authelia
diff --git a/lotus-land-story/authelia.yml b/lotus-land-story/authelia.yml
new file mode 100644
index 0000000..3c8ce2a
--- /dev/null
+++ b/lotus-land-story/authelia.yml
@@ -0,0 +1,48 @@
+- name: Set up Authelia
+ hosts: lotus-land-story
+ vars_files:
+ - vars.yml
+ tasks:
+
+ - name: Create directories for volume mounting
+ ansible.builtin.file:
+ path: /mnt/lotus-land-story/authelia/{{ item }}
+ state: directory
+ mode: "0700"
+ loop:
+ - config
+ - secrets
+
+ - name: Copy configuration
+ ansible.builtin.template:
+ src: templates/authelia_{{ item }}.yml
+ dest: /mnt/lotus-land-story/authelia/config/{{ item }}.yml
+ mode: "0644"
+ loop:
+ - configuration
+ - users_database
+
+ - name: Get docker network
+ community.docker.docker_network:
+ name: lotus_land_story
+ register: docker_network
+
+ - name: Run Authelia
+ community.docker.docker_container:
+ restart: true
+ name: authelia
+ image: docker.io/authelia/authelia:4.37.5
+ env:
+ AUTHENTICATION_GUARD: remote_user_guard
+ volumes:
+ - /mnt/lotus-land-story/authelia/config:/config
+ - /mnt/lotus-land-story/authelia/secrets:/secrets
+ restart_policy: unless-stopped
+ networks:
+ - name: lotus_land_story
+
+ handlers:
+ - name: Import restarts
+ ansible.builtin.import_tasks: restarts.yml
+
+# vim: ft=yaml.ansible
diff --git a/lotus-land-story/caddy.yml b/lotus-land-story/caddy.yml
index a9c4aac..0bc2576 100644
--- a/lotus-land-story/caddy.yml
+++ b/lotus-land-story/caddy.yml
@@ -13,11 +13,20 @@
- caddy
- caddy/data
+ - name: Get docker network for trusted proxies
+ community.docker.docker_network:
+ name: lotus_land_story
+ register: docker_network
+
+ # TODO Reload Caddy when this changes:
+ # docker exec -w /etc/caddy $caddy_container_id caddy reload
- name: Set up Caddyfile
ansible.builtin.template:
src: templates/Caddyfile
dest: /mnt/lotus-land-story/caddy/Caddyfile
mode: "0644"
+ vars:
+ trusted_proxies: "{{ docker_network.network.IPAM.Config[0].Subnet }}"
- name: Create Caddy volume
community.docker.docker_volume:
diff --git a/lotus-land-story/grafana.yml b/lotus-land-story/grafana.yml
index 5c5ae42..5c09f36 100644
--- a/lotus-land-story/grafana.yml
+++ b/lotus-land-story/grafana.yml
@@ -22,6 +22,22 @@
[server]
domain = grafana.{{ domain }}
http_addr = 0.0.0.0
+ root_url = https://grafana.{{ domain }}
+ [auth.generic_oauth]
+ enabled = true
+ name = Authelia
+ icon = signin
+ client_id = grafana
+ client_secret = {{ grafana.oauth_secret }}
+ scopes = openid profile email groups
+ empty_scopes = false
+ auth_url = https://auth.{{ domain }}/api/oidc/authorization
+ token_url = https://auth.{{ domain }}/api/oidc/token
+ api_url = https://auth.{{ domain }}/api/oidc/userinfo
+ login_attribute_path = preferred_username
+ groups_attribute_path = groups
+ name_attribute_path = name
+ use_pkce = true
mode: "0644"
- name: Provision Prometheus
diff --git a/lotus-land-story/hledger.yml b/lotus-land-story/hledger.yml
new file mode 100644
index 0000000..9d81579
--- /dev/null
+++ b/lotus-land-story/hledger.yml
@@ -0,0 +1,32 @@
+- name: Set up hledger
+ hosts: lotus-land-story
+ vars_files:
+ - vars.yml
+ tasks:
+
+ - name: Create directory for volume mounting
+ ansible.builtin.file:
+ path: /mnt/lotus-land-story/hledger
+ state: directory
+ mode: "0755"
+
+ - name: Run hledger
+ community.docker.docker_container:
+ restart: true
+ name: hledger
+ image: dastapov/hledger:1.31
+ env:
+ HLEDGER_JOURNAL_FILE: /data/all.journal
+ HLEDGER_BASE_URL: https://{{ hledger.subdomain }}.{{ domain }}
+ HLEDGER_ARGS: --capabilities=view,add,manage
+ volumes:
+ - /mnt/lotus-land-story/hledger:/data
+ restart_policy: unless-stopped
+ networks:
+ - name: lotus_land_story
+
+ handlers:
+ - name: Import restarts
+ ansible.builtin.import_tasks: restarts.yml
+
+# vim: ft=yaml.ansible
diff --git a/lotus-land-story/templates/Caddyfile b/lotus-land-story/templates/Caddyfile
index 36cd9f1..406354b 100644
--- a/lotus-land-story/templates/Caddyfile
+++ b/lotus-land-story/templates/Caddyfile
@@ -1,3 +1,8 @@
+# https://www.authelia.com/integration/proxies/caddy/#forwarded-header-trust#trusted-proxies
+(trusted_proxy_list) {
+ trusted_proxies {{ trusted_proxies }}
+}
+
:2019 {
metrics
}
@@ -27,5 +32,35 @@ woodpecker.{{ domain }} {
}
{{ firefly_iii.subdomain }}.{{ domain }} {
- reverse_proxy firefly-iii:8080
+ forward_auth authelia:9091 {
+ uri /api/verify?rd=https://auth.{{ domain }}
+ copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
+
+ ## This import needs to be included if you're relying on a trusted proxies configuration.
