RPJosh
/
authelia
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
authelia/internal/suites/Standalone/configuration.yml

144 lines
3.3 KiB
YAML
Raw Permalink Normal View History

ci: add yamllint (#1895) This change implements yamllint and adjusts all yaml files to abide by our linting setup. This excludes config.template.yml as this will be done in an alternate commit.
2021-04-10 20:51:00 +00:00
---
Fix inactivity Ãe2e tests.
2019-01-30 22:33:14 +00:00
###############################################################
# Authelia minimal configuration #
###############################################################
test(web): integration test auto theme (#2096) Allows capturing of code coverage for the `auto` theme in the Standalone suite.
2021-06-18 07:15:58 +00:00
theme: auto
feat(configuration): replace several configuration options (#2209) This change adjusts several global options moving them into the server block. It additionally notes other breaking changes in the configuration. BREAKING CHANGE: Several configuration options have been changed and moved into other sections. Migration instructions are documented here: https://authelia.com/docs/configuration/migration.html#4.30.0
2021-08-02 11:55:30 +00:00
server:
feat(authentication): suport ldap over unix socket (#5397) This adds support for LDAP unix sockets using the ldapi scheme. In addition it improves all of the address related parsing significantly deprecating old options. Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-05-07 06:39:17 +00:00
address: 'tcp://:9091'
feat(configuration): replace several configuration options (#2209) This change adjusts several global options moving them into the server block. It additionally notes other breaking changes in the configuration. BREAKING CHANGE: Several configuration options have been changed and moved into other sections. Migration instructions are documented here: https://authelia.com/docs/configuration/migration.html#4.30.0
2021-08-02 11:55:30 +00:00
tls:
refactor(suites): use pki for oidc (#4913)
2023-02-11 04:37:54 +00:00
certificate: /pki/public.backend.crt
key: /pki/private.backend.pem
Implement gRPC endpoint for envoy
2023-06-23 19:19:56 +00:00
grpc:
address: 'tcp://0.0.0.0:9092'
disableTLS: false
feat(configuration): replace several configuration options (#2209) This change adjusts several global options moving them into the server block. It additionally notes other breaking changes in the configuration. BREAKING CHANGE: Several configuration options have been changed and moved into other sections. Migration instructions are documented here: https://authelia.com/docs/configuration/migration.html#4.30.0
2021-08-02 11:55:30 +00:00
feat(metrics): implement prometheus metrics (#3234) Adds ability to record metrics and gather them for Prometheus.
2022-06-14 07:20:13 +00:00
telemetry:
metrics:
enabled: true
fix(configuration): address parsing failure (#3653) This fixes an issue with parsing address types from strings.
2022-07-05 04:43:12 +00:00
address: tcp://0.0.0.0:9959
feat(metrics): implement prometheus metrics (#3234) Adds ability to record metrics and gather them for Prometheus.
2022-06-14 07:20:13 +00:00
refactor(configuration): use key log instead of logging (#2072) * refactor: logging config key to log This refactors the recent pre-release change adding log options to their own configuration section in favor of a log section (from logging). * docs: add step to getting started to get the latest tagged commit This is so we avoid issues with changes on master having differences that don't work on the latest docker tag. * test: adjust tests * docs: adjust doc strings
2021-06-08 13:15:43 +00:00
log:
Implement gRPC endpoint for envoy
2023-06-23 19:19:56 +00:00
level: trace
Fix inactivity Ãe2e tests.
2019-01-30 22:33:14 +00:00
authentication_backend:
file:
[FEATURE] Docker simplification and configuration generation (#1113) * [FEATURE] Docker simplification and configuration generation The Authelia binary now will attempt to generate configuration based on the latest template assuming that the config location specified on startup does not exist. If a file based backend is selected and the backend cannot be found similarly it will generate a `user_database.yml` based a template. This will allow more seamless bootstrapping of an environment no matter the deployment method. We have also squashed the Docker volume requirement down to just `/config` thus removing the requirement for `/var/lib/authelia` this is primarily in attempts to simplify the Docker deployment. Users with the old volume mappings have two options: 1. Change their mappings to conform to `/config` 2. Change the container entrypoint from `authelia --config /config/configuration.yml` to their old mapping * Adjust paths relative to `/etc/authelia` and simplify to single volume for compose * Add generation for file backend based user database * Refactor Docker volumes and paths to /config * Refactor Docker WORKDIR to /app * Fix integration tests * Update BREAKING.md for v4.20.0 * Run go mod tidy * Fix log_file_path in miscellaneous.md docs * Generate config and userdb with 0600 permissions * Fix log_file_path in config.template.yml
2020-06-17 06:25:35 +00:00
path: /config/users.yml
Fix inactivity Ãe2e tests.
