log:
  level: debug

telemetry:
  metrics:
    enabled: true

access_control:
  default_policy: 'deny'
  rules:
    # bypass for api resources
    - domain: 'rss.gzr.im'
      resources: ['^/v1/']
      policy: 'bypass'
    - domain: 'paper.gzr.im'
      resources: ['^/api/']
      policy: 'bypass'
    # group-based access restrictions
    - domain: ['cp.gzr.im', 'cp.demo.gzr.im']
      subject: ['group:copyparty', 'group:admins']
      policy: 'one_factor'
    - domain: 'photos.gzr.im'
      subject: ['group:immich', 'group:admins']
      policy: 'one_factor'
    - domain: 'paper.gzr.im'
      subject: ['group:paperless', 'group:admins']
      policy: 'one_factor'
    - domain: 'rss.gzr.im'
      subject: ['group:miniflux', 'group:admins']
      policy: 'one_factor'
    - domain: 'tv.gzr.im'
      subject: ['group:jellyfin', 'group:admins']
      policy: 'one_factor'
    - domain: 'where.gzr.im'
      subject: ['group:geopulse', 'group:admins']
      policy: 'one_factor'
    # two_factor as default
    - domain: ['gzr.im', '*.gzr.im']
      policy: 'two_factor'

# regulation:
#   max_retries: 3
#   find_time: '2 minutes'
#   ban_time: '5 minutes'

session:
  cookies:
    - name: 'authelia_session'
      domain: 'gzr.im'  # Should match whatever your root protected domain is
      authelia_url: 'https://login.gzr.im'
      # relaxed expiry and inactivity
      expiration: '3w'
      inactivity: '3w'
      # blank auth should go back to account page
      default_redirection_url: 'https://login.gzr.im/authenticated'

notifier:
  filesystem:
    filename: /notifier/message.txt

totp:
  issuer: 'login.gzr.im'

webauthn:
  enable_passkey_login: true

duo_api:
  disable: true