122 lines
3.1 KiB
Cheetah
122 lines
3.1 KiB
Cheetah
---
|
|
# Copyright 2025-2026 Thomas Hintz
|
|
|
|
# This file is part of Nassella.
|
|
|
|
# Nassella is free software: you can redistribute it and/or modify it under the
|
|
# terms of the GNU Affero General Public License as published by the Free
|
|
# Software Foundation, either version 3 of the License, or (at your option) any
|
|
# later version.
|
|
|
|
# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
|
|
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
|
# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
|
|
|
|
# You should have received a copy of the GNU Affero General Public License
|
|
# along with Nassella. If not, see <https://www.gnu.org/licenses/>.
|
|
###############################################################
|
|
# Authelia configuration #
|
|
###############################################################
|
|
|
|
server:
|
|
address: 'tcp://:9091/authelia'
|
|
endpoints:
|
|
authz:
|
|
forward-auth:
|
|
implementation: 'ForwardAuth'
|
|
|
|
log:
|
|
level: 'debug'
|
|
|
|
totp:
|
|
issuer: 'authelia.com'
|
|
|
|
identity_validation:
|
|
reset_password:
|
|
jwt_secret: '$AUTHELIA_JWT_SECRET'
|
|
|
|
authentication_backend:
|
|
disable_reset_password: true
|
|
file:
|
|
path: '/config/users.yml'
|
|
watch: false
|
|
search:
|
|
email: false
|
|
case_insensitive: false
|
|
extra_attributes:
|
|
extra_example:
|
|
multi_valued: false
|
|
value_type: 'string'
|
|
password:
|
|
algorithm: 'argon2'
|
|
argon2:
|
|
variant: 'argon2id'
|
|
iterations: 3
|
|
memory: 65536
|
|
parallelism: 4
|
|
key_length: 32
|
|
salt_length: 16
|
|
scrypt:
|
|
variant: 'scrypt'
|
|
iterations: 16
|
|
block_size: 8
|
|
parallelism: 1
|
|
key_length: 32
|
|
salt_length: 16
|
|
pbkdf2:
|
|
variant: 'sha512'
|
|
iterations: 310000
|
|
salt_length: 16
|
|
sha2crypt:
|
|
variant: 'sha512'
|
|
iterations: 50000
|
|
salt_length: 16
|
|
bcrypt:
|
|
variant: 'standard'
|
|
cost: 12
|
|
|
|
access_control:
|
|
default_policy: 'deny'
|
|
rules:
|
|
# - domain: 'public.x.localhost'
|
|
# policy: 'bypass'
|
|
# - domain: 'app.nassella.org'
|
|
# policy: 'one_factor'
|
|
- domain: '$DOZZLE_FULL_DOMAIN'
|
|
policy: 'two_factor'
|
|
|
|
session:
|
|
secret: '$AUTHELIA_SESSION_SECRET'
|
|
|
|
cookies:
|
|
- name: 'dozzle_session'
|
|
domain: '$DOZZLE_FULL_DOMAIN' # Should match whatever your root protected domain is
|
|
authelia_url: 'https://$DOZZLE_FULL_DOMAIN/authelia'
|
|
expiration: '1 hour' # 1 hour
|
|
inactivity: '5 minutes' # 5 minutes
|
|
default_redirection_url: 'https://$DOZZLE_FULL_DOMAIN/'
|
|
|
|
regulation:
|
|
max_retries: 3
|
|
find_time: '2 minutes'
|
|
ban_time: '5 minutes'
|
|
|
|
storage:
|
|
encryption_key: '$AUTHELIA_ENCRYPTION_KEY'
|
|
postgres:
|
|
address: 'tcp://authelia_db:5432'
|
|
servers: []
|
|
database: '$AUTHELIA_POSTGRES_DB'
|
|
schema: 'public'
|
|
username: '$AUTHELIA_POSTGRES_USER'
|
|
password: '$AUTHELIA_POSTGRES_PASSWORD'
|
|
timeout: '5s'
|
|
|
|
notifier:
|
|
smtp:
|
|
address: 'submission://$SMTP_HOST:$SMTP_PORT'
|
|
username: '$SMTP_AUTH_USER'
|
|
password: '$SMTP_AUTH_PASSWORD'
|
|
sender: '$SMTP_FROM'
|
|
...
|