++++++++++------------ bundles/authelia/files/users.yml | 2 ++ 2 files changed, 20 insertions(+), 12 deletions(-) (limited to 'bundles') diff --git a/bundles/authelia/files/configuration.yml b/bundles/authelia/files/configuration.yml index 1760493..e84d7e4 100644 --- a/bundles/authelia/files/configuration.yml +++ b/bundles/authelia/files/configuration.yml @@ -9,25 +9,31 @@ telemetry: access_control: default_policy: 'deny' rules: - # bypass api endpoints + # bypass for api resources - domain: 'rss.gzr.im' resources: ['^/v1/'] policy: 'bypass' - domain: 'paper.gzr.im' resources: ['^/api/'] policy: 'bypass' - # 1factor is fine - - domain: - - 'rss.gzr.im' - - 'paper.gzr.im' - - 'tv.gzr.im' - - 'photos.gzr.im' - - 'where.gzr.im' policy: 'one_factor' - # 2factor is a sane default - - domain: - - 'gzr.im' - - '*.gzr.im' + - domain: 'photos.gzr.im' + subject: ['group:immich', 'group:admins'] + policy: 'one_factor' + - domain: 'paper.gzr.im' + subject: ['group:paperless', 'group:admins'] + policy: 'one_factor' + - domain: 'rss.gzr.im' + subject: ['group:miniflux', 'group:admins'] + policy: 'one_factor' + - domain: 'tv.gzr.im' + subject: ['group:jellyfin', 'group:admins'] + policy: 'one_factor' + - domain: 'where.gzr.im' + subject: ['group:geopulse', 'group:admins'] + policy: 'one_factor' + # two_factor as default + - domain: ['gzr.im', '*.gzr.im'] policy: 'two_factor' # regulation: diff --git a/bundles/authelia/files/users.yml b/bundles/authelia/files/users.yml index 5788d6b..2e07988 100644 --- a/bundles/authelia/files/users.yml +++ b/bundles/authelia/files/users.yml @@ -17,3 +17,5 @@ users: email: hi@gonca.me groups: - jellyfin + - immich + - copyparty -- cgit 1.4.1