feat(authentication): suport ldap over unix socket (#5397)

This adds support for LDAP unix sockets using the ldapi scheme. In addition it improves all of the address related parsing significantly deprecating old options.

Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>

.github/FUNDING.yml

@@ -3,7 +3,7 @@
 
 # github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
 # patreon: # Replace with a single Patreon username
-open_collective: authelia-sponsors
+open_collective: 'authelia-sponsors'
 # ko_fi: # Replace with a single Ko-fi username
 # tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
 # community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry

.github/ISSUE_TEMPLATE/config.yml

@@ -1,22 +1,22 @@
 ---
 blank_issues_enabled: false
 contact_links:
-  - name: Idea
+  - name: 'Idea'
-    url: https://github.com/authelia/authelia/discussions/new?category=ideas
+    url: 'https://github.com/authelia/authelia/discussions/new?category=ideas'
-    about: Submit an Idea for Voting
+    about: 'Submit an Idea for Voting'
-  - name: Question
+  - name: 'Question'
-    url: https://github.com/authelia/authelia/discussions/new?category=q-a
+    url: 'https://github.com/authelia/authelia/discussions/new?category=q-a'
-    about: Ask a Question
+    about: 'Ask a Question'
-  - name: Discussion
+  - name: 'Discussion'
-    url: https://github.com/authelia/authelia/discussions/new
+    url: 'https://github.com/authelia/authelia/discussions/new'
-    about: Start a Discussion related to Ideas, Polls, Show and Tell, or General Topics
+    about: 'Start a Discussion related to Ideas, Polls, Show and Tell, or General Topics'
-  - name: Documentation
+  - name: 'Documentation'
-    url: https://www.authelia.com/
+    url: 'https://www.authelia.com/'
-    about: Read the Documentation
+    about: 'Read the Documentation'
-  - name: Matrix
+  - name: 'Matrix'
-    url: https://matrix.to/#/#community:authelia.com
+    url: 'https://matrix.to/#/#community:authelia.com'
-    about: Discuss Authelia with the Developers on Matrix which is the preferred method of contact
+    about: 'Discuss Authelia with the Developers on Matrix which is the preferred method of contact'
-  - name: Discord
+  - name: 'Discord'
-    url: https://discord.authelia.com
+    url: 'https://discord.authelia.com'
-    about: Discuss Authelia with the Developers on Discord which is bridged to Matrix
+    about: 'Discuss Authelia with the Developers on Discord which is bridged to Matrix'
 ...

.github/ISSUE_TEMPLATE/feature-request.yml

@@ -1,12 +1,12 @@
 ---
-name: Feature Request
+name: 'Feature Request'
-description: Submit a Feature Request
+description: 'Submit a Feature Request'
 labels:
-  - type/feature
+  - 'type/feature'
-  - status/needs-design
+  - 'status/needs-design'
-  - priority/4/normal
+  - 'priority/4/normal'
 body:
-  - type: markdown
+  - type: 'markdown'
     attributes:
       value: |
         Thanks for taking the time to fill out this feature request. A feature request is created as issue for the purpose of tracking the design and implementation of a feature.
@@ -16,42 +16,54 @@ body:
         1. Ensure there are no other similar feature requests.
         2. Make sure you've checked the [Documentation](https://www.authelia.com) doesn't clearly document the features existence already.
         3. Consider creating an [Idea Discussion](https://github.com/authelia/authelia/discussions/new?category=ideas) which can be voted on instead if one doesn't exist.
-  - type: textarea
+  - type: 'textarea'
-    id: description
+    id: 'description'
     attributes:
-      label: Description
+      label: |
-      description: Describe the feature
+      	Description
+      description: |
+      	Describe the feature
     validations:
       required: true
-  - type: textarea
+  - type: 'textarea'
-    id: use-case
+    id: 'use-case'
     attributes:
-      label: Use Case
+      label: |
-      description: Provide a use case
+      	Use Case
+      description: |
+      	Provide a use case
     validations:
       required: true
-  - type: textarea
+  - type: 'textarea'
-    id: details
+    id: 'details'
     attributes:
-      label: Details
+      label: |
-      description: Describe the feature in detail
+      	Details
+      description: |
+      	Describe the feature in detail
     validations:
       required: false
-  - type: textarea
+  - type: 'textarea'
-    id: documentation
+    id: 'documentation'
     attributes:
-      label: Documentation
+      label: |
-      description: Provide any relevant specification or other documentation if applicable
+      	Documentation
+      description: |
+      	Provide any relevant specification or other documentation if applicable
     validations:
       required: false
-  - type: checkboxes
+  - type: 'checkboxes'
-    id: checklist
+    id: 'checklist'
     attributes:
-      label: Pre-Submission Checklist
+      label: |
-      description: By submitting this issue confirm all of the following
+      	Pre-Submission Checklist
+      description: |
+      	By submitting this issue confirm all of the following
       options:
-        - label: I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
+        - label: |
+        	I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
           required: true
-        - label: I have checked for related issues and checked the documentation
+        - label: |
+        	I have checked for related issues and checked the documentation
           required: true
 ...

