Commit new Chart releases for TrueCharts

Signed-off-by: TrueCharts-Bot <bot@truecharts.org>
This commit is contained in:
TrueCharts-Bot 2022-12-21 20:03:26 +00:00
parent 65faadd339
commit 03ff8da2a6
28 changed files with 4049 additions and 21 deletions

View File

@ -0,0 +1,99 @@
**Important:**
*for the complete changelog, please refer to the website*
## [authelia-14.0.17](https://github.com/truecharts/charts/compare/authelia-14.0.16...authelia-14.0.17) (2022-12-21)
### Chore
- update container image tccr.io/truecharts/authelia to v4.37.5
## [authelia-14.0.16](https://github.com/truecharts/charts/compare/authelia-14.0.15...authelia-14.0.16) (2022-12-19)
### Chore
- update helm general non-major
## [authelia-14.0.15](https://github.com/truecharts/charts/compare/authelia-14.0.13...authelia-14.0.15) (2022-12-18)
### Chore
- update container image tccr.io/truecharts/authelia to v4.37.4
- update helm chart postgresql to v11.0.13 ([#5495](https://github.com/truecharts/charts/issues/5495))
- update helm chart redis to v5.0.16
## [authelia-14.0.13](https://github.com/truecharts/charts/compare/authelia-14.0.12...authelia-14.0.13) (2022-12-13)
### Chore
- update helm general non-major
## [authelia-14.0.12](https://github.com/truecharts/charts/compare/authelia-14.0.11...authelia-14.0.12) (2022-12-08)
### Fix
- typo ([#5219](https://github.com/truecharts/charts/issues/5219))
## [authelia-14.0.11](https://github.com/truecharts/charts/compare/authelia-14.0.10...authelia-14.0.11) (2022-12-08)
## [authelia-14.0.10](https://github.com/truecharts/charts/compare/authelia-14.0.9...authelia-14.0.10) (2022-12-08)
### Chore
- update container image tccr.io/truecharts/authelia to v4.37.3
## [authelia-14.0.9](https://github.com/truecharts/charts/compare/authelia-14.0.8...authelia-14.0.9) (2022-12-05)
### Chore
- update helm general non-major
## [authelia-14.0.8](https://github.com/truecharts/charts/compare/authelia-14.0.6...authelia-14.0.8) (2022-11-30)
## [authelia-14.0.8](https://github.com/truecharts/charts/compare/authelia-14.0.6...authelia-14.0.8) (2022-11-30)
## [authelia-14.0.8](https://github.com/truecharts/charts/compare/authelia-14.0.6...authelia-14.0.8) (2022-11-30)
## [authelia-14.0.8](https://github.com/truecharts/charts/compare/authelia-14.0.6...authelia-14.0.8) (2022-11-30)
## [authelia-14.0.8](https://github.com/truecharts/charts/compare/authelia-14.0.6...authelia-14.0.8) (2022-11-30)

View File

@ -0,0 +1,47 @@
apiVersion: v2
appVersion: "4.37.5"
dependencies:
- name: common
repository: https://library-charts.truecharts.org
version: 11.0.9
- condition: postgresql.enabled
name: postgresql
repository: https://charts.truecharts.org/
version: 11.0.13
- condition: redis.enabled
name: redis
repository: https://charts.truecharts.org
version: 5.0.17
deprecated: false
description: Authelia is a Single Sign-On Multi-Factor portal for web apps
home: https://truecharts.org/charts/stable/authelia
icon: https://truecharts.org/img/hotlink-ok/chart-icons/authelia.png
keywords:
- authelia
- authentication
- login
- SSO
- Authentication
- Security
- Two-Factor
- U2F
- YubiKey
- Push Notifications
- LDAP
kubeVersion: ">=1.16.0-0"
maintainers:
- email: info@truecharts.org
name: TrueCharts
url: https://truecharts.org
name: authelia
sources:
- https://github.com/truecharts/charts/tree/master/charts/stable/authelia
- https://github.com/authelia/chartrepo
- https://github.com/authelia/authelia
type: application
version: 14.0.17
annotations:
truecharts.org/catagories: |
- security
truecharts.org/SCALE-support: "true"
truecharts.org/grade: U

