description:"Use StartTLS with the LDAP connection"
schema:
type:boolean
default:false
- variable:tls
label:"TLS Settings"
schema:
type:dict
attrs:
- variable:server_name
label:"Server Name"
description:"Server Name for certificate validation (in case it's not set correctly in the URL)."
schema:
type:string
default:""
- variable:skip_verify
label:"Skip Certificate Verification"
description:"Skip verifying the server certificate (to allow a self-signed certificate)"
schema:
type:boolean
default:false
- variable:minimum_version
label:"Minimum TLS version"
description:"Minimum TLS version for either Secure LDAP or LDAP StartTLS."
schema:
type:string
default:"TLS1.2"
enum:
- value:"TLS1.0"
description:"TLS1.0"
- value:"TLS1.1"
description:"TLS1.1"
- value:"TLS1.2"
description:"TLS1.2"
- value:"TLS1.3"
description:"TLS1.3"
- variable:base_dn
label:"Base DN"
description:"The base dn for every LDAP query."
schema:
type:string
default:"DC=example,DC=com"
required:true
- variable:username_attribute
label:"Username Attribute"
description:"The attribute holding the username of the user"
schema:
type:string
default:""
required:true
- variable:additional_users_dn
label:"Additional Users DN"
description:"An additional dn to define the scope to all users."
schema:
type:string
default:"OU=Users"
required:true
- variable:users_filter
label:"Users Filter"
description:"The groups filter used in search queries to find the groups of the user."
schema:
type:string
default:""
required:true
- variable:additional_groups_dn
label:"Additional Groups DN"
description:"An additional dn to define the scope of groups."
schema:
type:string
default:"OU=Groups"
required:true
- variable:groups_filter
label:"Groups Filter"
description:"The groups filter used in search queries to find the groups of the user."
schema:
type:string
default:""
required:true
- variable:group_name_attribute
label:"Group name Attribute"
description:"The attribute holding the name of the group"
schema:
type:string
default:""
required:true
- variable:mail_attribute
label:"Mail Attribute"
description:"The attribute holding the primary mail address of the user"
schema:
type:string
default:""
required:true
- variable:display_name_attribute
label:"Display Name Attribute"
description:"he attribute holding the display name of the user. This will be used to greet an authenticated user."
schema:
type:string
default:""
- variable:user
label:"Admin User"
description:"The username of the admin user used to connect to LDAP."
schema:
type:string
default:"CN=Authelia,DC=example,DC=com"
required:true
- variable:plain_password
label:"Password"
schema:
type:string
default:""
required:true
- variable:file
label:"File backend configuration"
description:"With this backend, the users database is stored in a file which is updated when users reset their passwords."
schema:
type:dict
attrs:
- variable:enabled
label:"Enable"
schema:
type:boolean
default:false
show_subquestions_if:true
subquestions:
- variable:path
label:"Path"
schema:
type:string
default:"/config/users_database.yml"
required:true
- variable:password
label:"Password Settings"
schema:
type:dict
attrs:
- variable:algorithm
label:"Algorithm"
schema:
type:string
default:"argon2id"
enum:
- value:"argon2id"
description:"argon2id"
- value:"sha512"
description:"sha512"
- variable:iterations
label:"Iterations"
schema:
type:int
default:1
required:true
- variable:key_length
label:"Key Length"
schema:
type:int
default:32
required:true
- variable:salt_length
label:"Salt Length"
schema:
type:int
default:16
required:true
- variable:memory
label:"Memory"
schema:
type:int
default:1024
required:true
- variable:parallelism
label:"Parallelism"
schema:
type:int
default:8
required:true
- variable:notifier
group:"App Configuration"
label:"Notifier Configuration"
description:"otifications are sent to users when they require a password reset, a u2f registration or a TOTP registration."
schema:
type:dict
attrs:
- variable:disable_startup_check
label:"Disable Startup Check"
schema:
type:boolean
default:false
- variable:filesystem
label:"Filesystem Provider"
schema:
type:dict
attrs:
- variable:enabled
label:"Enable"
schema:
type:boolean
default:false
show_subquestions_if:true
subquestions:
- variable:filename
label:"File Path"
schema:
type:string
default:"/config/notification.txt"
required:true
- variable:smtp
label:"SMTP Provider"
description:"Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate."
schema:
type:dict
attrs:
- variable:enabled
label:"Enable"
schema:
type:boolean
default:true
show_subquestions_if:true
subquestions:
- variable:host
label:"Host"
schema:
type:string
default:"smtp.mail.svc.cluster.local"
required:true
- variable:port
label:"Port"
schema:
type:int
default:25
required:true
- variable:timeout
label:"Timeout"
schema:
type:string
default:"5s"
required:true
- variable:username
label:"Username"
schema:
type:string
default:""
required:true
- variable:plain_password
label:"Password"
schema:
type:string
default:""
required:true
- variable:sender
label:"Sender"
schema:
type:string
default:""
required:true
- variable:identifier
label:"Identifier"
description:"HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost."
