---
# Copyright 2025-2026 Thomas Hintz

# This file is part of Nassella.

# Nassella is free software: you can redistribute it and/or modify it under the
# terms of the GNU Affero General Public License as published by the Free
# Software Foundation, either version 3 of the License, or (at your option) any
# later version.

# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

# You should have received a copy of the GNU Affero General Public License
# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
###############################################################
#                   Authelia configuration                    #
###############################################################

server:
  address: 'tcp://:9091/authelia'
  endpoints:
    authz:
      forward-auth:
        implementation: 'ForwardAuth'

log:
  level: 'debug'

totp:
  issuer: 'authelia.com'

identity_validation:
  reset_password:
    jwt_secret: '$AUTHELIA_JWT_SECRET'

authentication_backend:
  disable_reset_password: true
  file:
    path: '/config/users.yml'
    watch: false
    search:
      email: false
      case_insensitive: false
    extra_attributes:
      extra_example:
        multi_valued: false
        value_type: 'string'
    password:
      algorithm: 'argon2'
      argon2:
        variant: 'argon2id'
        iterations: 3
        memory: 65536
        parallelism: 4
        key_length: 32
        salt_length: 16
      scrypt:
        variant: 'scrypt'
        iterations: 16
        block_size: 8
        parallelism: 1
        key_length: 32
        salt_length: 16
      pbkdf2:
        variant: 'sha512'
        iterations: 310000
        salt_length: 16
      sha2crypt:
        variant: 'sha512'
        iterations: 50000
        salt_length: 16
      bcrypt:
        variant: 'standard'
        cost: 12

access_control:
  default_policy: 'deny'
  rules:
    # - domain: 'public.x.localhost'
    #   policy: 'bypass'
    # - domain: 'app.nassella.org'
    #   policy: 'one_factor'
    - domain: '$DOZZLE_FULL_DOMAIN'
      policy: 'two_factor'

session:
  secret: '$AUTHELIA_SESSION_SECRET'

  cookies:
    - name: 'dozzle_session'
      domain: '$DOZZLE_FULL_DOMAIN'  # Should match whatever your root protected domain is
      authelia_url: 'https://$DOZZLE_FULL_DOMAIN/authelia'
      expiration: '1 hour'  # 1 hour
      inactivity: '5 minutes'  # 5 minutes
      default_redirection_url: 'https://$DOZZLE_FULL_DOMAIN/'

regulation:
  max_retries: 3
  find_time: '2 minutes'
  ban_time: '5 minutes'

storage:
  encryption_key: '$AUTHELIA_ENCRYPTION_KEY'
  postgres:
    address: 'tcp://authelia_db:5432'
    servers: []
    database: '$AUTHELIA_POSTGRES_DB'
    schema: 'public'
    username: '$AUTHELIA_POSTGRES_USER'
    password: '$AUTHELIA_POSTGRES_PASSWORD'
    timeout: '5s'

notifier:
  smtp:
    address: 'submission://$SMTP_HOST:$SMTP_PORT'
    username: '$SMTP_AUTH_USER'
    password: '$SMTP_AUTH_PASSWORD'
    sender: '$SMTP_FROM'
...