View File

@ -0,0 +1,109 @@
# authelia
Authelia is a Single Sign-On Multi-Factor portal for web apps
TrueCharts can be installed as both *normal* Helm Charts or as Apps on TrueNAS SCALE.
This readme is just an automatically generated general guide on installing our Helm Charts and Apps.
For more information, please click here: [authelia](https://truecharts.org/docs/charts/stable/authelia)
**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)**
## Source Code
* <https://github.com/truecharts/charts/tree/master/charts/stable/authelia>
* <https://github.com/authelia/chartrepo>
* <https://github.com/authelia/authelia>
## Requirements
Kubernetes: `>=1.16.0-0`
## Dependencies
| Repository | Name | Version |
|------------|------|---------|
| https://charts.truecharts.org/ | postgresql | 8.0.122 |
| https://charts.truecharts.org | redis | 3.0.121 |
| https://library-charts.truecharts.org | common | 10.9.4 |
## Installing the Chart
### TrueNAS SCALE
To install this Chart on TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/docs/manual/SCALE%20Apps/Installing-an-App).
### Helm
To install the chart with the release name `authelia`
```console
helm repo add TrueCharts https://charts.truecharts.org
helm repo update
helm install authelia TrueCharts/authelia
```
## Uninstall
### TrueNAS SCALE
**Upgrading, Rolling Back and Uninstalling the Chart**
To upgrade, rollback or delete this Chart from TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/docs/manual/SCALE%20Apps/Upgrade-rollback-delete-an-App).
### Helm
To uninstall the `authelia` deployment
```console
helm uninstall authelia
```
## Configuration
### Helm
#### Available Settings
Read through the values.yaml file. It has several commented out suggested values.
Other values may be used from the [values.yaml](https://github.com/truecharts/library-charts/tree/main/charts/stable/common/values.yaml) from the [common library](https://github.com/truecharts/library-charts/tree/main/charts/common).
#### Configure using the command line
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
```console
helm install authelia \
--set env.TZ="America/New York" \
TrueCharts/authelia
```
#### Configure using a yaml file
Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart.
```console
helm install authelia TrueCharts/authelia -f values.yaml
```
#### Connecting to other charts
If you need to connect this Chart to other Charts on TrueNAS SCALE, please refer to our [Linking Charts Internally](https://truecharts.org/docs/manual/SCALE%20Apps/linking-apps) quick-start guide.
## Support
- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/docs/manual/SCALE%20Apps/Important-MUST-READ).
- See the [Website](https://truecharts.org)
- Check our [Discord](https://discord.gg/tVsPTHWTtr)
- Open a [issue](https://github.com/truecharts/apps/issues/new/choose)
---
## Sponsor TrueCharts
TrueCharts can only exist due to the incredible effort of our staff.
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
---
All Rights Reserved - The TrueCharts Project

View File

@ -0,0 +1,9 @@
## [authelia-14.0.17](https://github.com/truecharts/charts/compare/authelia-14.0.16...authelia-14.0.17) (2022-12-21)
### Chore
- update container image tccr.io/truecharts/authelia to v4.37.5

View File

@ -0,0 +1,8 @@
Authelia is a Single Sign-On Multi-Factor portal for web apps
This App is supplied by TrueCharts, for more information visit the manual: [https://truecharts.org/docs/charts/stable/authelia](https://truecharts.org/docs/charts/stable/authelia)
---
TrueCharts can only exist due to the incredible effort of our staff.
Please consider making a [donation](https://truecharts.org/docs/about/sponsor) or contributing back to the project any way you can!