schema:
type:string
default:"localhost"
required:true
- variable:subject
label:"Subject"
description:"Subject configuration of the emails sent, {title} is replaced by the text from the notifier"
schema:
type:string
default:"[Authelia] {title}"
required:true
- variable:startup_check_address
label:"Startup Check Address"
description:"This address is used during the startup check to verify the email configuration is correct."
schema:
type:string
default:"test@authelia.com"
required:true
- variable:disable_require_tls
label:"Disable Require TLS"
schema:
type:boolean
default:false
- variable:disable_html_emails
label:"Disable HTML emails"
schema:
type:boolean
default:false
- variable:tls
label:"TLS Settings"
schema:
type:dict
attrs:
- variable:server_name
label:"Server Name"
description:"Server Name for certificate validation (in case it's not set correctly in the URL)."
schema:
type:string
default:""
- variable:skip_verify
label:"Skip Certificate Verification"
description:"Skip verifying the server certificate (to allow a self-signed certificate)"
schema:
type:boolean
default:false
- variable:minimum_version
label:"Minimum TLS version"
description:"Minimum TLS version for either Secure LDAP or LDAP StartTLS."
schema:
type:string
default:"TLS1.2"
enum:
- value:"TLS1.0"
description:"TLS1.0"
- value:"TLS1.1"
description:"TLS1.1"
- value:"TLS1.2"
description:"TLS1.2"
- value:"TLS1.3"
description:"TLS1.3"
- variable:access_control
group:"App Configuration"
label:"Access Control Configuration"
description:"Access control is a list of rules defining the authorizations applied for one resource to users or group of users."
schema:
type:dict
attrs:
- variable:default_policy
label:"Default Policy"
description:"Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'."
schema:
type:string
default:"two_factor"
enum:
- value:"bypass"
description:"bypass"
- value:"one_factor"
description:"one_factor"
- value:"two_factor"
description:"two_factor"
- value:"deny"
description:"deny"
- variable:networks
label:"Networks"
schema:
type:list
default:[]
items:
- variable:networkItem
label:"Network Item"
schema:
type:dict
attrs:
- variable:name
label:"Name"
schema:
type:string
default:""
required:true
- variable:networks
label:"Networks"
schema:
type:list
default:[]
items:
- variable:network
label:"network"
schema:
type:string
default:""
required:true
- variable:rules
label:"Rules"
schema:
type:list
default:[]
items:
- variable:rulesItem
label:"Rule"
schema:
type:dict
attrs:
- variable:domain
label:"Domains"
description:"defines which domain or set of domains the rule applies to."
schema:
type:list
default:[]
items:
- variable:domainEntry
label:"Domain"
schema:
type:string
default:""
required:true
- variable:policy
label:"Policy"
description:"The policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'."
schema:
type:string
default:"two_factor"
enum:
- value:"bypass"
description:"bypass"
- value:"one_factor"
description:"one_factor"
- value:"two_factor"
description:"two_factor"
- value:"deny"
description:"deny"
- variable:subject
label:"Subject"
description:"defines the subject to apply authorizations to. This parameter is optional and matching any user if not provided"
schema:
type:list
default:[]
items:
- variable:subjectitem
label:"Subject"
schema:
type:string
default:""
required:true
- variable:networks
label:"Networks"
schema:
type:list
default:[]
items:
- variable:network
label:"Network"
schema:
type:string
default:""
required:true
- variable:resources
label:"Resources"
description:"is a list of regular expressions that matches a set of resources to apply the policy to"
schema:
type:list
default:[]
items:
- variable:resource
label:"Resource"
schema:
type:string
default:""
required:true
- variable:service
group:"Networking and Services"
label:"Configure Service(s)"
schema:
type:dict
attrs:
- variable:main
label:"Main Service"
description:"The Primary service on which the healthcheck runs, often the webUI"
schema:
type:dict
attrs:
- variable:enabled
label:"Enable the service"
schema:
type:boolean
default:true
hidden:true
- variable:type
label:"Service Type"
description:"ClusterIP's are only internally available, nodePorts expose the container to the host node System, Loadbalancer exposes the service using the system loadbalancer"
description:"ClusterIP's are only internally available, nodePorts expose the container to the host node System, Loadbalancer exposes the service using the system loadbalancer"
description:"deployment name, defaults to main deployment"
