log:
  level: debug

telemetry:
  metrics:
    enabled: true

access_control:
  default_policy: 'deny'
  rules:
    # bypass api endpoints
    - domain: 'rss.gzr.im'
      resources: ['^/v1/']
      policy: 'bypass'
    - domain: 'paper.gzr.im'
      resources: ['^/api/']
      policy: 'bypass'
    # 1factor is fine
    - domain:
        - 'rss.gzr.im'
        - 'paper.gzr.im'
        - 'tv.gzr.im'
        - 'photos.gzr.im'
      policy: 'one_factor'
    # 2factor is a sane default
    - domain:
        - 'gzr.im'
        - '*.gzr.im'
      policy: 'two_factor'

# regulation:
#   max_retries: 3
#   find_time: '2 minutes'
#   ban_time: '5 minutes'

session:
  cookies:
    - name: 'authelia_session'
      domain: 'gzr.im'  # Should match whatever your root protected domain is
      authelia_url: 'https://login.gzr.im'
      # relaxed expiry and inactivity
      expiration: '3w'
      inactivity: '3w'
      # blank auth should go back to account page
      default_redirection_url: 'https://login.gzr.im/authenticated'

notifier:
  filesystem:
    filename: /notifier/message.txt

totp:
  issuer: 'login.gzr.im'

webauthn:
  enable_passkey_login: true

duo_api:
  disable: true