Refactor authelia for logs to use file backed users.

all-apps/authelia/4/Caddyfile

@@ -14,8 +14,17 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with Nassella. If not, see <https://www.gnu.org/licenses/>.
 
-{$authelia_SUBDOMAIN}.{$ROOT_DOMAIN} {
-  import maintenance_intercept
+#{$authelia_SUBDOMAIN}.{$ROOT_DOMAIN} {
+#  route {
+#    @authelia path /authelia /authelia/*
+#    handle @authelia {
+#      reverse_proxy authelia:9091
+#    }
+#    forward_auth authelia:9091 {
+#      uri /api/authz/forward-auth
+#      copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
+#    }
+#    reverse_proxy authelia:9091
+#  }
+#}
 
-  reverse_proxy authelia:9091
-}

all-apps/authelia/4/Makefile

@@ -18,7 +18,8 @@ IMAGE_DEPS := $(IMAGE_DEPS) \
 app/authelia/postgres_db \
 app/authelia/postgres_user \
 app/authelia/postgres_password \
-app/authelia/authelia-config/configuration.yml
+app/authelia/authelia-config/configuration.yml \
+app/authelia/authelia-config/users.yml
 
 app/authelia/postgres_db: $(apps_config)
 	bash -c 'source ./$(apps_config); printf "%s\n" "$$AUTHELIA_POSTGRES_DB" > $@'
@@ -29,3 +30,6 @@ app/authelia/postgres_password: $(apps_config)
 app/authelia/authelia-config/configuration.yml: $(apps_config) app/authelia/authelia-config/configuration.yml.tmpl \
 app/authelia/make-authelia-config.sh
 	./app/authelia/make-authelia-config.sh $(apps_config)
+app/authelia/authelia-config/users.yml: $(apps_config) app/authelia/authelia-config/users.yml.tmpl \
+app/authelia/make-authelia-users-config.sh
+	./app/authelia/make-authelia-users-config.sh $(apps_config)

all-apps/authelia/4/authelia-config/configuration.yml.tmpl

@@ -35,58 +35,45 @@ identity_validation:
   reset_password:
     jwt_secret: '$AUTHELIA_JWT_SECRET'
 
-# lldap service account user should instead
-# use an account with lldap_password_manager group
-# since that can't be used to change an admin password
 authentication_backend:
-  ldap:
-    address: 'ldap://lldap:3890'
-    implementation: 'lldap'
-    timeout: '5s'
-    pooling:
-      enable: false
-      count: 5
-      retries: 2
-      timeout: '10 seconds'
-    base_dn: 'DC=nassella,DC=org'
-#    additional_users_dn: 'OU=users'
-#    additional_groups_dn: 'OU=groups'
-#    group_search_mode: 'filter'
-#    permit_referrals: false
-    permit_unauthenticated_bind: false
-    permit_feature_detection_failure: false
-    user: 'uid=admin,ou=people,dc=nassella,dc=org'
-    password: '$LLDAP_ADMIN_PASSWORD'
-    # attributes:
-    #   distinguished_name: 'distinguishedName'
-    #   username: 'uid'
-    #   display_name: 'displayName'
-    #   family_name: 'sn'
-    #   given_name: 'givenName'
-    #   middle_name: 'middleName'
-    #   nickname: ''
-    #   gender: ''
-    #   birthdate: ''
-    #   website: 'wWWHomePage'
-    #   profile: ''
-    #   picture: ''
-    #   zoneinfo: ''
-    #   locale: ''
-    #   phone_number: 'telephoneNumber'
-    #   phone_extension: ''
-    #   street_address: 'streetAddress'
-    #   locality: 'l'
-    #   region: 'st'
-    #   postal_code: 'postalCode'
-    #   country: 'c'
-    #   mail: 'mail'
-    #   member_of: 'memberOf'
-    #   group_name: 'cn'
-    #   extra:
-    #     extra_example:
-    #       name: ''
-    #       multi_valued: false
-    #       value_type: 'string'
+  disable_reset_password: true
+  file:
+    path: '/config/users.yml'
+    watch: false
+    search:
+      email: false
+      case_insensitive: false
+    extra_attributes:
+      extra_example:
+        multi_valued: false
+        value_type: 'string'
+    password:
+      algorithm: 'argon2'
+      argon2:
+        variant: 'argon2id'
+        iterations: 3
+        memory: 65536
+        parallelism: 4
+        key_length: 32
+        salt_length: 16
+      scrypt:
+        variant: 'scrypt'
+        iterations: 16
+        block_size: 8
+        parallelism: 1
+        key_length: 32
+        salt_length: 16
+      pbkdf2:
+        variant: 'sha512'
+        iterations: 310000
+        salt_length: 16
+      sha2crypt:
+        variant: 'sha512'
+        iterations: 50000
+        salt_length: 16
+      bcrypt:
+        variant: 'standard'
+        cost: 12
 
 access_control:
   default_policy: 'deny'
@@ -102,11 +89,12 @@ session:
   secret: '$AUTHELIA_SESSION_SECRET'
 
   cookies:
-    - name: 'authelia_session'
-      domain: '$ROOT_DOMAIN'  # Should match whatever your root protected domain is
-      authelia_url: 'https://$AUTHELIA_FULL_DOMAIN'
+    - name: 'dozzle_session'
+      domain: '$DOZZLE_FULL_DOMAIN'  # Should match whatever your root protected domain is
+      authelia_url: 'https://$DOZZLE_FULL_DOMAIN/authelia'
       expiration: '1 hour'  # 1 hour
       inactivity: '5 minutes'  # 5 minutes
+      default_redirection_url: 'https://$DOZZLE_FULL_DOMAIN/'
 
 regulation:
   max_retries: 3

all-apps/authelia/4/docker-compose.yaml

@@ -50,13 +50,11 @@ services:
     image: 'authelia/authelia'
     volumes:
       - ./authelia/authelia-config/configuration.yml:/config/configuration.yml:ro
+      - ./authelia/authelia-config/users.yml:/config/users.yml:ro
     networks:
       - lb
       - authelia_internal_db
-      - lldap_internal
     depends_on:
-      lldap:
-        condition: service_healthy
       authelia_db:
         condition: service_healthy
     restart: 'unless-stopped'
@@ -66,9 +64,6 @@ services:
 
 networks:
   lb:
-  lldap_internal:
-    driver: bridge
-    internal: true
   authelia_internal_db:
     driver: bridge
     internal: true

all-apps/dozzle/20/Caddyfile

@@ -15,9 +15,15 @@
 # along with Nassella. If not, see <https://www.gnu.org/licenses/>.
 
 {$dozzle_SUBDOMAIN}.{$ROOT_DOMAIN} {
-  forward_auth authelia:9091 {
-    uri /api/authz/forward-auth
-    copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
+  route {
+    @authelia path /authelia /authelia/*
+    handle @authelia {
+      reverse_proxy authelia:9091
+    }
+    forward_auth authelia:9091 {
+      uri /api/authz/forward-auth
+      copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
+    }
+    reverse_proxy http://dozzle:8080
   }
-  reverse_proxy http://dozzle:8080
 }

all-apps/nassella/b0.0.1/authelia-config/configuration.yml.tmpl

@@ -84,7 +84,7 @@ access_control:
       policy: 'two_factor'
 
 session:
-  secret: 'insecure_session_secret'
+  secret: 'insecure_session_secret' # TODO fix
 
   cookies:
     - name: 'authelia_session'