.yamllint.yml

@@ -11,6 +11,7 @@ yaml-files:
 ignore: |
   api/openapi.yml
   docs/pnpm-lock.yaml
+  docs/node_modules/
   internal/configuration/test_resources/config_bad_quoting.yml
   web/pnpm-lock.yaml
   web/node_modules/

cmd/authelia-gen/templates/github_issue_template_bug_report.yml.tmpl

@@ -1,12 +1,12 @@
 ---
-name: Bug Report
+name: 'Bug Report'
-description: Report a bug
+description: 'Report a bug'
 labels:
 {{- range .Labels }}
-  - {{ . }}
+  - '{{ . }}'
 {{- end }}
 body:
-  - type: markdown
+  - type: 'markdown'
     attributes:
       value: |
         Thanks for taking the time to fill out this bug report. If you are unsure if this is actually a bug and you still need some form of support we generally recommend creating a [Question and Answer Discussion](https://github.com/authelia/authelia/discussions/new?category=q-a) first.
@@ -25,122 +25,152 @@ body:
             - Do not truncate any logs unless you are complying with the specific instructions in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section.
             - If you plan on sanitizing, removing, or adjusting any values for the logs or configuration files please read the [Sanitization](https://www.authelia.com/r/troubleshooting#sanitization) section.
         7. Please consider including a [HTTP Archive File](https://www.authelia.com/r/har) if you're having redirection issues.
-  - type: dropdown
+  - type: 'dropdown'
-    id: version
+    id: 'version'
     attributes:
-      label: Version
+      label: |
-      description: What version(s) of Authelia can you reproduce this bug on?
+      	Version
+      description: |
+      	What version(s) of Authelia can you reproduce this bug on?
       multiple: true
       options:
       {{- range .Versions }}
-        - {{ . }}
+        - '{{ . }}'
 	  {{- end }}
     validations:
       required: true
-  - type: dropdown
+  - type: 'dropdown'
-    id: deployment
+    id: 'deployment'
     attributes:
-      label: Deployment Method
+      label: |
-      description: How are you deploying Authelia?
+      	Deployment Method
+      description: |
+      	How are you deploying Authelia?
       options:
-        - Docker
+        - 'Docker'
-        - Kubernetes
+        - 'Kubernetes'
-        - Bare-metal
+        - 'Bare-metal'
-        - Other
+        - 'Other'
     validations:
       required: true
-  - type: dropdown
+  - type: 'dropdown'
-    id: proxy
+    id: 'proxy'
     attributes:
-      label: Reverse Proxy
+      label: |
-      description: What reverse proxy are you using?
+      	Reverse Proxy
+      description: |
+      	What reverse proxy are you using?
       options:
       {{- range .Proxies }}
-        - {{ . }}
+        - '{{ . }}'
 	  {{- end }}
     validations:
       required: true
-  - type: input
+  - type: 'input'
-    id: proxy-version
+    id: 'proxy-version'
     attributes:
-      label: Reverse Proxy Version
+      label: |
-      description: What is the version of your reverse proxy?
+      	Reverse Proxy Version
-      placeholder: x.x.x
+      description: |
+      	What is the version of your reverse proxy?
+      placeholder: 'x.x.x'
     validations:
       required: false
-  - type: textarea
+  - type: 'textarea'
-    id: description
+    id: 'description'
     attributes:
-      label: Description
+      label: |
-      description: Describe the bug.
+      	Description
+      description: |
+      	Describe the bug.
     validations:
       required: true
-  - type: textarea
+  - type: 'textarea'
-    id: reproduction
+    id: 'reproduction'
     attributes:
-      label: Reproduction
+      label: |
-      description: Describe how we can reproduce this issue. This should be step by step and should include detailed and specific information. Abstract or generic information should be avoided. For example this should include specific application names and versions if relevant. Reproducing the issue is important so we can verify it exists, add relevant tests, and verify it is solved.
+      	Reproduction
+      description: |
+      	Describe how we can reproduce this issue. This should be step by step and should include detailed and specific information. Abstract or generic information should be avoided. For example this should include specific application names and versions if relevant. Reproducing the issue is important so we can verify it exists, add relevant tests, and verify it is solved.
     validations:
       required: true
-  - type: textarea
+  - type: 'textarea'
-    id: expectations
+    id: 'expectations'
     attributes:
-      label: Expectations
+      label: |
-      description: Describe the desired or expected results.
+      	Expectations
+      description: |
+      	Describe the desired or expected results.
     validations:
       required: false
-  - type: textarea
+  - type: 'textarea'
-    id: configuration
+    id: 'configuration'
     attributes:
-      label: Configuration (Authelia)
+      label: |
-      description: Provide a complete configuration file (the template will automatically put this content in a code block).
+      	Configuration (Authelia)
-      render: yaml
+      description: |
+      	Provide a complete configuration file (the template will automatically put this content in a code block).
+      render: 'yaml'
     validations:
       required: false
-  - type: textarea
+  - type: 'textarea'
-    id: logs
+    id: 'logs'
     attributes:
-      label: Logs (Authelia)
+      label: |
+      	Logs (Authelia)
       description: |
         Provide complete logs with the log level set to debug or trace. Complete means from application start until the issue occurring. This is clearly explained in the [Logs](https://www.authelia.com/r/troubleshooting#logs) section of the troubleshooting guide.
 
