158 lines
5.0 KiB
YAML
158 lines
5.0 KiB
YAML
|
apiVersion: v1
|
||
|
|
kind: ConfigMap
|
||
|
|
metadata:
|
||
|
|
name: authelia-config
|
||
|
|
namespace: idp
|
||
|
|
data:
|
||
|
|
configuration.yml: |
|
||
|
|
default_redirection_url: https://portal.bhasher.com
|
||
|
|
theme: dark
|
||
|
|
|
||
|
|
server:
|
||
|
|
host: 0.0.0.0
|
||
|
|
port: 9091
|
||
|
|
|
||
|
|
log:
|
||
|
|
level: debug
|
||
|
|
|
||
|
|
totp:
|
||
|
|
disable: false
|
||
|
|
issuer: idp.bhasher.com
|
||
|
|
algorithm: sha256
|
||
|
|
digits: 6
|
||
|
|
period: 30
|
||
|
|
skew: 1
|
||
|
|
secret_size: 32
|
||
|
|
|
||
|
|
authentication_backend:
|
||
|
|
disable_reset_password: false
|
||
|
|
refresh_interval: 5m
|
||
|
|
ldap:
|
||
|
|
implementation: custom
|
||
|
|
url: ldap://openldap.idp.svc.cluster.local
|
||
|
|
timeout: 5s
|
||
|
|
start_tls: false
|
||
|
|
base_dn: DC=bhasher,DC=com
|
||
|
|
username_attribute: uid
|
||
|
|
additional_users_dn: ou=users
|
||
|
|
users_filter: (&({username_attribute}={input})(objectClass=inetOrgPerson))
|
||
|
|
additional_groups_dn: ou=groups
|
||
|
|
groups_filter: (&(uniqueMember={dn})(objectClass=groupOfUniqueNames))
|
||
|
|
group_name_attribute: cn
|
||
|
|
mail_attribute: mail
|
||
|
|
display_name_attribute: cn
|
||
|
|
permit_referrals: false
|
||
|
|
|
||
|
|
access_control:
|
||
|
|
default_policy: deny
|
||
|
|
rules:
|
||
|
|
- domain: '*.bhasher.com'
|
||
|
|
policy: two_factor
|
||
|
|
subject:
|
||
|
|
- "group:admin"
|
||
|
|
- domain: 'git.bhasher.com'
|
||
|
|
policy: two_factor
|
||
|
|
subject:
|
||
|
|
- "group:contributor"
|
||
|
|
- domain: 'wiki.bhasher.com'
|
||
|
|
policy: two_factor
|
||
|
|
subject:
|
||
|
|
- "group:contributor"
|
||
|
|
- domain: 'radarr.bhasher.com'
|
||
|
|
policy: two_factor
|
||
|
|
subject:
|
||
|
|
- "group:mediaserver"
|
||
|
|
- domain: 'nextcloud.bhasher.com'
|
||
|
|
policy: two_factor
|
||
|
|
subject:
|
||
|
|
- "group:home"
|
||
|
|
|
||
|
|
session:
|
||
|
|
name: auth_session
|
||
|
|
domain: bhasher.com
|
||
|
|
same_site: lax
|
||
|
|
expiration: 1d
|
||
|
|
inactivity: 3h
|
||
|
|
remember_me_duration: 1w
|
||
|
|
redis:
|
||
|
|
host: redis.storage.svc.cluster.local
|
||
|
|
port: 6379
|
||
|
|
|
||
|
|
regulation:
|
||
|
|
max_retries: 3
|
||
|
|
find_time: 1m
|
||
|
|
ban_time: 5m
|
||
|
|
|
||
|
|
storage:
|
||
|
|
# local:
|
||
|
|
# path: /data/db.sqlite3
|
||
|
|
postgres:
|
||
|
|
host: postgres.storage.svc.cluster.local
|
||
|
|
port: 5432
|
||
|
|
database: authelia
|
||
|
|
schema: public
|
||
|
|
username: authelia
|
||
|
|
|
||
|
|
notifier:
|
||
|
|
smtp:
|
||
|
|
username: no-reply@bhasher.com
|
||
|
|
host: bdubois.io
|
||
|
|
port: 587
|
||
|
|
sender: no-reply@bhasher.com
