Luj/snowfield
1
0
Fork 0
mirror of https://github.com/JulienMalka/snowfield.git synced 2025-03-27 06:10:53 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Updated authelia : still not in prod

Browse source
This commit is contained in:
Julien Malka 2022-03-10 15:22:54 +01:00
parent 2879423999
commit 90e2e3e9bb
No known key found for this signature in database
GPG key ID: 3C68E13964FEA07F
3 changed files with 92 additions and 64 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
modules/authelia/configuration.yml → modules/authelia/authelia-config.nix
View file

@ -1,16 +1,21 @@
host: 0.0.0.0
port: 9091
# Taken from 'config.template.yml' for Authelia v4.32.2.
# Update along with 'pkgs/authelia.nix'.
{ cfg }:
''
server:
host: 0.0.0.0
port: 9091
read_buffer_size: 4096
write_buffer_size: 4096
path: "authelia"
log_level: debug
log.level: debug
jwt_secret: somethingsomethingrandomrecret
default_redirection_url: https://auth.julienmalka.me
default_redirection_url: https://autheliafailed.julienmalka.me
authentication_backend:
disable_reset_password: false
file:
path: /config/users_database.yml
path: ${./config/users.yml}
password:
algorithm: argon2id
iterations: 1
@ -18,19 +23,24 @@ authentication_backend:
salt_length: 16
memory: 512
parallelism: 8
access_control:
default_policy: deny
rules:
- domain:
- series.julienmalka.me
- "auth.julienmalka.me"
policy: bypass
- domain:
- "series.julienmalka.me"
policy: one_factor
session:
name: authelia_session
secret: somerandomsecret
expiration: 1h
inactivity: 5m
remember_me_duration: 1M
domain: series.julienmalka.me
domain: julienmalka.me
regulation:
max_retries: 3
find_time: 2m
@ -38,8 +48,10 @@ regulation:
storage:
encryption_key: a_very_important_secret
local:
path: /config/db.sqlite3
path: /var/lib/authelia/storage.db
notifier:
disable_startup_check: false
filesystem:
filename: /config/notification.txt
filename: /var/lib/authelia/notification.txt
''

0
modules/authelia/users.yml → modules/authelia/config/users.yml
View file

126
modules/authelia/default.nix
View file

@ -1,6 +1,8 @@
{ pkgs, lib, config, ... }:
with lib; let
cfg = config.luj.authelia;
autheliaConfig = pkgs.writeText "authelia-config.yml"
(import ./authelia-config.nix { inherit cfg; });
in
{
options.luj.authelia = {
@ -8,72 +10,86 @@ in
};
config = mkIf cfg.enable {
virtualisation.docker.enable = true;
virtualisation.oci-containers.containers."authelia" = {
image = "authelia/authelia";
environment = {
"TZ" = "Europe/Paris";
};
volumes = [
"/srv/authelia:/config/"
];
systemd = {
services.authelia = {
ports = [ "9091:9091" ];
serviceConfig = {
User = "authelia";
StateDirectory = "authelia";
RuntimeDirectory = "authelia";
StateDirectoryMode = "0700";
RuntimeDirectoryMode = "0700";
};
script = ''
exec ${pkgs.authelia}/bin/authelia --config ${autheliaConfig}
'';
};
};
services.nginx.appendHttpConfig = ''
server {
server_name auth.julienmalka.me;
listen 80;
return 301 https://$server_name$request_uri;
}
users = {
users.authelia = {
group = "authelia";
isSystemUser = true;
};
server {
server_name auth.julienmalka.me;
listen 443 ssl http2;
groups.authelia = {
members = [ "nginx" ];
};
};
location / {
set $upstream_authelia http://127.0.0.1:9091;
proxy_pass $upstream_authelia;
client_body_buffer_size 128k;
#Timeout if the real server is dead
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
# Advanced Proxy Config
send_timeout 5m;
proxy_read_timeout 360;
proxy_send_timeout 360;
proxy_connect_timeout 360;
services.nginx.virtualHosts."auth.julienmalka.me" = {
enableACME = true;
forceSSL = true;
locations."/" = {
extraConfig = ''
set $upstream_authelia http://127.0.0.1:9091;
proxy_pass $upstream_authelia;
# Basic Proxy Config
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_redirect http:// $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 64 256k;
client_body_buffer_size 128k;
# If behind reverse proxy, forwards the correct IP
set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.0.0.0/8;
set_real_ip_from 192.168.0.0/16;
set_real_ip_from fc00::/7;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
}
}
'';
#Timeout if the real server is dead
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
# Advanced Proxy Config
send_timeout 5m;
proxy_read_timeout 360;
proxy_send_timeout 360;
proxy_connect_timeout 360;
# Basic Proxy Config
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_redirect http:// $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 64 256k;
# If behind reverse proxy, forwards the correct IP
set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.0.0.0/8;
set_real_ip_from 192.168.0.0/16;
set_real_ip_from fc00::/7;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
'';
};
};
};
}