         The template will automatically put this content in a code block so you can just paste it.
-      render: shell
+      render: 'shell'
     validations:
       required: true
-  - type: textarea
+  - type: 'textarea'
-    id: logs-other
+    id: 'logs-other'
     attributes:
-      label: Logs (Proxy / Application)
+      label: |
-      description: Provide complete debug logs for the affected proxy and/or application if available and relevant (the template will automatically put this content in a code block).
+      	Logs (Proxy / Application)
-      render: shell
+      description: |
+      	Provide complete debug logs for the affected proxy and/or application if available and relevant (the template will automatically put this content in a code block).
+      render: 'shell'
     validations:
       required: false
-  - type: textarea
+  - type: 'textarea'
-    id: documentation
+    id: 'documentation'
     attributes:
-      label: Documentation
+      label: |
-      description: Provide any relevant specification or other documentation if applicable.
+      	Documentation
+      description: |
+      	Provide any relevant specification or other documentation if applicable.
     validations:
       required: false
-  - type: checkboxes
+  - type: 'checkboxes'
-    id: checklist
+    id: 'checklist'
     attributes:
-      label: Pre-Submission Checklist
+      label: |
-      description: By submitting this issue confirm all of the following.
+      	Pre-Submission Checklist
+      description: |
+      	By submitting this issue confirm all of the following.
       options:
-        - label: I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
+        - label: |
+        	I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
           required: true
-        - label: This is a bug report and not a support request
+        - label: |
+        	This is a bug report and not a support request
           required: true
-        - label: I have read the security policy and this bug report is not a security issue or security related issue
+        - label: |
+        	I have read the security policy and this bug report is not a security issue or security related issue
           required: true
-        - label: I have either included the complete configuration file or I am sure it's unrelated to the configuration
+        - label: |
+        	I have either included the complete configuration file or I am sure it's unrelated to the configuration
           required: true
-        - label: I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide
+        - label: |
+        	I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the [Troubleshooting Sanitization](https://www.authelia.com/r/sanitize) reference guide
           required: true
-        - label: I have checked for related proxy or application logs and included them if available
+        - label: |
+        	I have checked for related proxy or application logs and included them if available
           required: true
-        - label: I have checked for related issues and checked the documentation
+        - label: |
+        	I have checked for related issues and checked the documentation
           required: true
 ...

