TrueChartsClone/charts/stable/authelia/templates/_configmap.tpl

{{/* Define the configmap */}}
{{- define "authelia.configmap" -}}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: authelia-paths
data:
  AUTHELIA_SERVER_DISABLE_HEALTHCHECK: "true"
  AUTHELIA_JWT_SECRET_FILE: "/secrets/JWT_TOKEN"
  AUTHELIA_SESSION_SECRET_FILE: "/secrets/SESSION_ENCRYPTION_KEY"
  AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: "/secrets/ENCRYPTION_KEY"
  AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE: "/secrets/STORAGE_PASSWORD"
  {{- if .Values.authentication_backend.ldap.enabled }}
  AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE: "/secrets/LDAP_PASSWORD"
  {{- end }}
  {{- if .Values.notifier.smtp.enabled }}
  AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE: "/secrets/SMTP_PASSWORD"
  {{- end }}
  AUTHELIA_SESSION_REDIS_PASSWORD_FILE: "/secrets/REDIS_PASSWORD"
  {{- if .Values.redisProvider.high_availability.enabled }}
  AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_PASSWORD_FILE: "/secrets/REDIS_SENTINEL_PASSWORD"
  {{- end }}
  {{- if .Values.duo_api.enabled }}
  AUTHELIA_DUO_API_SECRET_KEY_FILE: "/secrets/DUO_API_KEY"
  {{- end }}
  {{- if .Values.identity_providers.oidc.enabled }}
  AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE: "/secrets/OIDC_HMAC_SECRET"
  AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE: "/secrets/OIDC_PRIVATE_KEY"
  {{- end }}

---

apiVersion: v1
kind: ConfigMap
metadata:
  name: authelia-configfile
data:
  configuration.yaml: |
    ---
    theme: {{ default "light" .Values.theme }}
    default_redirection_url: {{ default (printf "https://www.%s" .Values.domain) .Values.default_redirection_url }}
    server:
      host: 0.0.0.0
      port: {{ default 9091 .Values.server.port }}
      {{- if not (eq "" (default "" .Values.server.path)) }}
      path: {{ .Values.server.path }}
      {{- end }}
      read_buffer_size: {{ default 4096 .Values.server.read_buffer_size }}
      write_buffer_size: {{ default 4096 .Values.server.write_buffer_size }}
      enable_pprof: {{ default false .Values.server.enable_pprof }}
      enable_expvars: {{ default false .Values.server.enable_expvars }}
    log:
      level: {{ default "info" .Values.log.level }}
      format: {{ default "text" .Values.log.format }}
      {{- if not (eq "" (default "" .Values.log.file_path)) }}
      file_path: {{ .Values.log.file_path }}
      keep_stdout: true
      {{- end }}
    totp:
      issuer: {{ default .Values.domain .Values.totp.issuer }}
      period: {{ default 30 .Values.totp.period }}
      skew: {{ default 1 .Values.totp.skew }}
    {{- if .Values.duo_api.enabled }}
    duo_api:
      hostname: {{ .Values.duo_api.hostname }}
      integration_key: {{ .Values.duo_api.integration_key }}
    {{- end }}
    {{- with $auth := .Values.authentication_backend }}
    authentication_backend:
      disable_reset_password: {{ $auth.disable_reset_password }}
    {{- if $auth.file.enabled }}
      file:
        path: {{ $auth.file.path }}
        password: {{ toYaml $auth.file.password | nindent 10 }}
    {{- end }}
    {{- if $auth.ldap.enabled }}
      ldap:
        implementation: {{ default "custom" $auth.ldap.implementation }}
        url: {{ $auth.ldap.url }}
        timeout: {{ default "5s" $auth.ldap.timeout }}
        start_tls: {{ $auth.ldap.start_tls }}
        tls:
          {{- if hasKey $auth.ldap.tls "server_name" }}
          server_name: {{ default $auth.ldap.host $auth.ldap.tls.server_name }}
          {{- end }}
          minimum_version: {{ default "TLS1.2" $auth.ldap.tls.minimum_version }}
          skip_verify: {{ default false $auth.ldap.tls.skip_verify }}