View File

@ -0,0 +1,628 @@
image:
repository: tccr.io/truecharts/authelia
pullPolicy: IfNotPresent
tag: 4.37.5@sha256:76a4617539534cec140fd98a12f721b878524f2df3a3653f3df8ff2b7eaab586
command: ["authelia"]
args: ["--config=/configuration.yaml"]
enableServiceLinks: false
service:
main:
ports:
main:
port: 9091
targetPort: 9091
persistence:
config:
enabled: true
mountPath: "/config"
# Enabled postgres
postgresql:
enabled: true
existingSecret: "dbcreds"
postgresqlUsername: authelia
postgresqlDatabase: authelia
# Enabled redis
# ... for more options see https://github.com/tccr.io/truecharts/charts/tree/master/tccr.io/truecharts/redis
redis:
enabled: true
existingSecret: "rediscreds"
resources:
limits: {}
# limits:
# cpu: "4.00"
# memory: 125Mi
requests: {}
# requests:
# cpu: "0.25"
# memory: 50Mi
envFrom:
- configMapRef:
name: authelia-paths
# probes:
# liveness:
# type: HTTP
# path: /api/health"
# readiness:
# type: HTTP
# path: "/api/health"
# startup:
# type: HTTP
# path: "/api/health"
domain: example.com
##
## Server Configuration
##
server:
##
## Port sets the configured port for the daemon, service, and the probes.
## Default is 9091 and should not need to be changed.
##
port: 9091
## Buffers usually should be configured to be the same value.
## Explanation at https://www.authelia.com/docs/configuration/server.html
## Read buffer size adjusts the server's max incoming request size in bytes.
## Write buffer size does the same for outgoing responses.
read_buffer_size: 4096
write_buffer_size: 4096
## Set the single level path Authelia listens on.
## Must be alphanumeric chars and should not contain any slashes.
path: ""
log:
## Level of verbosity for logs: info, debug, trace.
level: trace
## Format the logs are written as: json, text.
format: text
## TODO: Statefulness check should check if this is set, and the configMap should enable it.
## File path where the logs will be written. If not set logs are written to stdout.
# file_path: /config/authelia.log
## Default redirection URL
##
## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end
## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use
## in such a case.
##
## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
## Default is https://www.<domain> (value at the top of the values.yaml).
default_redirection_url: ""
# default_redirection_url: https://example.com
theme: light
##
## TOTP Configuration
##
## Parameters used for TOTP generation
totp:
## The issuer name displayed in the Authenticator application of your choice
## See: https://github.com/google/google-authenticator/wiki/Key-Uri-Format for more info on issuer names
## Defaults to <domain>.
issuer: ""
## The period in seconds a one-time password is current for. Changing this will require all users to register
## their TOTP applications again. Warning: before changing period read the docs link below.
period: 30
## The skew controls number of one-time passwords either side of the current one that are valid.
## Warning: before changing skew read the docs link below.
## See: https://www.authelia.com/docs/configuration/one-time-password.html#period-and-skew to read the documentation.
skew: 1
##
## Duo Push API Configuration
##
## Parameters used to contact the Duo API. Those are generated when you protect an application of type
## "Partner Auth API" in the management panel.
duo_api:
enabled: false
hostname: api-123456789.example.com
integration_key: ABCDEF
plain_api_key: ""
##
## Authentication Backend Provider Configuration
##
## Used for verifying user passwords and retrieve information such as email address and groups users belong to.
##
## The available providers are: `file`, `ldap`. You must use one and only one of these providers.
authentication_backend:
## Disable both the HTML element and the API for reset password functionality
disable_reset_password: false
## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation.
## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
## To force update on every request you can set this to '0' or 'always', this will increase processor demand.
## See the below documentation for more information.
## Duration Notation docs: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
## Refresh Interval docs: https://www.authelia.com/docs/configuration/authentication/ldap.html#refresh-interval
refresh_interval: 5m
## LDAP backend configuration.
##
## This backend allows Authelia to be scaled to more
## than one instance and therefore is recommended for
## production.
ldap:
## Enable LDAP Backend.
enabled: false
## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
## Acceptable options are as follows:
## - 'activedirectory' - For Microsoft Active Directory.
## - 'custom' - For custom specifications of attributes and filters.
## This currently defaults to 'custom' to maintain existing behaviour.
##
## Depending on the option here certain other values in this section have a default value, notably all of the
## attribute mappings have a default value that this config overrides, you can read more about these default values
## at https://www.authelia.com/docs/configuration/authentication/ldap.html#defaults
implementation: activedirectory
## The url to the ldap server. Format: <scheme>://<address>[:<port>].
## Scheme can be ldap or ldaps in the format (port optional).
url: ldap://openldap.default.svc.cluster.local
## Connection Timeout.
timeout: 5s
## Use StartTLS with the LDAP connection.
start_tls: false
tls:
## Server Name for certificate validation (in case it's not set correctly in the URL).
server_name: ""
## Skip verifying the server certificate (to allow a self-signed certificate).
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
skip_verify: false
## Minimum TLS version for either Secure LDAP or LDAP StartTLS.
minimum_version: TLS1.2
## The base dn for every LDAP query.
base_dn: DC=example,DC=com
## The attribute holding the username of the user. This attribute is used to populate the username in the session
## information. It was introduced due to #561 to handle case insensitive search queries. For you information,
## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this
## attribute holds the unique identifiers for the users binding the user and the configuration stored in database.
## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user
## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also
## be used but we don't recommend using them, we instead advise to use the attributes mentioned above
## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt.
username_attribute: ""
## An additional dn to define the scope to all users.
additional_users_dn: OU=Users
## The users filter used in search queries to find the user profile based on input filled in login form.
## Various placeholders are available in the user filter:
## - {input} is a placeholder replaced by what the user inputs in the login form.
## - {username_attribute} is a mandatory placeholder replaced by what is configured in `username_attribute`.
## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`.
## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later
## versions, so please don't use it.
##
## Recommended settings are as follows:
## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
## - OpenLDAP:
## - (&({username_attribute}={input})(objectClass=person))
## - (&({username_attribute}={input})(objectClass=inetOrgPerson))
##
## To allow sign in both with username and email, one can use a filter like
## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
users_filter: ""
## An additional dn to define the scope of groups.
additional_groups_dn: OU=Groups
## The groups filter used in search queries to find the groups of the user.
## - {input} is a placeholder replaced by what the user inputs in the login form.
## - {username} is a placeholder replace by the username stored in LDAP (based on `username_attribute`).
## - {dn} is a matcher replaced by the user distinguished name, aka, user DN.
## - {username_attribute} is a placeholder replaced by what is configured in `username_attribute`.
## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`.
## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later
## versions, so please don't use it.
## - DON'T USE - {1} is an alias for {username} supported for backward compatibility but it will be deprecated in
## later version, so please don't use it.
##
## If your groups use the `groupOfUniqueNames` structure use this instead:
## (&(uniquemember={dn})(objectclass=groupOfUniqueNames))
groups_filter: ""
## The attribute holding the name of the group
group_name_attribute: ""
## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
## first one returned by the LDAP server is used.
mail_attribute: ""
## The attribute holding the display name of the user. This will be used to greet an authenticated user.
display_name_attribute: ""
## The username of the admin user.
user: CN=Authelia,DC=example,DC=com
plain_password: ""
##
## File (Authentication Provider)
##
## With this backend, the users database is stored in a file which is updated when users reset their passwords.
## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia
## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security
## implications it is highly recommended you leave the default values. Before considering changing these settings
## please read the docs page below:
## https://www.authelia.com/docs/configuration/authentication/file.html#password-hash-algorithm-tuning
##
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
##
file:
enabled: true
path: /config/users_database.yml
