image: repository: ghcr.io/authelia/authelia pullPolicy: IfNotPresent tag: 4.37.5@sha256:25fc5423238b6f3a1fc967fda3f6a9212846aeb4a720327ef61c8ccff52dbbe2 manifestManager: enabled: true workload: main: replicas: 2 strategy: RollingUpdate podSpec: containers: main: command: - authelia args: - --config=/configuration.yaml envFrom: - configMapRef: name: authelia-paths probes: liveness: type: http path: "/api/health" readiness: type: http path: "/api/health" startup: type: http path: "/api/health" service: main: ports: main: port: 9091 targetPort: 9091 persistence: config: enabled: true mountPath: "/config" cnpg: main: enabled: true user: authelia database: authelia # Enabled redis # ... for more options see https://github.com/tccr.io/truecharts/charts/tree/master/tccr.io/truecharts/redis redis: enabled: true domain: example.com ## ## Server Configuration ## server: ## ## Port sets the configured port for the daemon, service, and the probes. ## Default is 9091 and should not need to be changed. ## port: 9091 ## Buffers usually should be configured to be the same value. ## Explanation at https://www.authelia.com/docs/configuration/server.html ## Read buffer size adjusts the server's max incoming request size in bytes. ## Write buffer size does the same for outgoing responses. read_buffer_size: 4096 write_buffer_size: 4096 ## Set the single level path Authelia listens on. ## Must be alphanumeric chars and should not contain any slashes. path: "" log: ## Level of verbosity for logs: info, debug, trace. level: trace ## Format the logs are written as: json, text. format: text ## TODO: Statefulness check should check if this is set, and the configMap should enable it. ## File path where the logs will be written. If not set logs are written to stdout. # file_path: /config/authelia.log ## Default redirection URL ## ## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end ## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use ## in such a case. ## ## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication. ## Default is https://www. (value at the top of the values.yaml). default_redirection_url: "" # default_redirection_url: https://example.com theme: light ## ## TOTP Configuration ## ## Parameters used for TOTP generation totp: ## The issuer name displayed in the Authenticator application of your choice ## See: https://github.com/google/google-authenticator/wiki/Key-Uri-Format for more info on issuer names ## Defaults to . issuer: "" ## The period in seconds a one-time password is current for. Changing this will require all users to register ## their TOTP applications again. Warning: before changing period read the docs link below. period: 30 ## The skew controls number of one-time passwords either side of the current one that are valid. ## Warning: before changing skew read the docs link below. ## See: https://www.authelia.com/docs/configuration/one-time-password.html#period-and-skew to read the documentation. skew: 1 ## ## Password Policy Config ## ## Parameters used for Password Policies password_policy: ## See: https://www.authelia.com/configuration/security/password-policy/ standard: enabled: false min_length: 8 max_length: 0 require_uppercase: false require_lowercase: false require_number: false require_special: false zxcvbn: ## See https://www.authelia.com/configuration/security/password-policy/#zxcvbn for more info enabled: false min_score: 3 ## ## Duo Push API Configuration ## ## Parameters used to contact the Duo API. Those are generated when you protect an application of type ## "Partner Auth API" in the management panel. duo_api: enabled: false hostname: api-123456789.example.com integration_key: ABCDEF plain_api_key: "" ## NTP settings ntp: address: "time.cloudflare.com:123" version: 4 max_desync: 3s disable_startup_check: false disable_failure: true ## ## Authentication Backend Provider Configuration ## ## Used for verifying user passwords and retrieve information such as email address and groups users belong to. ## ## The available providers are: `file`, `ldap`. You must use one and only one of these providers. authentication_backend: ## Disable both the HTML element and the API for reset password functionality disable_reset_password: false ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation. ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP. ## To force update on every request you can set this to '0' or 'always', this will increase processor demand. ## See the below documentation for more information. ## Duration Notation docs: https://www.authelia.com/docs/configuration/index.html#duration-notation-format ## Refresh Interval docs: https://www.authelia.com/docs/configuration/authentication/ldap.html#refresh-interval refresh_interval: 5m ## LDAP backend configuration. ## ## This backend allows Authelia to be scaled to more ## than one instance and therefore is recommended for ## production. ldap: ## Enable LDAP Backend. enabled: false ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password. ## Acceptable options are as follows: ## - 'activedirectory' - For Microsoft Active Directory. ## - 'custom' - For custom specifications of attributes and filters. ## This currently defaults to 'custom' to maintain existing behaviour. ## ## Depending on the option here certain other values in this section have a default value, notably all of the ## attribute mappings have a default value that this config overrides, you can read more about these default values ## at https://www.authelia.com/docs/configuration/authentication/ldap.html#defaults implementation: activedirectory ## The url to the ldap server. Format: ://