+ import trusted_proxy_list
+ }
+
+ reverse_proxy firefly-iii:8080 {
+ import trusted_proxy_list
+ }
+}
+
+auth.{{ domain }} {
+ reverse_proxy authelia:9091 {
+ import trusted_proxy_list
+ }
+}
+
+{{ hledger.subdomain }}.{{ domain }} {
+ forward_auth authelia:9091 {
+ uri /api/verify?rd=https://auth.{{ domain }}
+ # copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
+
+ ## This import needs to be included if you're relying on a trusted proxies configuration.
+ import trusted_proxy_list
+ }
+
+ reverse_proxy hledger:5000 {
+ import trusted_proxy_list
+ }
}
diff --git a/lotus-land-story/templates/authelia_configuration.yml b/lotus-land-story/templates/authelia_configuration.yml
new file mode 100644
index 0000000..b4c4458
--- /dev/null
+++ b/lotus-land-story/templates/authelia_configuration.yml
@@ -0,0 +1,66 @@
+theme: auto
+jwt_secret: {{ authelia.jwt_secret }}
+default_redirection_url: https://auth.{{ domain }}/
+
+log:
+ level: debug
+ format: json
+
+telemetry:
+ metrics:
+ enabled: true
+
+authentication_backend:
+ file:
+ path: /config/users_database.yml
+
+access_control:
+ default_policy: deny
+ rules:
+ - domain: "*.{{ domain }}"
+ policy: two_factor
+
+session:
+ secret: {{ authelia.session_secret }}
+ domain: {{ domain }}
+
+storage:
+ encryption_key: {{ authelia.storage_encryption_key }}
+ local:
+ path: /config/db.sqlite3
+
+notifier:
+ smtp:
+ username: apikey
+ password: {{ authelia.smtp_password }}
+ host: smtp.sendgrid.net
+ port: 25
+ sender: authelia@kejadlen.dev
+
+identity_providers:
+ oidc:
+ issuer_private_key: |
+ {{ authelia.oidc_private_key | indent(6) }}
+ clients:
+ - id: grafana
+ description: Grafana
+ secret: $argon2id$v=19$m=65536,t=3,p=4$bHcAAorVdHuZzuz53WfAQA$x+pIDTo6SsGyY9JD4OZ7dT6pkEcPf8Yh6Yb7DXco8aQ
+ public: false
+ authorization_policy: two_factor
+ redirect_uris:
+ - https://grafana.{{ domain }}/login/generic_oauth
+ scopes:
+ - openid
+ - profile
+ - groups
+ - email
+ userinfo_signing_algorithm: none
+ - id: tailscale
+ description: Tailscale
+ secret: $argon2id$v=19$m=65536,t=3,p=4$RivlSdV1WE/NLfd3Pzrubw$ljSvHj9sb0byolv7fk5G3nL415nS7Ze2RMASwPgfBX0
+ redirect_uris:
+ - https://login.tailscale.com/a/oauth_response
+ scopes:
+ - openid
+ - email
+ - profile
diff --git a/lotus-land-story/templates/authelia_users_database.yml b/lotus-land-story/templates/authelia_users_database.yml
new file mode 100644
index 0000000..3c40ec3
--- /dev/null
+++ b/lotus-land-story/templates/authelia_users_database.yml
@@ -0,0 +1,8 @@
+users:
+ alpha:
+ disabled: false
+ displayname: "Alpha"
+ password: "$argon2id$v=19$m=65536,t=3,p=4$JHtyy/vVD+37neJUjy5Shw$6GODmDOXW/v7cfhqwuEp30bVSCWLT5R3OEe/Gi5FGX0" # yamllint disable-line rule:line-length
+ email: alpha@kejadlen.dev
+ groups:
+ - admins
diff --git a/lotus-land-story/templates/prometheus.yml b/lotus-land-story/templates/prometheus.yml
index e2f81af..e190c1b 100644
--- a/lotus-land-story/templates/prometheus.yml
+++ b/lotus-land-story/templates/prometheus.yml
@@ -42,6 +42,10 @@ scrape_configs:
static_configs:
- targets: ['woodpecker-server:8000']
+ - job_name: authelia
+ static_configs:
+ - targets: ['authelia:9959']
+
# - job_name: linode
# linode_sd_configs:
# - authorization: