blob: 9db77483fab879eac8f23615f0f150bab017fcca (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
|
log:
level: debug
telemetry:
metrics:
enabled: true
access_control:
default_policy: 'deny'
rules:
# bypass for api resources
- domain: 'rss.gzr.im'
resources: ['^/v1/']
policy: 'bypass'
- domain: 'paper.gzr.im'
resources: ['^/api/']
policy: 'bypass'
# group-based access restrictions
- domain: ['cp.gzr.im', 'cp.demo.gzr.im']
subject: ['group:copyparty', 'group:admins']
policy: 'one_factor'
- domain: 'photos.gzr.im'
subject: ['group:immich', 'group:admins']
policy: 'one_factor'
- domain: 'paper.gzr.im'
subject: ['group:paperless', 'group:admins']
policy: 'one_factor'
- domain: 'rss.gzr.im'
subject: ['group:miniflux', 'group:admins']
policy: 'one_factor'
- domain: 'tv.gzr.im'
subject: ['group:jellyfin', 'group:admins']
policy: 'one_factor'
- domain: 'where.gzr.im'
subject: ['group:geopulse', 'group:admins']
policy: 'one_factor'
# two_factor as default
- domain: '*'
subject: ['group:admins']
policy: 'two_factor'
# regulation:
# max_retries: 3
# find_time: '2 minutes'
# ban_time: '5 minutes'
session:
cookies:
- name: 'authelia_session'
domain: 'gzr.im' # Should match whatever your root protected domain is
authelia_url: 'https://login.gzr.im'
# relaxed expiry and inactivity
expiration: '3w'
inactivity: '3w'
# blank auth should go back to account page
default_redirection_url: 'https://login.gzr.im/authenticated'
notifier:
filesystem:
filename: /notifier/message.txt
totp:
issuer: 'login.gzr.im'
webauthn:
enable_passkey_login: true
duo_api:
disable: true
|
