blob: 39cf40fe78e0b03382dc5e7a496d13162ee019d4 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
|
log:
level: debug
telemetry:
metrics:
enabled: true
access_control:
default_policy: 'deny'
rules:
# bypass api endpoints
- domain: 'rss.gzr.im'
resources: ['^/v1/']
policy: 'bypass'
- domain: 'paper.gzr.im'
resources: ['^/api/']
policy: 'bypass'
# 1factor is fine
- domain:
- 'rss.gzr.im'
- 'paper.gzr.im'
- 'tv.gzr.im'
- 'photos.gzr.im'
policy: 'one_factor'
# 2factor is a sane default
- domain:
- 'gzr.im'
- '*.gzr.im'
policy: 'two_factor'
# regulation:
# max_retries: 3
# find_time: '2 minutes'
# ban_time: '5 minutes'
session:
cookies:
- name: 'authelia_session'
domain: 'gzr.im' # Should match whatever your root protected domain is
authelia_url: 'https://login.gzr.im'
# relaxed expiry and inactivity
expiration: '3w'
inactivity: '3w'
# blank auth should go back to account page
default_redirection_url: 'https://login.gzr.im/authenticated'
notifier:
filesystem:
filename: /notifier/message.txt
totp:
issuer: 'login.gzr.im'
webauthn:
enable_passkey_login: true
duo_api:
disable: true
|