    {{- if $auth.ldap.base_dn }}
        base_dn: {{ $auth.ldap.base_dn }}
    {{- end }}
    {{- if $auth.ldap.username_attribute }}
        username_attribute: {{ $auth.ldap.username_attribute }}
    {{- end }}
    {{- if $auth.ldap.additional_users_dn }}
        additional_users_dn: {{ $auth.ldap.additional_users_dn }}
    {{- end }}
    {{- if $auth.ldap.users_filter }}
        users_filter: {{ $auth.ldap.users_filter }}
    {{- end }}
    {{- if $auth.ldap.additional_groups_dn }}
        additional_groups_dn: {{ $auth.ldap.additional_groups_dn }}
    {{- end }}
    {{- if $auth.ldap.groups_filter }}
        groups_filter: {{ $auth.ldap.groups_filter }}
    {{- end }}
    {{- if $auth.ldap.group_name_attribute }}
        group_name_attribute: {{ $auth.ldap.group_name_attribute }}
    {{- end }}
    {{- if $auth.ldap.mail_attribute }}
        mail_attribute: {{ $auth.ldap.mail_attribute }}
    {{- end }}
    {{- if $auth.ldap.display_name_attribute }}
        display_name_attribute: {{ $auth.ldap.display_name_attribute }}
    {{- end }}
        user: {{ $auth.ldap.user }}
    {{- end }}
    {{- end }}
    {{- with $session := .Values.session }}
    session:
      name: {{ default "authelia_session" $session.name }}
      domain: {{ required "A valid .Values.domain entry required!" $.Values.domain }}
      same_site: {{ default "lax" $session.same_site }}
      expiration: {{ default "1M" $session.expiration }}
      inactivity: {{ default "5m" $session.inactivity }}
      remember_me_duration: {{ default "1M" $session.remember_me_duration }}
    {{- end }}
      redis:
        host: {{ .Values.redis.url.plain }}
      {{- with $redis := .Values.redisProvider }}
        port: {{ default 6379 $redis.port }}
        {{- if not (eq $redis.username "") }}
        username: {{ $redis.username }}
        {{- end }}
        maximum_active_connections: {{ default 8 $redis.maximum_active_connections }}
        minimum_idle_connections: {{ default 0 $redis.minimum_idle_connections }}
    {{- if $redis.tls.enabled }}
        tls:
          server_name: {{ $redis.tls.server_name }}
          minimum_version: {{ default "TLS1.2" $redis.tls.minimum_version }}
          skip_verify: {{ $redis.tls.skip_verify }}
    {{- end }}
    {{- if $redis.high_availability.enabled }}
        high_availability:
          sentinel_name: {{ $redis.high_availability.sentinel_name }}
    {{- if $redis.high_availability.nodes }}
          nodes: {{ toYaml $redis.high_availability.nodes | nindent 10 }}
    {{- end }}
          route_by_latency: {{ $redis.high_availability.route_by_latency }}
          route_randomly: {{ $redis.high_availability.route_randomly }}
      {{- end }}
    {{- end }}
    regulation: {{ toYaml .Values.regulation | nindent 6 }}
    storage:
      postgres:
        host: {{ printf "%v-%v" .Release.Name "postgresql" }}
    {{- with $storage := .Values.storage }}
        port: {{ default 5432 $storage.postgres.port }}
        database: {{ default "authelia" $storage.postgres.database }}
        username: {{ default "authelia" $storage.postgres.username }}
        timeout: {{ default "5s" $storage.postgres.timeout }}
        sslmode: {{ default "disable" $storage.postgres.sslmode }}
    {{- end }}
    {{- with $notifier := .Values.notifier }}
    notifier:
      disable_startup_check: {{ $.Values.notifier.disable_startup_check }}
    {{- if $notifier.filesystem.enabled }}
      filesystem:
        filename: {{ $notifier.filesystem.filename }}
    {{- end }}
    {{- if $notifier.smtp.enabled }}
      smtp:
        host: {{ $notifier.smtp.host }}
        port: {{ default 25 $notifier.smtp.port }}