[:]. ## Scheme can be ldap or ldaps in the format (port optional). url: ldap://openldap.default.svc.cluster.local ## Connection Timeout. timeout: 5s ## Use StartTLS with the LDAP connection. start_tls: false tls: ## Server Name for certificate validation (in case it's not set correctly in the URL). server_name: "" ## Skip verifying the server certificate (to allow a self-signed certificate). ## In preference to setting this we strongly recommend you add the public portion of the certificate to the ## certificates directory which is defined by the `certificates_directory` option at the top of the config. skip_verify: false ## Minimum TLS version for either Secure LDAP or LDAP StartTLS. minimum_version: TLS1.2 ## The base dn for every LDAP query. base_dn: DC=example,DC=com ## The attribute holding the username of the user. This attribute is used to populate the username in the session ## information. It was introduced due to #561 to handle case insensitive search queries. For you information, ## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this ## attribute holds the unique identifiers for the users binding the user and the configuration stored in database. ## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user ## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also ## be used but we don't recommend using them, we instead advise to use the attributes mentioned above ## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt. username_attribute: "uid" ## An additional dn to define the scope to all users. additional_users_dn: OU=Users ## The users filter used in search queries to find the user profile based on input filled in login form. ## Various placeholders are available in the user filter: ## - {input} is a placeholder replaced by what the user inputs in the login form. ## - {username_attribute} is a mandatory placeholder replaced by what is configured in `username_attribute`. ## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`. ## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later ## versions, so please don't use it. ## ## Recommended settings are as follows: ## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) ## - OpenLDAP: ## - (&({username_attribute}={input})(objectClass=person)) ## - (&({username_attribute}={input})(objectClass=inetOrgPerson)) ## ## To allow sign in both with username and email, one can use a filter like ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person)) users_filter: "" ## An additional dn to define the scope of groups. additional_groups_dn: OU=Groups ## The groups filter used in search queries to find the groups of the user. ## - {input} is a placeholder replaced by what the user inputs in the login form. ## - {username} is a placeholder replace by the username stored in LDAP (based on `username_attribute`). ## - {dn} is a matcher replaced by the user distinguished name, aka, user DN. ## - {username_attribute} is a placeholder replaced by what is configured in `username_attribute`. ## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`. ## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later ## versions, so please don't use it. ## - DON'T USE - {1} is an alias for {username} supported for backward compatibility but it will be deprecated in ## later version, so please don't use it. ## ## If your groups use the `groupOfUniqueNames` structure use this instead: ## (&(uniquemember={dn})(objectclass=groupOfUniqueNames)) groups_filter: "" ## The attribute holding the name of the group group_name_attribute: "cn" ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the ## first one returned by the LDAP server is used. mail_attribute: "mail" ## The attribute holding the display name of the user. This will be used to greet an authenticated user. display_name_attribute: "displayname" ## The username of the admin user. user: CN=admin,DC=example,DC=com plain_password: "" ## ## File (Authentication Provider) ## ## With this backend, the users database is stored in a file which is updated when users reset their passwords. ## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia ## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security ## implications it is highly recommended you leave the default values. Before considering changing these settings ## please read the docs page below: ## https://www.authelia.com/docs/configuration/authentication/file.html#password-hash-algorithm-tuning ## ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html ## file: enabled: true path: /config/users_database.yml password: algorithm: argon2id iterations: 1 key_length: 32 salt_length: 16 memory: 1024 parallelism: 8 ## ## Access Control Configuration ## ## Access control is a list of rules defining the authorizations applied for one resource to users or group of users. ## ## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed ## to anyone. Otherwise restrictions follow the rules defined. ## ## Note: One can use the wildcard * to match any subdomain. ## It must stand at the beginning of the pattern. (example: *.mydomain.com) ## ## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct. ## ## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'. ## ## - 'domain' defines which domain or set of domains the rule applies to. ## ## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not ## provided. If provided, the parameter represents either a user or a group. It should be of the form ## 'user:' or 'group:'. ## ## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'. ## ## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter ## is optional and matches any resource if not provided. ## ## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies. access_control: ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any ## resource if there is no policy to be applied to the user. default_policy: deny networks: [] # networks: # - name: private # networks: # - 10.0.0.0/8 # - 172.16.0.0/12 # - 192.168.0.0/16 # - name: vpn # networks: # - 10.9.0.0/16 rules: [] # rules: # - domain: public.example.com # policy: bypass # - domain: "*.example.com" # policy: bypass # methods: # - OPTIONS # - domain: secure.example.com # policy: one_factor # networks: # - private # - vpn # - 192.168.1.0/24 # - 10.0.0.1 # - domain: # - secure.example.com # - private.example.com # policy: two_factor # - domain: singlefactor.example.com # policy: one_factor # - domain: "mx2.mail.example.com" # subject: "group:admins" # policy: deny # - domain: "*.example.com" # subject: # - "group:admins" # - "group:moderators" # policy: two_factor # - domain: dev.example.com # resources: # - "^/groups/dev/.*$" # subject: "group:dev" # policy: two_factor # - domain: dev.example.com # resources: # - "^/users/john/.*$" # subject: # - ["group:dev", "user:john"] # - "group:admins" # policy: two_factor # - domain: "{user}.example.com" # policy: bypass ## ## Session Provider Configuration ## ## The session cookies identify the user once logged in. ## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined. session: ## The name of the session cookie. (default: authelia_session). name: authelia_session ## Sets the Cookie SameSite value. Possible options are none, lax, or strict. ## Please read https://www.authelia.com/docs/configuration/session.html#same_site same_site: lax ## The time in seconds before the cookie expires and session is reset. expiration: 1h ## The inactivity time in seconds before the session is reset. inactivity: 5m ## The remember me duration. ## Value is in seconds, or duration notation. Value of 0 disables remember me. ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format ## Longer periods are considered less secure because a stolen cookie will last longer giving attackers more time to ## spy or attack. Currently the default is 1M or 1 month. remember_me_duration: 1M ## ## Redis Provider ## ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html ## ## The redis connection details redisProvider: port: 6379 ## Optional username to be used with authentication. # username: authelia username: "" ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc). database_index: 0 ## The maximum number of concurrent active connections to Redis. maximum_active_connections: 8 ## The target number of idle connections to have open ready for work. Useful when opening connections is slow. minimum_idle_connections: 0 ## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s). tls: enabled: false ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option). server_name: "" ## Skip verifying the server certificate (to allow a self-signed certificate). ## In preference to setting this we strongly recommend you add the public portion of the certificate to the ## certificates directory which is defined by the `certificates_directory` option at the top of the config. skip_verify: false ## Minimum TLS version for the connection. minimum_version: TLS1.2 ## The Redis HA configuration options. ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name). high_availability: enabled: false enabledSecret: false ## Sentinel Name / Master Name sentinel_name: mysentinel ## The additional nodes to pre-seed the redis provider with (for sentinel). ## If the host in the above section is defined, it will be combined with this list to connect to sentinel. ## For high availability to be used you must have either defined; the host above or at least one node below. nodes: [] # nodes: # - host: sentinel-0.databases.svc.cluster.local # port: 26379 # - host: sentinel-1.databases.svc.cluster.local # port: 26379 ## Choose the host with the lowest latency. route_by_latency: false ## Choose the host randomly. route_randomly: false ## ## Regulation Configuration ## ## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are done ## in a short period of time. regulation: ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation. max_retries: 3 ## The time range during which the user can attempt login before being banned. The user is banned if the ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation. ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format find_time: 2m ## The length of time before a banned user can login again. Ban Time accepts duration notation. ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format ban_time: 5m ## ## Storage Provider Configuration ## ## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers. storage: ## ## PostgreSQL (Storage Provider) ## postgres: port: 5432 database: authelia username: authelia sslmode: disable timeout: 5s ## ## Notification Provider ## ## ## Notifications are sent to users when they require a password reset, a u2f registration or a TOTP registration. ## The available providers are: filesystem, smtp. You must use one and only one of these providers. notifier: ## You can disable the notifier startup check by setting this to true. disable_startup_check: false ## ## File System (Notification Provider) ## ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html ## filesystem: enabled: true filename: /config/notification.txt ## ## SMTP (Notification Provider) ## ## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate. ## [Security] By default Authelia will: ## - force all SMTP connections over TLS including unauthenticated connections ## - use the disable_require_tls boolean value to disable this requirement ## (only works for unauthenticated connections) ## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates ## (configure in tls section) smtp: enabled: false enabledSecret: false host: smtp.mail.svc.cluster.local port: 25 timeout: 5s username: test plain_password: test sender: admin@example.com ## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost. identifier: localhost ## Subject configuration of the emails sent. ## {title} is replaced by the text from the notifier subject: "[Authelia] {title}" ## This address is used during the startup check to verify the email configuration is correct. ## It's not important what it is except if your email server only allows local delivery. startup_check_address: test@authelia.com disable_require_tls: false disable_html_emails: false tls: ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option). server_name: "" ## Skip verifying the server certificate (to allow a self-signed certificate). ## In preference to setting this we strongly recommend you add the public portion of the certificate to the ## certificates directory which is defined by the `certificates_directory` option at the top of the config. skip_verify: false ## Minimum TLS version for either StartTLS or SMTPS. minimum_version: TLS1.2 identity_providers: oidc: ## Enables this in the config map. Currently in beta stage. ## See https://www.authelia.com/docs/configuration/identity-providers/oidc.html#roadmap enabled: false access_token_lifespan: 1h authorize_code_lifespan: 1m id_token_lifespan: 1h refresh_token_lifespan: 90m enable_client_debug_messages: false ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for ## security reasons. minimum_parameter_entropy: 8 clients: [] # clients: # - ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration. # id: myapp ## The description to show to users when they end up on the consent screen. Defaults to the ID above. # description: My Application ## The client secret is a shared secret between Authelia and the consumer of this client. # secret: apple123 ## Sets the client to public. This should typically not be set, please see the documentation for usage. # public: false ## The policy to require for this client; one_factor or two_factor. # authorization_policy: two_factor ## Configures the consent mode; auto, explicit or implicit # consent_mode: auto ## Audience this client is allowed to request. # audience: [] ## Scopes this client is allowed to request. # scopes: # - openid # - profile # - email # - groups ## Redirect URI's specifies a list of valid case-sensitive callbacks for this client. # redirect_uris: # - https://oidc.example.com/oauth2/callback ## Grant Types configures which grants this client can obtain. ## It's not recommended to configure this unless you know what you're doing. # grant_types: # - refresh_token # - authorization_code ## Response Types configures which responses this client can be sent. ## It's not recommended to configure this unless you know what you're doing. # response_types: # - code ## Response Modes configures which response modes this client supports. ## It's not recommended to configure this unless you know what you're doing. # response_modes: # - form_post # - query # - fragment ## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256. # userinfo_signing_algorithm: none portal: open: enabled: true