schema:
type:string
default:""
- variable:minReplicas
label:"Minimum Replicas"
schema:
type:int
default:1
- variable:maxReplicas
label:"Maximum Replicas"
schema:
type:int
default:5
- variable:targetCPUUtilizationPercentage
label:"Target CPU Utilization Percentage"
schema:
type:int
default:80
- variable:targetMemoryUtilizationPercentage
label:"Target Memory Utilization Percentage"
schema:
type:int
default:80
- variable:addons
group:"Addons"
label:""
schema:
type:dict
attrs:
- variable:vpn
label:"VPN"
schema:
type:dict
attrs:
- variable:type
label:"Type"
schema:
type:string
default:"disabled"
enum:
- value:"disabled"
description:"disabled"
- value:"openvpn"
description:"OpenVPN"
- value:"wireguard"
description:"Wireguard"
- variable:openvpn
label:"OpenVPN Settings"
schema:
type:dict
show_if:[["type","=","openvpn"]]
attrs:
- variable:username
label:"authentication username"
description:"authentication username, optional"
schema:
type:string
default:""
- variable:password
label:"authentication password"
description:"authentication credentials"
schema:
type:string
default:""
required:true
- variable:killSwitch
label:"Enable killswitch"
schema:
type:boolean
show_if:[["type","!=","disabled"]]
default:true
- variable:excludedNetworks_IPv4
label:"Killswitch Excluded IPv4 networks"
description:"list of killswitch excluded ipv4 addresses"
schema:
type:list
show_if:[["type","!=","disabled"]]
default:[]
items:
- variable:networkv4
label:"IPv4 Network"
schema:
type:string
required:true
- variable:excludedNetworks_IPv6
label:"Killswitch Excluded IPv6 networks"
description:"list of killswitch excluded ipv4 addresses"
schema:
type:list
show_if:[["type","!=","disabled"]]
default:[]
items:
- variable:networkv6
label:"IPv6 Network"
schema:
type:string
required:true
- variable:configFile
label:"VPN Config File Location"
schema:
type:dict
show_if:[["type","!=","disabled"]]
attrs:
- variable:enabled
label:"enabled"
schema:
type:boolean
default:true
hidden:true
- variable:type
label:"type"
schema:
type:string
default:"hostPath"
hidden:true
- variable:hostPathType
label:"hostPathType"
schema:
type:string
default:"File"
hidden:true
- variable:noMount
label:"noMount"
schema:
type:boolean
default:true
hidden:true
- variable:hostPath
label:"Full path to file"
description:"path to your local VPN config file for example: /mnt/tank/vpn.conf or /mnt/tank/vpn.ovpn"
schema:
type:string
default:""
required:true
- variable:envList
label:"VPN environment Variables"
schema:
type:list
show_if:[["type","!=","disabled"]]
default:[]
items:
- variable:envItem
label:"Environment Variable"
schema:
type:dict
attrs:
- variable:name
label:"Name"
schema:
type:string
required:true
- variable:value
label:"Value"
schema:
type:string
required:true
- variable:codeserver
label:"Codeserver"
schema:
type:dict
attrs:
- variable:enabled
label:"enabled"
schema:
type:boolean
default:false
show_subquestions_if:true
subquestions:
- variable:git
label:"Git Settings"
schema:
type:dict
attrs:
- variable:deployKey
description:"Raw SSH private key"
label:"deployKey"
schema:
type:string
- variable:deployKeyBase64
description:"Base64-encoded SSH private key. When both variables are set, the raw SSH key takes precedence"
label:"deployKeyBase64"
schema:
type:string
- variable:service
label:""
schema:
type:dict
attrs:
- variable:type
label:"Service Type"
description:"ClusterIP's are only internally available, nodePorts expose the container to the host node System, Loadbalancer exposes the service using the system loadbalancer"
schema:
type:string
default:"NodePort"
enum:
- value:"NodePort"
description:"NodePort"
- value:"ClusterIP"
description:"ClusterIP"
- value:"LoadBalancer"
description:"LoadBalancer"
- variable:loadBalancerIP
label:"LoadBalancer IP"
description:"LoadBalancerIP"
schema:
show_if:[["type","=","LoadBalancer"]]
type:string
default:""
- variable:externalIPs
label:"External IP's"
description:"External IP's"
schema:
show_if:[["type","=","LoadBalancer"]]
type:list
default:[]
items:
- variable:externalIP
label:"External IP"
schema:
type:string
- variable:ports
label:""
schema:
type:dict
attrs:
- variable:codeserver
label:""
schema:
type:dict
attrs:
- variable:nodePort
description:"leave empty to disable"
label:"nodePort"
schema:
type:int
default:36107
- variable:envList
label:"Codeserver environment Variables"
schema:
type:list
show_if:[["type","!=","disabled"]]
default:[]
items:
- variable:envItem
label:"Environment Variable"
schema:
type:dict
attrs:
- variable:name
label:"Name"
schema:
type:string