password:
algorithm: argon2id
iterations: 1
key_length: 32
salt_length: 16
memory: 1024
parallelism: 8
##
## Access Control Configuration
##
## Access control is a list of rules defining the authorizations applied for one resource to users or group of users.
##
## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed
## to anyone. Otherwise restrictions follow the rules defined.
##
## Note: One can use the wildcard * to match any subdomain.
## It must stand at the beginning of the pattern. (example: *.mydomain.com)
##
## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct.
##
## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'.
##
## - 'domain' defines which domain or set of domains the rule applies to.
##
## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not
## provided. If provided, the parameter represents either a user or a group. It should be of the form
## 'user:<username>' or 'group:<groupname>'.
##
## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'.
##
## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter
## is optional and matches any resource if not provided.
##
## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies.
access_control:
## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
## resource if there is no policy to be applied to the user.
default_policy: deny
networks: []
# networks:
# - name: private
# networks:
# - 10.0.0.0/8
# - 172.16.0.0/12
# - 192.168.0.0/16
# - name: vpn
# networks:
# - 10.9.0.0/16
rules: []
# rules:
# - domain: public.example.com
# policy: bypass
# - domain: "*.example.com"
# policy: bypass
# methods:
# - OPTIONS
# - domain: secure.example.com
# policy: one_factor
# networks:
# - private
# - vpn
# - 192.168.1.0/24
# - 10.0.0.1
# - domain:
# - secure.example.com
# - private.example.com
# policy: two_factor
# - domain: singlefactor.example.com
# policy: one_factor
# - domain: "mx2.mail.example.com"
# subject: "group:admins"
# policy: deny
# - domain: "*.example.com"
# subject:
# - "group:admins"
# - "group:moderators"
# policy: two_factor
# - domain: dev.example.com
# resources:
# - "^/groups/dev/.*$"
# subject: "group:dev"
# policy: two_factor
# - domain: dev.example.com
# resources:
# - "^/users/john/.*$"
# subject:
# - ["group:dev", "user:john"]
# - "group:admins"
# policy: two_factor
# - domain: "{user}.example.com"
# policy: bypass
##
## Session Provider Configuration
##
## The session cookies identify the user once logged in.
## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined.
session:
## The name of the session cookie. (default: authelia_session).
name: authelia_session
## Sets the Cookie SameSite value. Possible options are none, lax, or strict.
## Please read https://www.authelia.com/docs/configuration/session.html#same_site
same_site: lax
## The time in seconds before the cookie expires and session is reset.
expiration: 1h
## The inactivity time in seconds before the session is reset.
inactivity: 5m
## The remember me duration.
## Value is in seconds, or duration notation. Value of 0 disables remember me.
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
## Longer periods are considered less secure because a stolen cookie will last longer giving attackers more time to
## spy or attack. Currently the default is 1M or 1 month.
remember_me_duration: 1M
##
## Redis Provider
##
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
##
## The redis connection details
redisProvider:
port: 6379
## Optional username to be used with authentication.
# username: authelia
username: ""
## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
database_index: 0
## The maximum number of concurrent active connections to Redis.
maximum_active_connections: 8
## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
minimum_idle_connections: 0
## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s).
tls:
enabled: false
## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
server_name: ""
## Skip verifying the server certificate (to allow a self-signed certificate).
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
skip_verify: false
## Minimum TLS version for the connection.
minimum_version: TLS1.2
## The Redis HA configuration options.
## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
high_availability:
enabled: false
enabledSecret: false
## Sentinel Name / Master Name
sentinel_name: mysentinel
## The additional nodes to pre-seed the redis provider with (for sentinel).
## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
## For high availability to be used you must have either defined; the host above or at least one node below.
nodes: []
# nodes:
# - host: sentinel-0.databases.svc.cluster.local
# port: 26379
# - host: sentinel-1.databases.svc.cluster.local
# port: 26379
## Choose the host with the lowest latency.
route_by_latency: false
## Choose the host randomly.
route_randomly: false
##
## Regulation Configuration
##
## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are done
## in a short period of time.
regulation:
## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
max_retries: 3
## The time range during which the user can attempt login before being banned. The user is banned if the
## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
find_time: 2m
## The length of time before a banned user can login again. Ban Time accepts duration notation.
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
ban_time: 5m
##
## Storage Provider Configuration
##
## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.
storage:
##
## PostgreSQL (Storage Provider)
##
postgres:
port: 5432
database: authelia
username: authelia
sslmode: disable
timeout: 5s
##
## Notification Provider
##
##
## Notifications are sent to users when they require a password reset, a u2f registration or a TOTP registration.
## The available providers are: filesystem, smtp. You must use one and only one of these providers.
notifier:
## You can disable the notifier startup check by setting this to true.
disable_startup_check: false
##
## File System (Notification Provider)
##
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
##
filesystem:
enabled: true
filename: /config/notification.txt
##
## SMTP (Notification Provider)
##
## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate.
## [Security] By default Authelia will:
## - force all SMTP connections over TLS including unauthenticated connections
## - use the disable_require_tls boolean value to disable this requirement
## (only works for unauthenticated connections)
## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates
## (configure in tls section)
smtp:
enabled: false
enabledSecret: false
host: smtp.mail.svc.cluster.local
port: 25
timeout: 5s
username: test
plain_password: test
sender: admin@example.com
## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost.
identifier: localhost
## Subject configuration of the emails sent.
## {title} is replaced by the text from the notifier
subject: "[Authelia] {title}"
## This address is used during the startup check to verify the email configuration is correct.
## It's not important what it is except if your email server only allows local delivery.
startup_check_address: test@authelia.com
disable_require_tls: false
disable_html_emails: false
tls:
## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
server_name: ""
## Skip verifying the server certificate (to allow a self-signed certificate).
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
skip_verify: false
## Minimum TLS version for either StartTLS or SMTPS.
minimum_version: TLS1.2
identity_providers:
oidc:
## Enables this in the config map. Currently in beta stage.
## See https://www.authelia.com/docs/configuration/identity-providers/oidc.html#roadmap
enabled: false
access_token_lifespan: 1h
authorize_code_lifespan: 1m
id_token_lifespan: 1h
refresh_token_lifespan: 90m
enable_client_debug_messages: false
## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for
## security reasons.
minimum_parameter_entropy: 8
clients: []
# clients:
# -
## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
# id: myapp
## The description to show to users when they end up on the consent screen. Defaults to the ID above.
# description: My Application
## The client secret is a shared secret between Authelia and the consumer of this client.
# secret: apple123
## Sets the client to public. This should typically not be set, please see the documentation for usage.
# public: false
## The policy to require for this client; one_factor or two_factor.
# authorization_policy: two_factor
## Configures the consent mode; auto, explicit or implicit
# consent_mode: auto
## Audience this client is allowed to request.
# audience: []
## Scopes this client is allowed to request.
# scopes:
# - openid
# - profile
# - email
# - groups
## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
# redirect_uris:
# - https://oidc.example.com/oauth2/callback
## Grant Types configures which grants this client can obtain.
## It's not recommended to configure this unless you know what you're doing.
# grant_types:
# - refresh_token
# - authorization_code
## Response Types configures which responses this client can be sent.
## It's not recommended to configure this unless you know what you're doing.
# response_types:
# - code
## Response Modes configures which response modes this client supports.
## It's not recommended to configure this unless you know what you're doing.
# response_modes:
# - form_post
# - query
# - fragment
## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
# userinfo_signing_algorithm: none
portal:
enabled: true

