mirror of
https://github.com/auricom/home-cluster.git
synced 2025-09-30 15:37:44 +02:00
92 lines
3.2 KiB
YAML
92 lines
3.2 KiB
YAML
---
|
|
session:
|
|
# redis:
|
|
# high_availability:
|
|
# sentinel_name: redis-master
|
|
# nodes:
|
|
# - host: redis-node-0.redis-headless.default.svc.cluster.local.
|
|
# port: 26379
|
|
# - host: redis-node-1.redis-headless.default.svc.cluster.local.
|
|
# port: 26379
|
|
# - host: redis-node-2.redis-headless.default.svc.cluster.local.
|
|
# port: 26379
|
|
|
|
access_control:
|
|
## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
|
|
## resource if there is no policy to be applied to the user.
|
|
default_policy: two_factor
|
|
networks:
|
|
- name: private
|
|
networks: ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
|
|
- name: vpn
|
|
networks: ["10.10.0.0/16"]
|
|
rules:
|
|
# bypass Authelia WAN + LAN
|
|
- domain:
|
|
- auth.${SECRET_PUBLIC_DOMAIN}
|
|
policy: bypass
|
|
# One factor auth for LAN
|
|
- domain:
|
|
- "*.${SECRET_PUBLIC_DOMAIN}"
|
|
policy: one_factor
|
|
subject: ["group:admins", "group:users"]
|
|
networks:
|
|
- private
|
|
# Deny public resources
|
|
- domain: ["navidrome.${SECRET_PUBLIC_DOMAIN}"]
|
|
resources: ["^/metrics.*$"]
|
|
policy: deny
|
|
identity_providers:
|
|
oidc:
|
|
cors:
|
|
endpoints: ["authorization", "token", "revocation", "introspection"]
|
|
allowed_origins_from_client_redirect_uris: true
|
|
clients:
|
|
- id: gitea
|
|
secret: "${GITEA_OAUTH_CLIENT_SECRET}"
|
|
public: false
|
|
authorization_policy: two_factor
|
|
scopes: ["openid", "profile", "groups", "email"]
|
|
redirect_uris:
|
|
[
|
|
"https://gitea.${SECRET_PUBLIC_DOMAIN}/user/oauth2/authelia/callback",
|
|
]
|
|
userinfo_signing_algorithm: none
|
|
- id: grafana
|
|
description: Grafana
|
|
secret: "${GRAFANA_OAUTH_CLIENT_SECRET}"
|
|
public: false
|
|
authorization_policy: two_factor
|
|
pre_configured_consent_duration: 1y
|
|
scopes: ["openid", "profile", "groups", "email"]
|
|
redirect_uris:
|
|
["https://grafana.${SECRET_PUBLIC_DOMAIN}/login/generic_oauth"]
|
|
userinfo_signing_algorithm: none
|
|
- id: outline
|
|
description: Outline
|
|
secret: "${OUTLINE_OAUTH_CLIENT_SECRET}"
|
|
public: false
|
|
authorization_policy: two_factor
|
|
pre_configured_consent_duration: 1y
|
|
scopes: ["openid", "profile", "email", "offline_access"]
|
|
redirect_uris:
|
|
["https://docs.${SECRET_PUBLIC_DOMAIN}/auth/oidc.callback"]
|
|
userinfo_signing_algorithm: none
|
|
- id: immich
|
|
description: Immich
|
|
secret: "${IMMICH_OAUTH_CLIENT_SECRET}"
|
|
public: false
|
|
authorization_policy: one_factor
|
|
pre_configured_consent_duration: 1y
|
|
scopes: ["openid", "profile", "email"]
|
|
redirect_uris: ["https://photos.${SECRET_PUBLIC_DOMAIN}/auth/login", "app.immich:/"]
|
|
userinfo_signing_algorithm: none
|
|
- id: jellyfin
|
|
description: jellyfin
|
|
public: false
|
|
secret: "${JELLYFIN_OAUTH_CLIENT_SECRET}"
|
|
authorization_policy: two_factor
|
|
pre_configured_consent_duration: 1y
|
|
scopes: ["openid", "profile", "groups", "email"]
|
|
redirect_uris: [ "https://jellyfin.${SECRET_PUBLIC_DOMAIN}/sso/OID/redirect/authelia" ]
|