1
0
mirror of https://github.com/Haxxnet/Compose-Examples synced 2024-12-30 06:00:21 +00:00
Compose-Examples/examples/authelia/config/configuration.yml

177 lines
4.8 KiB
YAML
Raw Normal View History

2023-03-01 23:37:37 +00:00
---
###############################################################
# Authelia configuration #
###############################################################
server:
address: 'tcp://:9091/'
2023-03-01 23:37:37 +00:00
log:
level: debug
theme: dark
identity_validation:
reset_password:
jwt_secret: unsecure_jwt_secret
2023-03-01 23:37:37 +00:00
totp:
issuer: authelia.com
# duo_api:
# hostname: api-123456789.example.com
# integration_key: ABCDEF
# # This secret can also be set using the env variables AUTHELIA_DUO_API_SECRET_KEY_FILE
# secret_key: 1234567890abcdefghifjkl
2023-03-05 15:07:52 +00:00
password_policy:
standard:
enabled: true
min_length: 16
max_length: 0
require_uppercase: true
require_lowercase: true
require_number: true
require_special: true
2023-03-01 23:37:37 +00:00
authentication_backend:
file:
path: /config/users_database.yml
password:
algorithm: argon2id
iterations: 1
salt_length: 16
parallelism: 8
memory: 64
access_control:
default_policy: deny
rules:
# Rules applied to everyone
# chose from bypass, one_factor and two_factor
- domain: public.example.com
policy: bypass
- domain: subdomain1.example.com
policy: one_factor
- domain: subdomain2.example.com
policy: two_factor
2024-05-29 17:54:32 +00:00
subject:
- "group:admins" # access restriction based on groups
2023-03-01 23:37:37 +00:00
session:
name: authelia_session
# This secret can also be set using the env variables AUTHELIA_SESSION_SECRET_FILE
secret: unsecure_session_secret
expiration: 1h # 1 hour
inactivity: 5m # 5 minutes
cookies:
2024-05-29 17:53:01 +00:00
- domain: example.com
authelia_url: 'https://example.com'
default_redirection_url: 'https://www.example.com' # must be diffent to authelia_url
2023-03-01 23:37:37 +00:00
redis:
host: authelia-redis
port: 6379
# This secret can also be set using the env variables AUTHELIA_SESSION_REDIS_PASSWORD_FILE
2023-03-02 23:51:36 +00:00
password: SuperSecureRedisAuthPassword # must be the same as in the docker-compose.yml defined for the redis service
2023-03-01 23:37:37 +00:00
regulation:
max_retries: 3
find_time: 120
ban_time: 300
# yubikey support
webauthn:
disable: false
display_name: Authelia
attestation_conveyance_preference: indirect
user_verification: preferred
timeout: 60s
2023-03-01 23:37:37 +00:00
storage:
encryption_key: a_very_important_secret # Now required
local:
path: /config/db.sqlite3
notifier:
# smtp:
# username: test
# # This secret can also be set using the env variables AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE
# password: password
2024-03-15 20:44:29 +00:00
# host: smtp.gmail.com
# port: 465
# sender: "MySender <admin@example.com>"
2023-03-01 23:37:37 +00:00
filesystem:
filename: /config/notifications.txt
#identity_providers:
# oidc:
# hmac_secret: 'a-very-secure-hmac-secret'
# jwks:
# - key_id: 'authelia'
# algorithm: 'RS256'
# use: 'sig'
# certificate_chain: |
# -----BEGIN CERTIFICATE-----
# <PUBLIC-KEY-DATA-COMES-HERE>
# -----END CERTIFICATE-----
# key: |
# -----BEGIN PRIVATE KEY-----
# <PRIVATE-KEY-DATA-COMES-HERE>
# -----END PRIVATE KEY-----
# enable_client_debug_messages: false
# minimum_parameter_entropy: 8
# enforce_pkce: 'public_clients_only'
# enable_pkce_plain_challenge: false
# enable_jwt_access_token_stateless_introspection: false
# discovery_signed_response_alg: 'none'
# discovery_signed_response_key_id: ''
# require_pushed_authorization_requests: false
# lifespans:
# access_token: '1h'
# authorize_code: '1m'
# id_token: '1h'
# refresh_token: '90m'
# cors:
# endpoints:
# - 'authorization'
# - 'token'
# - 'revocation'
# - 'introspection'
# allowed_origins:
# - 'https://immich.example.com'
# allowed_origins_from_client_redirect_uris: false
# clients:
# - client_id: immich
# client_name: Immich OIDC
# client_secret: 'a-very-secure-client-secret'
# public: false
# authorization_policy: one_factor # may use two_factor to enforce 2FA
# consent_mode: explicit
# token_endpoint_auth_method: "client_secret_basic"
# pre_configured_consent_duration: 1w
# scopes:
# - openid
# - groups
# - email
# - profile
# redirect_uris: # adjust to your domains
# - https://authelia.example.com/
# - https://authelia.example.com/oauth2/callback
# - https://immich.example.com/oauth2/callback
# - https://immich.example.com/auth/login
# - https://immich.example.com/user-settings
# - https://immich.example.com
# - app.immich:/
# - https://immich.example.com/api/oauth/mobile-redirect
# grant_types:
# - refresh_token
# - authorization_code
# response_types:
# - code
# response_modes:
# - form_post
# - query
# - fragment
2023-03-01 23:37:37 +00:00
...