required:true
- variable:value
label:"Value"
schema:
type:string
required:true
- variable:promtail
label:"Promtail"
schema:
type:dict
attrs:
- variable:enabled
label:"enabled"
schema:
type:boolean
default:false
show_subquestions_if:true
subquestions:
- variable:loki
label:"Loki URL"
schema:
type:string
required:true
- variable:logs
label:"Log Paths"
schema:
type:dict
attrs:
- variable:name
label:"Name"
schema:
type:string
required:true
- variable:path
label:"Path"
schema:
type:string
required:true
- variable:args
label:"Promtail ecommand line arguments"
schema:
type:list
show_if:[["type","!=","disabled"]]
default:[]
items:
- variable:arg
label:"Arg"
schema:
type:string
required:true
- variable:envList
label:"Promtail environment Variables"
schema:
type:list
show_if:[["type","!=","disabled"]]
default:[]
items:
- variable:envItem
label:"Environment Variable"
schema:
type:dict
attrs:
- variable:name
label:"Name"
schema:
type:string
required:true
- variable:value
label:"Value"
schema:
type:string
required:true
- variable:netshoot
label:"Netshoot"
schema:
type:dict
attrs:
- variable:enabled
label:"enabled"
schema:
type:boolean
default:false
show_subquestions_if:true
subquestions:
- variable:envList
label:"Netshoot environment Variables"
schema:
type:list
show_if:[["type","!=","disabled"]]
default:[]
items:
- variable:envItem
label:"Environment Variable"
schema:
type:dict
attrs:
- variable:name
label:"Name"
schema:
type:string
required:true
- variable:value
label:"Value"
schema:
type:string
required:true
- variable:identity_providers
group:"Advanced"
label:"Authelia Identity Providers (BETA)"
schema:
type:dict
attrs:
- variable:oidc
label:"OpenID Connect(BETA)"
schema:
type:dict
attrs:
- variable:enabled
label:"enabled"
schema:
type:boolean
default:false
show_subquestions_if:true
subquestions:
- variable:access_token_lifespan
label:"Access Token Lifespan"
schema:
type:string
default:"1h"
required:true
- variable:authorize_code_lifespan
label:"Authorize Code Lifespan"
schema:
type:string
default:"1m"
required:true
- variable:id_token_lifespan
label:"ID Token Lifespan"
schema:
type:string
default:"1h"
required:true
- variable:refresh_token_lifespan
label:"Refresh Token Lifespan"
schema:
type:string
default:"90m"
required:true
- variable:enable_client_debug_messages
label:"Enable Client Debug Messages"
schema:
type:boolean
default:false
- variable:minimum_parameter_entropy
label:"Minimum Parameter Entropy"
schema:
type:int
default:8
hidden:true
- variable:clients
label:"Clients"
schema:
type:list
default:[]
items:
- variable:clientEntry
label:"Client"
schema:
type:dict
attrs:
- variable:id
label:"ID/Name"
description:"The ID is the OpenID Connect ClientID which is used to link an application to a configuration."
schema:
type:string
default:"myapp"
required:true
- variable:description
label:"Description"
description:"The description to show to users when they end up on the consent screen. Defaults to the ID above."
schema:
type:string
default:"My Application"
required:true
- variable:secret
label:"Secret"
description:"The client secret is a shared secret between Authelia and the consumer of this client."
schema:
type:string
default:""
required:true
- variable:public
label:"public"
description:"Sets the client to public. This should typically not be set, please see the documentation for usage."
schema:
type:boolean
default:false
- variable:authorization_policy
label:"Authorization Policy"
description:"The policy to require for this client; one_factor or two_factor."
schema:
type:string
default:"two_factor"
enum:
- value:"one_factor"
description:"one_factor"
- value:"two_factor"
description:"two_factor"
- variable:userinfo_signing_algorithm
label:"Userinfo Signing Algorithm"
description:"The algorithm used to sign userinfo endpoint responses for this client, either none or RS256."
schema:
type:string
default:"none"
enum:
- value:"none"
description:"none"
- value:"RS256"
description:"RS256"
- variable:audience
label:"Audience"
description:"Audience this client is allowed to request."
schema:
type:list
default:[]
items:
- variable:audienceEntry
label:""
schema:
type:string
default:""
required:true
- variable:scopes
label:"Scopes"
description:"Scopes this client is allowed to request."
schema:
type:list
default:[]
items:
- variable:ScopeEntry
label:"Scope"
schema:
type:string
default:"openid"
required:true
- variable:redirect_uris
label:"redirect_uris"
description:"Redirect URI's specifies a list of valid case-sensitive callbacks for this client."