2019-01-30 22:33:14 +00:00
session:
feat(session): multiple session cookie domains (#3754) This adds support to configure multiple session cookie domains. Closes #1198 Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2023-01-12 10:57:44 +00:00
expiration: 3600
inactivity: 300
remember_me: 1y
feat(server): customizable authz endpoints (#4296) This allows users to customize the authz endpoints. Closes #2753, Fixes #3716 Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2023-01-25 09:36:40 +00:00
cookies:
- domain: 'example.com'
authelia_url: 'https://login.example.com:8080'
Implement gRPC endpoint for envoy
2023-06-23 19:19:56 +00:00
- domain: 'rpjosh.de'
authelia_url: 'https://ubuntugui.rpjosh.de:9091'
Fix inactivity Ãe2e tests.
2019-01-30 22:33:14 +00:00
storage:
feat(storage): encrypted secret values (#2588) This adds an AES-GCM 256bit encryption layer for storage for sensitive items. This is only TOTP secrets for the time being but this may be expanded later. This will require a configuration change as per https://www.authelia.com/docs/configuration/migration.html#4330. Closes #682
2021-11-25 01:56:58 +00:00
encryption_key: a_not_so_secure_encryption_key
Fix inactivity Ãe2e tests.
2019-01-30 22:33:14 +00:00
local:
Build docker image upfront in CI and use it in integration tests. (#555) * Build docker image upfront in CI and use it in integration tests. Previously, the development workflow was broken because the container generated from Dockerfile.CI was used in dev environments but the binary was not pre-built as it is on buildkite. I propose to just remove that image and use the "to be published" image instead in integration tests. This will have several advantages: - Fix the dev workflow. - Remove CI arch from authelia-scripts build command - Optimize CI time in buildkite since we'll cache a way small artifact - We don't build authelia more than once for earch arch. * Fix suites and only build ARM images on master or tagged commits * Optimise pipeline dependencies and Kubernetes suite to utilise cache * Run unit tests and docker image build in parallel. * Fix suite trying to write on read only fs. Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2020-01-17 19:46:51 +00:00
path: /tmp/db.sqlite3
Fix inactivity Ãe2e tests.
2019-01-30 22:33:14 +00:00
totp:
issuer: example.com
access_control:
default_policy: deny
rules:
[BREAKING] Create a suite for kubernetes tests. Authelia client uses hash router instead of browser router in order to work with Kubernetes nginx-ingress-controller. This is also better for users having old browsers. This commit is breaking because it requires to change the configuration of the proxy to include the # in the URL of the login portal.
2019-03-03 22:51:52 +00:00
- domain: singlefactor.example.com
Fix inactivity Ãe2e tests.
2019-01-30 22:33:14 +00:00
policy: one_factor
Fix the bypass strategy. Before this fix an anonymous user was not able to access a resource that were configured with a bypass policy. This was due to a useless check of the userid in the auth session. Moreover, in the case of an anonymous user, we should not check the inactivity period since there is no session. Also refactor /verify endpoint for better testability and add tests in a new suite.
2019-03-22 15:54:27 +00:00
- domain: public.example.com
policy: bypass
perf(authorizer): preload access control lists (#1640) * adjust session refresh to always occur (for disabled users) * feat: adds filtering option for Request Method in ACL's * simplify flow of internal/authorization/authorizer.go's methods * implement query string checking * utilize authorizer.Object fully * make matchers uniform * add tests * add missing request methods * add frontend enhancements to handle request method * add request method to 1FA Handler Suite * add internal ACL representations (preparsing) * expand on access_control next * add docs * remove unnecessary slice for network names and instead just use a plain string * add warning for ineffectual bypass policy (due to subjects) * add user/group wildcard support * fix(authorization): allow subject rules to match anonymous users * feat(api): add new params * docs(api): wording adjustments * test: add request method into testing and proxy docs * test: add several checks and refactor schema validation for ACL * test: add integration test for methods acl * refactor: apply suggestions from code review * docs(authorization): update description
2021-03-05 04:18:31 +00:00
- domain: secure.example.com
policy: bypass
methods:
- OPTIONS
Display only one 2FA option. Displaying only one option at 2FA stage will allow to add more options like DUO push or OAuth. The user can switch to other option and in this case the option is remembered so that next time, the user will see the same option. The latest option is considered as the prefered option by Authelia.
2019-03-23 14:44:46 +00:00
- domain: secure.example.com
policy: two_factor
Rewrite and fix remaining suites in Go.
2019-11-24 20:27:59 +00:00
- domain: "*.example.com"
Fix inactivity Ãe2e tests.
2019-01-30 22:33:14 +00:00
subject: "group:admins"
policy: two_factor
- domain: dev.example.com
resources:
Rewrite and fix remaining suites in Go.
2019-11-24 20:27:59 +00:00
- "^/users/john/.*$"
Fix inactivity Ãe2e tests.
