1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
# https://www.authelia.com/integration/openid-connect/frequently-asked-questions/#how-do-i-generate-client-secrets

theme: auto

log:
  level: debug
  format: json

telemetry:
  metrics:
    enabled: true

authentication_backend:
  file:
    path: /config/users_database.yml
  password_change:
    disable: true

access_control:
  default_policy: deny
  rules:
    - domain: "*.chislan.family"
      policy: two_factor
      subject:
        - group:family
    - domain: "*.kejadlen.dev"
      policy: two_factor
      subject:
        - user:alpha

identity_validation:
  reset_password:
    jwt_secret: {{ authelia.jwt_secret }}

session:
  secret: {{ authelia.session_secret }}
  cookies:
    - domain: kejadlen.dev
      authelia_url: https://auth.kejadlen.dev
      # default_redirection_url: https://www.kejadlen.dev
    - domain: chislan.family
      authelia_url: https://auth.chislan.family

storage:
  encryption_key: {{ authelia.storage_encryption_key }}
  local:
    path: /config/db.sqlite3

notifier:
  # filesystem:
  #   filename: /config/notification.txt
  smtp:
    username: {{ authelia.smtp_username }}
    password: {{ authelia.smtp_password }}
    # address: smtp://email-smtp.us-west-2.amazonaws.com:25
    address: smtp://mail.smtp2go.com:2525
    sender: authelia@kejadlen.dev

identity_providers:
  oidc:
    jwks:
      - key: |
          {{ authelia.oidc_private_key | indent(10) }}

    clients:
      # https://www.authelia.com/reference/guides/generating-secure-values/#generating-a-random-password-hash

      - client_id: tailscale
        client_name: Tailscale
        client_secret: $argon2id$v=19$m=65536,t=3,p=4$RivlSdV1WE/NLfd3Pzrubw$ljSvHj9sb0byolv7fk5G3nL415nS7Ze2RMASwPgfBX0
        redirect_uris:
          - https://login.tailscale.com/a/oauth_response
        scopes:
          - openid
          - email
          - profile

      - client_id: gitea
        client_name: Gitea
        client_secret: $argon2id$v=19$m=65536,t=3,p=4$bMcI49gLNfk6ovxXbg9jFQ$qE/G5lDzkFebKopyGv1FOqkiA64HhRJ9kq+TJCR0HM0
        public: false
        redirect_uris:
          - https://git.kejadlen.dev/user/oauth2/authelia/callback
        scopes:
          - openid
          - email
          - profile

      - client_id: gotosocial
        client_name: GoToSocial
        client_secret: $argon2id$v=19$m=65536,t=3,p=4$4fkP2O3FYs26yKH/3WLuvQ$JHkaAA+b752/v7rtyhEzGwGutpSZR+7PSmz8psFb8BM
        public: false
        redirect_uris:
          - https://hey.kejadlen.dev/auth/callback
        scopes:
          - openid
          - email
          - profile
          - groups