        timeout: {{ default "5s" $notifier.smtp.timeout }}
        username: {{ $notifier.smtp.username }}
        sender: {{ $notifier.smtp.sender }}
        identifier: {{ $notifier.smtp.identifier }}
        subject: {{ $notifier.smtp.subject | quote }}
        startup_check_address: {{ $notifier.smtp.startup_check_address }}
        disable_require_tls: {{ $notifier.smtp.disable_require_tls }}
        disable_html_emails: {{ $notifier.smtp.disable_html_emails }}
        tls:
          server_name: {{ default $notifier.smtp.host $notifier.smtp.tls.server_name }}
          minimum_version: {{ default "TLS1.2" $notifier.smtp.tls.minimum_version }}
          skip_verify: {{ default false $notifier.smtp.tls.skip_verify }}
    {{- end }}
    {{- end }}
    {{- if .Values.identity_providers.oidc.enabled }}
    identity_providers:
      oidc:
        access_token_lifespan: {{ default "1h" .Values.identity_providers.oidc.access_token_lifespan }}
        authorize_code_lifespan: {{ default "1m" .Values.identity_providers.oidc.authorize_code_lifespan }}
        id_token_lifespan: {{ default "1h" .Values.identity_providers.oidc.id_token_lifespan }}
        refresh_token_lifespan: {{ default "90m" .Values.identity_providers.oidc.refresh_token_lifespan }}
        enable_client_debug_messages: {{ default false .Values.identity_providers.oidc.enable_client_debug_messages }}
        minimum_parameter_entropy: {{ default 8 .Values.identity_providers.oidc.minimum_parameter_entropy }}
        {{- if gt (len .Values.identity_providers.oidc.clients) 0 }}
        clients:
    {{- range $client := .Values.identity_providers.oidc.clients }}
        - id: {{ $client.id }}
          description: {{ default $client.id $client.description }}
          secret: {{ default (randAlphaNum 128) $client.secret }}
          {{- if $client.public }}
          public: {{ $client.public }}
          {{- end }}
          authorization_policy: {{ default "two_factor" $client.authorization_policy }}
          redirect_uris:
          {{- range $client.redirect_uris }}
          - {{ . }}
          {{- end }}
          {{- if $client.audience }}
          audience: {{ toYaml $client.audience | nindent 10 }}
          {{- end }}
          scopes: {{ toYaml (default (list "openid" "profile" "email" "groups") $client.scopes) | nindent 10 }}
          grant_types: {{ toYaml (default (list "refresh_token" "authorization_code") $client.grant_types) | nindent 10 }}
          response_types: {{ toYaml (default (list "code") $client.response_types) | nindent 10 }}
          {{- if $client.response_modes }}
          response_modes: {{ toYaml $client.response_modes | nindent 10 }}
          {{- end }}
          userinfo_signing_algorithm: {{ default "none" $client.userinfo_signing_algorithm }}
    {{- end }}
    {{- end }}
    {{- end }}
    access_control:
    {{- if (eq (len .Values.access_control.rules) 0) }}
      {{- if (eq .Values.access_control.default_policy "bypass") }}
      default_policy: one_factor
      {{- else if (eq .Values.access_control.default_policy "deny") }}
      default_policy: two_factor
      {{- else }}
      default_policy: {{ .Values.access_control.default_policy }}
      {{- end }}
    {{- else }}
      default_policy: {{ .Values.access_control.default_policy }}
    {{- end }}
    {{- if (eq (len .Values.access_control.networks) 0) }}
      networks: []
    {{- else }}
      networks: {{ toYaml .Values.access_control.networks | nindent 6 }}
    {{- end }}
    {{- if (eq (len .Values.access_control.rules) 0) }}
      rules: []
    {{- else }}
      rules: {{ toYaml .Values.access_control.rules | nindent 6 }}
    {{- end }}
    ...
{{- end -}}