2019-01-30 22:33:14 +00:00
subject: "user:john"
policy: two_factor
- domain: dev.example.com
resources:
Rewrite and fix remaining suites in Go.
2019-11-24 20:27:59 +00:00
- "^/users/harry/.*$"
Fix inactivity Ãe2e tests.
2019-01-30 22:33:14 +00:00
subject: "user:harry"
policy: two_factor
Rewrite and fix remaining suites in Go.
2019-11-24 20:27:59 +00:00
- domain: "*.mail.example.com"
Fix inactivity Ãe2e tests.
2019-01-30 22:33:14 +00:00
subject: "user:bob"
policy: two_factor
- domain: dev.example.com
resources:
Rewrite and fix remaining suites in Go.
2019-11-24 20:27:59 +00:00
- "^/users/bob/.*$"
Fix inactivity Ãe2e tests.
2019-01-30 22:33:14 +00:00
subject: "user:bob"
policy: two_factor
Implement gRPC endpoint for envoy
2023-06-23 19:19:56 +00:00
- domain: auth.rpjosh.de
policy: bypass
- domain: datenbank.rpjosh.de
resources:
- "^/$"
policy: bypass
- domain: datenbank.rpjosh.de
resources:
- "^/hi.*$"
policy: one_factor
feat(session): multiple session cookie domains (#3754) This adds support to configure multiple session cookie domains. Closes #1198 Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2023-01-12 10:57:44 +00:00
Rewrite and fix remaining suites in Go.
2019-11-24 20:27:59 +00:00
regulation:
Fix inactivity Ãe2e tests.
2019-01-30 22:33:14 +00:00
# Set it to 0 to disable max_retries.
max_retries: 3
Misc Spelling Corrections - Mostly changes to spelling of comments/docs/displayed text - A few changes to test function names
2020-01-21 00:10:00 +00:00
# The user is banned if the authentication failed `max_retries` times in a `find_time` seconds window.
Create a specific suite for short timeouts to let humans use simple suite.
2019-03-02 21:27:54 +00:00
find_time: 300
Fix inactivity Ãe2e tests.
2019-01-30 22:33:14 +00:00
# The length of time before a banned user can login again.
Create a specific suite for short timeouts to let humans use simple suite.
2019-03-02 21:27:54 +00:00
ban_time: 900
Fix inactivity Ãe2e tests.
2019-01-30 22:33:14 +00:00
notifier:
smtp:
feat(authentication): suport ldap over unix socket (#5397) This adds support for LDAP unix sockets using the ldapi scheme. In addition it improves all of the address related parsing significantly deprecating old options. Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-05-07 06:39:17 +00:00
address: 'smtp://smtp:1025'
Fix inactivity Ãe2e tests.
2019-01-30 22:33:14 +00:00
sender: admin@example.com
ci: add yamllint (#1895) This change implements yamllint and adjusts all yaml files to abide by our linting setup. This excludes config.template.yml as this will be done in an alternate commit.
2021-04-10 20:51:00 +00:00
disable_require_tls: true
feat(ntp): check clock sync on startup (#2251) This adds method to validate the system clock is synchronized on startup. Configuration allows adjusting the server address, enabled state, desync limit, and if the error is fatal. Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2021-09-17 04:44:35 +00:00
ntp:
## NTP server address
address: "time.cloudflare.com:123"
## ntp version
version: 4
## "maximum desynchronization" is the allowed offset time between the host and the ntp server
max_desync: 3s
## You can enable or disable the NTP synchronization check on startup
disable_startup_check: false
feat(authentication): password policy (#2723) Implement a password policy with visual feedback in the web portal. Co-authored-by: Manuel Nuñez <@mind-ar> Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-04-02 22:32:57 +00:00
password_policy:
standard:
# Enables standard password Policy
refactor: misc password policy refactoring (#3102) Add tests and makes the password policy a provider so the configuration can be loaded to memory on startup.
2022-04-03 00:48:26 +00:00
enabled: false
feat(authentication): password policy (#2723) Implement a password policy with visual feedback in the web portal. Co-authored-by: Manuel Nuñez <@mind-ar> Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-04-02 22:32:57 +00:00
min_length: 8
max_length: 0
require_uppercase: true
require_lowercase: true
require_number: true
require_special: true
zxcvbn:
## zxcvbn: uses zxcvbn for password strength checking (see: https://github.com/dropbox/zxcvbn)
## Note that the zxcvbn option does not prohibit the user from using a weak password,
## it only offers feedback about the strength of the password they are entering.
## if you need to enforce password rules, you should use `mode=classic`
enabled: false
ci: add yamllint (#1895) This change implements yamllint and adjusts all yaml files to abide by our linting setup. This excludes config.template.yml as this will be done in an alternate commit.
2021-04-10 20:51:00 +00:00
...