File diff suppressed because it is too large Load Diff

View File

@ -0,0 +1,249 @@
{{/* Define the configmap */}}
{{- define "authelia.configmap" -}}
---
apiVersion: v1
kind: ConfigMap
metadata:
name: authelia-paths
data:
AUTHELIA_SERVER_DISABLE_HEALTHCHECK: "true"
AUTHELIA_JWT_SECRET_FILE: "/secrets/JWT_TOKEN"
AUTHELIA_SESSION_SECRET_FILE: "/secrets/SESSION_ENCRYPTION_KEY"
AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: "/secrets/ENCRYPTION_KEY"
AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE: "/secrets/STORAGE_PASSWORD"
{{- if .Values.authentication_backend.ldap.enabled }}
AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE: "/secrets/LDAP_PASSWORD"
{{- end }}
{{- if .Values.notifier.smtp.enabled }}
AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE: "/secrets/SMTP_PASSWORD"
{{- end }}
AUTHELIA_SESSION_REDIS_PASSWORD_FILE: "/secrets/REDIS_PASSWORD"
{{- if .Values.redisProvider.high_availability.enabled }}
AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_PASSWORD_FILE: "/secrets/REDIS_SENTINEL_PASSWORD"
{{- end }}
{{- if .Values.duo_api.enabled }}
AUTHELIA_DUO_API_SECRET_KEY_FILE: "/secrets/DUO_API_KEY"
{{- end }}
{{- if .Values.identity_providers.oidc.enabled }}
AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE: "/secrets/OIDC_HMAC_SECRET"
AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE: "/secrets/OIDC_PRIVATE_KEY"
{{- end }}
---
apiVersion: v1
kind: ConfigMap
metadata:
name: authelia-configfile
data:
configuration.yaml: |
---
theme: {{ default "light" .Values.theme }}
default_redirection_url: {{ default (printf "https://www.%s" .Values.domain) .Values.default_redirection_url }}
server:
host: 0.0.0.0
port: {{ default 9091 .Values.server.port }}
{{- if not (eq "" (default "" .Values.server.path)) }}
path: {{ .Values.server.path }}
{{- end }}
read_buffer_size: {{ default 4096 .Values.server.read_buffer_size }}
write_buffer_size: {{ default 4096 .Values.server.write_buffer_size }}
enable_pprof: {{ default false .Values.server.enable_pprof }}
enable_expvars: {{ default false .Values.server.enable_expvars }}
log:
level: {{ default "info" .Values.log.level }}
format: {{ default "text" .Values.log.format }}
{{- if not (eq "" (default "" .Values.log.file_path)) }}
file_path: {{ .Values.log.file_path }}
keep_stdout: true
{{- end }}
totp:
issuer: {{ default .Values.domain .Values.totp.issuer }}
period: {{ default 30 .Values.totp.period }}
skew: {{ default 1 .Values.totp.skew }}
{{- if .Values.duo_api.enabled }}
duo_api:
hostname: {{ .Values.duo_api.hostname }}
integration_key: {{ .Values.duo_api.integration_key }}
{{- end }}
{{- with $auth := .Values.authentication_backend }}
authentication_backend:
disable_reset_password: {{ $auth.disable_reset_password }}
{{- if $auth.file.enabled }}
file:
path: {{ $auth.file.path }}
password: {{ toYaml $auth.file.password | nindent 10 }}
{{- end }}
{{- if $auth.ldap.enabled }}
ldap:
implementation: {{ default "custom" $auth.ldap.implementation }}
url: {{ $auth.ldap.url }}
timeout: {{ default "5s" $auth.ldap.timeout }}
start_tls: {{ $auth.ldap.start_tls }}
tls:
{{- if hasKey $auth.ldap.tls "server_name" }}
server_name: {{ default $auth.ldap.host $auth.ldap.tls.server_name }}
{{- end }}
minimum_version: {{ default "TLS1.2" $auth.ldap.tls.minimum_version }}
skip_verify: {{ default false $auth.ldap.tls.skip_verify }}
{{- if $auth.ldap.base_dn }}
base_dn: {{ $auth.ldap.base_dn }}
{{- end }}
{{- if $auth.ldap.username_attribute }}
username_attribute: {{ $auth.ldap.username_attribute }}
{{- end }}
{{- if $auth.ldap.additional_users_dn }}
additional_users_dn: {{ $auth.ldap.additional_users_dn }}
{{- end }}
{{- if $auth.ldap.users_filter }}
users_filter: {{ $auth.ldap.users_filter }}
{{- end }}
{{- if $auth.ldap.additional_groups_dn }}
additional_groups_dn: {{ $auth.ldap.additional_groups_dn }}
{{- end }}
{{- if $auth.ldap.groups_filter }}
groups_filter: {{ $auth.ldap.groups_filter }}
{{- end }}
{{- if $auth.ldap.group_name_attribute }}
group_name_attribute: {{ $auth.ldap.group_name_attribute }}
{{- end }}
{{- if $auth.ldap.mail_attribute }}
mail_attribute: {{ $auth.ldap.mail_attribute }}
{{- end }}
{{- if $auth.ldap.display_name_attribute }}
display_name_attribute: {{ $auth.ldap.display_name_attribute }}
{{- end }}
user: {{ $auth.ldap.user }}
{{- end }}
{{- end }}
{{- with $session := .Values.session }}
session:
name: {{ default "authelia_session" $session.name }}
domain: {{ required "A valid .Values.domain entry required!" $.Values.domain }}
same_site: {{ default "lax" $session.same_site }}
expiration: {{ default "1M" $session.expiration }}
inactivity: {{ default "5m" $session.inactivity }}
remember_me_duration: {{ default "1M" $session.remember_me_duration }}
{{- end }}
redis:
host: {{ .Values.redis.url.plain }}
{{- with $redis := .Values.redisProvider }}
port: {{ default 6379 $redis.port }}
