ilnmors-homelab/config/services/containers/auth/authelia/config/authelia.yaml.j2

---
# https://github.com/lldap/lldap/blob/main/example_configs/authelia.md
# authelia.yaml
# certificates setting
certificates_directory: '/etc/ssl/authelia/'

# them setting - light, dark, grey, auto.
theme: 'auto'

# Server configuration
server:
  # TLS will be applied on caddy
  address: 'tcp://:{{ services['authelia']['ports']['http'] }}/'

# Log configuration
log:
  level: 'info'
  #file_path: 'path/of/log/file' - without this option, using stdout

# TOTP configuration
totp:
  # issure option is for 2FA app. It works as identifier. "My homelab' or 'ilnmors.internal', 'Authelia - ilnmors'
  issuer: '{{ domain['internal'] }}'

# Identity validation confituration
identity_validation:
  reset_password:
    jwt_secret: '' # $AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE option is designated in container file

# Authentication backend provider configuration
authentication_backend:
  ldap:
    # ldaps uses 636 -> NAT automatically change port 636 in output packet -> 2636 which lldap server uses.
    address: 'ldaps://{{ services['ldap']['domain'] }}.{{ domain['internal'] }}'
    implementation: 'lldap'
    # tls configruation, it uses certificates_directory's /etc/ssl/authelia/{{ root_cert_filename }}
    tls:
      server_name: '{{ services['ldap']['domain'] }}.{{ domain['internal'] }}'
      skip_verify: false
    # LLDAP base DN
    base_dn: '{{ domain['dc'] }}'
    additional_users_dn: 'ou=people'
    additional_groups_dn: 'ou=groups'
    # LLDAP filters
    users_filter: '(&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))'
    groups_filter: '(&(member={dn})(objectClass=groupOfNames))'
    # LLDAP bind account configuration
    user: 'uid=authelia,ou=people,{{ domain['dc'] }}'
    password: '' # $AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE option is designated in container file

# Access control configuration
access_control:
  default_policy: 'deny'
  rules:
    # authelia portal
    - domain: '{{ services['authelia']['domain'] }}.{{ domain['public'] }}'
      policy: 'bypass'
#    - domain: 'test.ilnmors.com'
#      policy: 'one_factor'
#      subject:
#        - 'group:admins'
# Session provider configuration
session:
  secret: '' # $AUTHELIA_SESSION_SECRET_FILE  is designated in container file
  expiration: '24 hours' # Session maintains for 24 hours
  inactivity: '24 hours' # Session maintains for 24 hours without actions
  cookies:
    - name: 'authelia_public_session'
      domain: '{{ domain['public'] }}'
      authelia_url: 'https://{{ services['authelia']['domain'] }}.{{ domain['public'] }}'
      same_site: 'lax'

# This authelia doesn't use Redis.

# Storage provider configuration
storage:
  encryption_key: '' # $AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE is designated in container file
  postgres:
    address: 'tcp://{{ services['postgresql']['domain'] }}.{{ domain['internal'] }}:{{ services['postgresql']['ports']['tcp'] }}'
    database: 'authelia_db'
    username: 'authelia'
    password: '' # $AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE is designated in container file
    tls:
      server_name: '{{ services['postgresql']['domain'] }}.{{ domain['internal'] }}'
      skip_verify: false