|
||
|
|
tls:
|
||
|
|
skip_verify: true
|
||
|
|
|
||
|
|
password_policy:
|
||
|
|
standard:
|
||
|
|
enabled: true
|
||
|
|
min_length: 8
|
||
|
|
max_length: 0
|
||
|
|
require_uppercase: false
|
||
|
|
require_lowercase: false
|
||
|
|
require_number: false
|
||
|
|
require_special: false
|
||
|
|
|
||
|
|
identity_providers:
|
||
|
|
oidc:
|
||
|
|
issuer_private_key: |
|
||
|
|
-----BEGIN RSA PRIVATE KEY-----
|
||
|
|
MIIEowIBAAKCAQEAwz+97ZILHP+8Hxu2XsK17QZEyOiGQ45SRl6/UbjhiN5Cc5di
|
||
|
|
UQ3I8LaHwvxrsbbBaqLQsYVISye8xdeVvKEa/Pk/VYVGRgOQ+DFHPthOYwGa9bZa
|
||
|
|
INtvOKy85OiqFY8mamRiTkCDo4unxVf35mI6Z01+a5WycvG2mC1VY3v0VC2/PyJt
|
||
|
|
uRusqk9946DbP7IJ83WS8GuVEGsKna8pjr1DW2kC+qUZtA8pM0mH8EK1o2wDKPOb
|
||
|
|
X/4J+/A9kbx2Gnt8gxq3NtErcUHsSKwQtQfik38ehfFfOxq+xINjn5W90gUvx2q5
|
||
|
|
zI3gk2cJFTxiKqRtYfTETnepvKqkzTMlBCVAMwIDAQABAoIBAHlpfMBrbW+18xRh
|
||
|
|
FjGs4JYorMNGHJ+Ls8vAhTXbQpvqoeXhQCjo6ogM6TUt5AYZgALAhgeturvJVRCt
|
||
|
|
s5YdlHu0vlZ+zqkg9JfxhL0mou/cArFCmJ8P9QSIHdo2d/V6E8ha7ep9IZ6kbEpC
|
||
|
|
HoxrjqfIP5HE/7eMaSAOKKf5X4Cr701/3r/0rD+BsYZPC0eklRO2W1x801n0+ks0
|
||
|
|
oVI1/fNkM+F8It7GK/AC1KGThLL8DzBP9cwYaqnABktNKCh+/2z4+50G9z8Bcc3F
|
||
|
|
4FUYubidahZ0DD0KniFGcENfDhLPpy3HsQU6Sp5IgZBaM+jbbp5Grv3Wh7kqDEOQ
|
||
|
|
tmdjEGECgYEA7ZLpHm8h2C9nMFwMzCR18VQgAzLlhCxBJn7wOF5EUOJWNRCo1To1
|
||
|
|
G9qNMUKb1pcnwYGc2s488YfiUkufxZKCjdRSmVwul4D5ufb4zGu/4ulzfrx6DnjJ
|
||
|
|
8BBAtYPiP5RD+m9keB1OI6BHYOMtLi4Vv+XjkasTbtYRWcPdQABC+DECgYEA0mR1
|
||
|
|
ye9T4KcrQoFP14I0vFkVLe2gzVa3Kn5MSM7iMMXcTV3G2GSQCtufpVRbGvw0qgDy
|
||
|
|
cdIvT24dIhYaqF33IuJdZgzSlM4/3KQbMPhVlLpaGpiP1CqUuxsTlrjzOZUkTZBE
|
||
|
|
BrfkBO9VwaGX35WqnatFyXJ3TEWPt4/1s9DfiaMCgYEA4sg6gDLVu+iEOEWmcbjc
|
||
|
|
XWJQrL0JGwKjrnu+FBDoZc2pPT6J7AGEcPJPlZZf7Jid+rofYT8+LdHo2WYXPiJ9
|
||
|
|
PaZQstSsJTOZL0vydDDnG1R+S5zfZrEnE2JwYtViRA7kVUvAPGi9DoURngs+NbcI
|
||
|
|
TAbHFWaZRlRSe73clhup0gECgYBK9Pm2MSssDcLu1c1RVZVeSUqva0rv/WYSoJ6j
|
||
|
|
DfouMEAV3EQ80k8zXx3YtF4lFhfZPa8i+CRc4zlD7KYguCGVbxqhgg4AcB72iA0b
|
||
|
|
/E3ZSC9T7GjJyUXmB3aKK2iUaltduvlRf3CghXiDHQRT5ym7NMsPQ1XXea0DVCnQ
|
||
|
|
n6kUiwKBgDAMfny68ymQVskEv/NCTbRkpz6O1DA997QyjPV/QyfSpt1znPuNvgkE
|
||
|
|
SQu0C/b47Nm2ZGAHVryWLo8bBS8+ECEV74GM/kHoDWpWzEeoxynW+dBZoP9sbKzZ
|
||
|
|
LCWjPegQEkVdtp83Thfqb/MfeUj8GHf8MegIGoJd50f19tggd4a3
|
||
|
|
-----END RSA PRIVATE KEY-----
|
||
|
|
access_token_lifespan: 3h
|
||
|
|
authorize_code_lifespan: 1m
|
||
|
|
id_token_lifespan: 1h
|
||
|
|
refresh_token_lifespan: 90m
|
||
|
|
enable_client_debug_messages: false
|
||
|
|
cors:
|
||
|
|
endpoints:
|
||
|
|
- authorization
|
||
|
|
- token
|
||
|
|
- revocation
|
||
|
|
- introspection
|
||
|
|
allowed_origins:
|
||
|
|
- https://git.bhasher.com
|
||
|
|
allowed_origins_from_client_redirect_uris: false
|