{{- if not (eq $redis.username "") }}
username: {{ $redis.username }}
{{- end }}
maximum_active_connections: {{ default 8 $redis.maximum_active_connections }}
minimum_idle_connections: {{ default 0 $redis.minimum_idle_connections }}
{{- if $redis.tls.enabled }}
tls:
server_name: {{ $redis.tls.server_name }}
minimum_version: {{ default "TLS1.2" $redis.tls.minimum_version }}
skip_verify: {{ $redis.tls.skip_verify }}
{{- end }}
{{- if $redis.high_availability.enabled }}
high_availability:
sentinel_name: {{ $redis.high_availability.sentinel_name }}
{{- if $redis.high_availability.nodes }}
nodes: {{ toYaml $redis.high_availability.nodes | nindent 10 }}
{{- end }}
route_by_latency: {{ $redis.high_availability.route_by_latency }}
route_randomly: {{ $redis.high_availability.route_randomly }}
{{- end }}
{{- end }}
regulation: {{ toYaml .Values.regulation | nindent 6 }}
storage:
postgres:
host: {{ printf "%v-%v" .Release.Name "postgresql" }}
{{- with $storage := .Values.storage }}
port: {{ default 5432 $storage.postgres.port }}
database: {{ default "authelia" $storage.postgres.database }}
username: {{ default "authelia" $storage.postgres.username }}
timeout: {{ default "5s" $storage.postgres.timeout }}
sslmode: {{ default "disable" $storage.postgres.sslmode }}
{{- end }}
{{- with $notifier := .Values.notifier }}
notifier:
disable_startup_check: {{ $.Values.notifier.disable_startup_check }}
{{- if $notifier.filesystem.enabled }}
filesystem:
filename: {{ $notifier.filesystem.filename }}
{{- end }}
{{- if $notifier.smtp.enabled }}
smtp:
host: {{ $notifier.smtp.host }}
port: {{ default 25 $notifier.smtp.port }}
timeout: {{ default "5s" $notifier.smtp.timeout }}
username: {{ $notifier.smtp.username }}
sender: {{ $notifier.smtp.sender }}
identifier: {{ $notifier.smtp.identifier }}
subject: {{ $notifier.smtp.subject | quote }}
startup_check_address: {{ $notifier.smtp.startup_check_address }}
disable_require_tls: {{ $notifier.smtp.disable_require_tls }}
disable_html_emails: {{ $notifier.smtp.disable_html_emails }}
tls:
server_name: {{ default $notifier.smtp.host $notifier.smtp.tls.server_name }}
minimum_version: {{ default "TLS1.2" $notifier.smtp.tls.minimum_version }}
skip_verify: {{ default false $notifier.smtp.tls.skip_verify }}
{{- end }}
{{- end }}
{{- if .Values.identity_providers.oidc.enabled }}
identity_providers:
oidc:
access_token_lifespan: {{ default "1h" .Values.identity_providers.oidc.access_token_lifespan }}
authorize_code_lifespan: {{ default "1m" .Values.identity_providers.oidc.authorize_code_lifespan }}
id_token_lifespan: {{ default "1h" .Values.identity_providers.oidc.id_token_lifespan }}
refresh_token_lifespan: {{ default "90m" .Values.identity_providers.oidc.refresh_token_lifespan }}
enable_client_debug_messages: {{ default false .Values.identity_providers.oidc.enable_client_debug_messages }}
minimum_parameter_entropy: {{ default 8 .Values.identity_providers.oidc.minimum_parameter_entropy }}
{{- if gt (len .Values.identity_providers.oidc.clients) 0 }}
clients:
{{- range $client := .Values.identity_providers.oidc.clients }}
- id: {{ $client.id }}
description: {{ default $client.id $client.description }}
secret: {{ default (randAlphaNum 128) $client.secret }}
{{- if $client.public }}
public: {{ $client.public }}
{{- end }}
authorization_policy: {{ default "two_factor" $client.authorization_policy }}
consent_mode: {{ default "auto" $client.consent_mode}}
redirect_uris:
{{- range $client.redirect_uris }}
- {{ . }}
{{- end }}
{{- if $client.audience }}
audience: {{ toYaml $client.audience | nindent 10 }}
{{- end }}
scopes: {{ toYaml (default (list "openid" "profile" "email" "groups") $client.scopes) | nindent 10 }}
grant_types: {{ toYaml (default (list "refresh_token" "authorization_code") $client.grant_types) | nindent 10 }}
response_types: {{ toYaml (default (list "code") $client.response_types) | nindent 10 }}
{{- if $client.response_modes }}
response_modes: {{ toYaml $client.response_modes | nindent 10 }}
{{- end }}
userinfo_signing_algorithm: {{ default "none" $client.userinfo_signing_algorithm }}
{{- end }}
{{- end }}
{{- end }}
access_control:
{{- if (eq (len .Values.access_control.rules) 0) }}
{{- if (eq .Values.access_control.default_policy "bypass") }}
default_policy: one_factor
{{- else if (eq .Values.access_control.default_policy "deny") }}
default_policy: two_factor
{{- else }}
default_policy: {{ .Values.access_control.default_policy }}
{{- end }}
{{- else }}
default_policy: {{ .Values.access_control.default_policy }}
{{- end }}
{{- if (eq (len .Values.access_control.networks) 0) }}
networks: []
{{- else }}
networks: {{ toYaml .Values.access_control.networks | nindent 6 }}
{{- end }}
{{- if (eq (len .Values.access_control.rules) 0) }}
rules: []
{{- else }}
rules: {{ toYaml .Values.access_control.rules | nindent 6 }}
{{- end }}
...
{{- end -}}