# Notification provider
notifier:
  filesystem:
    filename: '/config/notification.txt'

# This part needs the clients to integrate with Authelia in order for it to activate.
identity_providers:
  oidc:
    hmac_secret: '' # $AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE
    # For the app which doesn't use secret.
    cors:
      endpoints:
        - 'authorization'
        - 'token'
        - 'revocation'
        - 'introspection'
        - 'userinfo'
      allowed_origins:
        - 'https://{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}'
      allowed_origins_from_client_redirect_uris: true
    jwks:{% raw %}
      - algorithm: 'RS256'
        use: 'sig'
        key: {{ secret "/run/secrets/AUTHELIA_JWKS_RS256" | mindent 10 "|" | msquote }}
      - algorithm: 'ES256'
        use: 'sig'
        key: {{ secret "/run/secrets/AUTHELIA_JWKS_ES256" | mindent 10 "|" | msquote }}{% endraw %} 
    clients:
      # https://www.authelia.com/integration/openid-connect/clients/synology-dsm/
      - client_id: 'dsm'
        client_name: 'dsm'
        # It depends on application
        # hash vaule generate: 
	      # podman exec -it authelia sh
	      # authelia crypto hash generate pbkdf2 --password 'password'
        client_secret: '{{ hostvars['console']['dsm']['oidc']['hash'] }}'
        # If there were not client secret, public should be `true` [true | false]
        public: false
        authorization_policy: 'one_factor'
        require_pkce: false
        pkce_challenge_method: ''
        redirect_uris:
          - 'https://{{ services['nas']['domain'] }}.{{ domain['internal'] }}:{{ services['nas']['ports']['https'] }}'
        scopes:
          - 'openid'
          - 'profile'
          - 'groups'
          - 'email'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        # [ client_secret_post | client_secret_basic ]
        token_endpoint_auth_method: 'client_secret_post'
      # https://www.authelia.com/integration/openid-connect/clients/gitea/
      - client_id: 'gitea'
        client_name: 'gitea'
        client_secret: '{{ hostvars['console']['gitea']['oidc']['hash'] }}'
        public: false
        authorization_policy: 'one_factor'
        require_pkce: false
        pkce_challenge_method: ''
        redirect_uris:
          - 'https://{{ services['gitea']['domain']['public'] }}.{{ domain['public'] }}/user/oauth2/authelia/callback'
        scopes:
          - 'openid'
          - 'email'
          - 'profile'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_basic'
      # https://www.authelia.com/integration/openid-connect/clients/immich/
      - client_id: 'immich'
        client_name: 'immich'
        client_secret: '{{ hostvars['console']['immich']['oidc']['hash'] }}'
        public: false
        authorization_policy: 'one_factor'
        require_pkce: false
        pkce_challenge_method: ''
        redirect_uris:
          - 'https://{{ services['immich']['domain']['public'] }}.{{ domain['public'] }}/auth/login'
          - 'https://{{ services['immich']['domain']['public'] }}.{{ domain['public'] }}/user-settings'
          - 'app.immich:///oauth-callback'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_post'
      # https://www.authelia.com/integration/openid-connect/clients/actual-budget/
      - client_id: 'actual-budget'
        client_name: 'Actual Budget'
        client_secret: '{{ hostvars['console']['actualbudget']['oidc']['hash'] }}'
        public: false
        authorization_policy: 'one_factor'
        require_pkce: false
        pkce_challenge_method: ''
        redirect_uris:
          - 'https://{{ services['actualbudget']['domain']['public'] }}.{{ domain['public'] }}/openid/callback'
        scopes:
          - 'openid'
          - 'profile'
          - 'groups'
          - 'email'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_basic'
      # https://www.authelia.com/integration/openid-connect/clients/paperless/
      - client_id: 'paperless'
        client_name: 'Paperless'
        client_secret: '{{ hostvars['console']['paperless']['oidc']['hash'] }}'
        public: false
        authorization_policy: 'one_factor'
        require_pkce: true
        pkce_challenge_method: 'S256'
        redirect_uris:
          - 'https://{{ services['paperless']['domain']['public'] }}.{{ domain['public'] }}/accounts/oidc/authelia/login/callback/'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
          - 'groups'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_post'
      # https://www.authelia.com/integration/openid-connect/clients/vikunja/
      - client_id: 'vikunja'
        client_name: 'Vikunja'
        client_secret: '{{ hostvars['console']['vikunja']['oidc']['hash'] }}'
        public: false
        authorization_policy: 'one_factor'
        require_pkce: false
        pkce_challenge_method: ''
        redirect_uris:
          - 'https://{{ services['vikunja']['domain']['public'] }}.{{ domain['public'] }}/auth/openid/authelia'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_basic'
      # OpenCloud configuration
      ## https://docs.opencloud.eu/docs/admin/configuration/authentication-and-user-management/external-idp/
      ## Web
      - client_id: 'opencloud'
        client_name: 'OpenCloud'
        public: true
        authorization_policy: 'one_factor'
        require_pkce: true
        pkce_challenge_method: 'S256'
        redirect_uris:
          - 'https://{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}/'
          - 'https://{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}/oidc-callback.html'
          - 'https://{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}/oidc-silent-redirect.html'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
          - 'groups'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'RS256'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'none'
      ## desktop
      - client_id: 'OpenCloudDesktop'
        client_name: 'OpenCloud'
        public: true
        authorization_policy: 'one_factor'
        require_pkce: true
        pkce_challenge_method: 'S256'
        redirect_uris:
          - 'http://localhost'
          - 'http://127.0.0.1'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
          - 'groups'
          - 'offline_access'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
          - 'refresh_token'
        access_token_signed_response_alg: 'RS256'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'none'   
      ## Android
      - client_id: 'OpenCloudAndroid'
        client_name: 'OpenCloud'
        public: true
        authorization_policy: 'one_factor'
        require_pkce: true
        pkce_challenge_method: 'S256'
        redirect_uris:
          - 'oc://android.opencloud.eu'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
          - 'groups'
          - 'offline_access'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
          - 'refresh_token'
        access_token_signed_response_alg: 'RS256'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'none'
      ## IOS
      - client_id: 'OpenCloudIOS'
        client_name: 'OpenCloud'
        public: true
        authorization_policy: 'one_factor'
        require_pkce: true
        pkce_challenge_method: 'S256'
        redirect_uris:
          - 'oc://ios.opencloud.eu'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
          - 'groups'
          - 'offline_access'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
          - 'refresh_token'
        access_token_signed_response_alg: 'RS256'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'none'
      # https://docs.affine.pro/self-host-affine/administer/oauth-2-0
      - client_id: 'affine'
        client_name: 'Affine'
        client_secret: '{{ hostvars['console']['affine']['oidc']['hash'] }}'
        public: false
        authorization_policy: 'one_factor'
        require_pkce: false
        pkce_challenge_method: ''
        redirect_uris:
          - 'https://{{ services['affine']['domain']['public'] }}.{{ domain['public'] }}/oauth/callback'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_post'
      # https://www.authelia.com/integration/openid-connect/clients/nextcloud/#openid-connect-user-backend-app
      - client_id: 'nextcloud'
        client_name: 'Nextcloud'
        client_secret: '{{ hostvars['console']['nextcloud']['oidc']['hash'] }}'
        public: false
        authorization_policy: 'one_factor'
        require_pkce: true
        pkce_challenge_method: 'S256'
        redirect_uris:
          - 'https://{{ services['nextcloud']['domain']['public'] }}.{{ domain['public'] }}/apps/user_oidc/code'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
          - 'groups'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_post'