View File

@ -0,0 +1,67 @@
{{/* Define the secrets */}}
{{- define "authelia.secrets" -}}
---
apiVersion: v1
kind: Secret
type: Opaque
metadata:
name: authelia-secrets
{{- $autheliaprevious := lookup "v1" "Secret" .Release.Namespace "authelia-secrets" }}
{{- $oidckey := "" }}
{{- $oidcsecret := "" }}
{{- $jwtsecret := "" }}
{{- $sessionsecret := "" }}
{{- $encryptionkey := "" }}
data:
{{- if $autheliaprevious }}
SESSION_ENCRYPTION_KEY: {{ index $autheliaprevious.data "SESSION_ENCRYPTION_KEY" }}
JWT_TOKEN: {{ index $autheliaprevious.data "JWT_TOKEN" }}
{{- if ( hasKey $autheliaprevious.data "ENCRYPTION_KEY" ) }}
ENCRYPTION_KEY: {{ index $autheliaprevious.data "ENCRYPTION_KEY" }}
{{- else }}
{{- $encryptionkey := randAlphaNum 100 }}
ENCRYPTION_KEY: {{ $encryptionkey | b64enc }}
{{- end }}
{{- else }}
{{- $jwtsecret := randAlphaNum 50 }}
{{- $sessionsecret := randAlphaNum 50 }}
{{- $encryptionkey := randAlphaNum 100 }}
SESSION_ENCRYPTION_KEY: {{ $sessionsecret | b64enc }}
JWT_TOKEN: {{ $jwtsecret | b64enc}}
ENCRYPTION_KEY: {{ $encryptionkey | b64enc }}
{{- end }}
{{- if .Values.authentication_backend.ldap.enabled }}
LDAP_PASSWORD: {{ .Values.authentication_backend.ldap.plain_password | b64enc | quote }}
{{- end }}
{{- if .Values.notifier.smtp.enabled }}
SMTP_PASSWORD: {{ .Values.notifier.smtp.plain_password | b64enc | quote }}
{{- end }}
{{- if .Values.duo_api.enabled }}
DUO_API_KEY: {{ .Values.duo_api.plain_api_key | b64enc }}
{{- end }}
STORAGE_PASSWORD: {{ .Values.postgresql.postgresqlPassword | trimAll "\"" | b64enc }}
REDIS_PASSWORD: {{ .Values.redis.redisPassword | trimAll "\"" | b64enc }}
{{- if .Values.redisProvider.high_availability.enabled}}
REDIS_SENTINEL_PASSWORD: {{ .Values.redis.sentinelPassword | trimAll "\"" | b64enc }}
{{- end }}
{{- if $autheliaprevious }}
{{- if and ( hasKey $autheliaprevious.data "OIDC_PRIVATE_KEY" ) ( hasKey $autheliaprevious.data "OIDC_HMAC_SECRET" ) }}
OIDC_PRIVATE_KEY: {{ index $autheliaprevious.data "OIDC_PRIVATE_KEY" }}
OIDC_HMAC_SECRET: {{ index $autheliaprevious.data "OIDC_HMAC_SECRET" }}
{{- else }}
{{- $oidckey := genPrivateKey "rsa" }}
{{- $oidcsecret := randAlphaNum 32 }}
OIDC_PRIVATE_KEY: {{ $oidckey | b64enc }}
OIDC_HMAC_SECRET: {{ $oidcsecret | b64enc }}
{{- end }}
{{- end }}
{{- end -}}

View File

@ -0,0 +1,74 @@
{{/* Make sure all variables are set properly */}}
{{- include "tc.common.loader.init" . }}
{{/* Render configmap for authelia */}}
{{- include "authelia.configmap" . }}
{{/* Render secrets for authelia */}}
{{- include "authelia.secrets" . }}
{{/* Append the general configMap volume to the volumes */}}
{{- define "authelia.configmapVolume" -}}
enabled: "true"
mountPath: " /configuration.yaml"
readOnly: true
subPath: configuration.yaml
type: "custom"
volumeSpec:
configMap:
name: authelia-configfile
items:
- key: configuration.yaml
path: configuration.yaml
{{- end -}}
{{/* Append the general secret volumes to the volumes */}}
{{- define "authelia.secretVolumes" -}}
enabled: "true"
mountPath: "/secrets"
readOnly: true
type: "custom"
volumeSpec:
secret:
secretName: authelia-secrets
items:
- key: "JWT_TOKEN"
path: JWT_TOKEN
- key: "SESSION_ENCRYPTION_KEY"
path: SESSION_ENCRYPTION_KEY
- key: "ENCRYPTION_KEY"
path: ENCRYPTION_KEY
- key: "STORAGE_PASSWORD"
path: STORAGE_PASSWORD
{{- if .Values.authentication_backend.ldap.enabled }}
- key: "LDAP_PASSWORD"
path: LDAP_PASSWORD
{{- end }}
{{- if .Values.notifier.smtp.enabled }}
- key: "SMTP_PASSWORD"
path: SMTP_PASSWORD
{{- end }}
- key: "REDIS_PASSWORD"
path: REDIS_PASSWORD
{{- if .Values.redisProvider.high_availability.enabled}}
- key: "REDIS_SENTINEL_PASSWORD"
path: REDIS_SENTINEL_PASSWORD
{{- end }}
{{- if .Values.duo_api.enabled }}
- key: "DUO_API_KEY"
path: DUO_API_KEY
{{- end }}
{{- if .Values.identity_providers.oidc.enabled }}
- key: "OIDC_PRIVATE_KEY"
path: OIDC_PRIVATE_KEY
- key: "OIDC_HMAC_SECRET"
path: OIDC_HMAC_SECRET
{{- end }}
{{- end -}}
{{- $_ := set .Values.persistence "authelia-configfile" (include "authelia.configmapVolume" . | fromYaml) -}}
{{- $_ := set .Values.persistence "authelia-secrets" (include "authelia.secretVolumes" . | fromYaml) -}}
{{/* Render the templates */}}
{{ include "tc.common.loader.apply" . }}

View File

@ -1,9 +0,0 @@
## [n8n-7.0.21](https://github.com/truecharts/charts/compare/n8n-7.0.20...n8n-7.0.21) (2022-12-19)
### Chore
- update helm general non-major

View File

@ -4,6 +4,15 @@
## [n8n-7.0.22](https://github.com/truecharts/charts/compare/n8n-7.0.21...n8n-7.0.22) (2022-12-21)
### Chore
- update container image tccr.io/truecharts/n8n to v0.209.0
## [n8n-7.0.21](https://github.com/truecharts/charts/compare/n8n-7.0.20...n8n-7.0.21) (2022-12-19)
### Chore
@ -88,12 +97,3 @@
## [n8n-7.0.11](https://github.com/truecharts/charts/compare/n8n-7.0.9...n8n-7.0.11) (2022-11-30)
## [n8n-7.0.11](https://github.com/truecharts/charts/compare/n8n-7.0.9...n8n-7.0.11) (2022-11-30)

View File

@ -1,5 +1,5 @@
apiVersion: v2
appVersion: "0.208.1"
appVersion: "0.209.0"
dependencies:
- name: common
repository: https://library-charts.truecharts.org
@ -29,7 +29,7 @@ sources:
- https://docs.n8n.io/
- https://github.com/n8n-io/n8n
- https://hub.docker.com/r/n8nio/n8n
version: 7.0.21
version: 7.0.22
annotations:
truecharts.org/catagories: |
- media

View File

@ -0,0 +1,9 @@
## [n8n-7.0.22](https://github.com/truecharts/charts/compare/n8n-7.0.21...n8n-7.0.22) (2022-12-21)
### Chore
- update container image tccr.io/truecharts/n8n to v0.209.0

Binary file not shown.

Binary file not shown.

Binary file not shown.

View File

@ -1,6 +1,6 @@
image:
repository: tccr.io/truecharts/n8n
tag: 0.208.1@sha256:009fdbaedb755c272d51042b72fd1906218dfca69e5c1bf5ba4088125f46a48b
tag: 0.209.0@sha256:c9cd26b0f9f3e9462d51232e3e237f386820b4590b4cd8eac3fcfb9b871a4bdf
pullPolicy: IfNotPresent
securityContext:

View File