cmd/authelia-gen/templates/github_issue_template_feature.yml.tmpl

@@ -1,12 +1,12 @@
 ---
-name: Feature Request
+name: 'Feature Request'
-description: Submit a Feature Request
+description: 'Submit a Feature Request'
 labels:
 {{- range .Labels }}
-  - {{ . }}
+  - '{{ . }}'
 {{- end }}
 body:
-  - type: markdown
+  - type: 'markdown'
     attributes:
       value: |
         Thanks for taking the time to fill out this feature request. A feature request is created as issue for the purpose of tracking the design and implementation of a feature.
@@ -16,42 +16,54 @@ body:
         1. Ensure there are no other similar feature requests.
         2. Make sure you've checked the [Documentation](https://www.authelia.com) doesn't clearly document the features existence already.
         3. Consider creating an [Idea Discussion](https://github.com/authelia/authelia/discussions/new?category=ideas) which can be voted on instead if one doesn't exist.
-  - type: textarea
+  - type: 'textarea'
-    id: description
+    id: 'description'
     attributes:
-      label: Description
+      label: |
-      description: Describe the feature
+      	Description
+      description: |
+      	Describe the feature
     validations:
       required: true
-  - type: textarea
+  - type: 'textarea'
-    id: use-case
+    id: 'use-case'
     attributes:
-      label: Use Case
+      label: |
-      description: Provide a use case
+      	Use Case
+      description: |
+      	Provide a use case
     validations:
       required: true
-  - type: textarea
+  - type: 'textarea'
-    id: details
+    id: 'details'
     attributes:
-      label: Details
+      label: |
-      description: Describe the feature in detail
+      	Details
+      description: |
+      	Describe the feature in detail
     validations:
       required: false
-  - type: textarea
+  - type: 'textarea'
-    id: documentation
+    id: 'documentation'
     attributes:
-      label: Documentation
+      label: |
-      description: Provide any relevant specification or other documentation if applicable
+      	Documentation
+      description: |
+      	Provide any relevant specification or other documentation if applicable
     validations:
       required: false
-  - type: checkboxes
+  - type: 'checkboxes'
-    id: checklist
+    id: 'checklist'
     attributes:
-      label: Pre-Submission Checklist
+      label: |
-      description: By submitting this issue confirm all of the following
+      	Pre-Submission Checklist
+      description: |
+      	By submitting this issue confirm all of the following
       options:
-        - label: I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
+        - label: |
+        	I agree to follow the [Code of Conduct](http://www.authelia.com/code-of-conduct)
           required: true
-        - label: I have checked for related issues and checked the documentation
+        - label: |
+        	I have checked for related issues and checked the documentation
           required: true
 ...

config.template.yml

@@ -9,14 +9,14 @@
 ## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to
 ## the system certificates store.
 ## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem.
-# certificates_directory: /config/certificates/
+# certificates_directory: '/config/certificates/'
 
 ## The theme to display: light, dark, grey, auto.
-theme: light
+theme: 'light'
 
 ## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be
 ## set using a secret: https://www.authelia.com/c/secrets
-jwt_secret: a_very_important_secret
+jwt_secret: 'a_very_important_secret'
 
 ## Default redirection URL
 ##
@@ -25,28 +25,32 @@ jwt_secret: a_very_important_secret
 ## in such a case.
 ##
 ## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
-default_redirection_url: https://home.example.com/
+default_redirection_url: 'https://home.example.com/'
 
 ## Set the default 2FA method for new users and for when a user has a preferred method configured that has been
 ## disabled. This setting must be a method that is enabled.
 ## Options are totp, webauthn, mobile_push.
-default_2fa_method: ""
+default_2fa_method: ''
 
 ##
 ## Server Configuration
 ##
 server:
-
+  ## The address for the Main server to listen on in the address common syntax.
-  ## The address to listen on. This must be a TCP or unix socket.
+  ## Formats:
-  address: "tcp://:9091"
+  ##  - [<scheme>://]<hostname>[:<port>]
+  ##  - [<scheme>://][hostname]:<port>
+  ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix'.
+  ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '9091'.
+  address: 'tcp://:9091'
 
   ## Set the single level path Authelia listens on.
   ## Must be alphanumeric chars and should not contain any slashes.
-  path: ""
+  path: ''
 
   ## Set the path on disk to Authelia assets.
   ## Useful to allow overriding of specific static assets.
-  # asset_path: /config/assets/
+  # asset_path: '/config/assets/'
 
   ## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0.
   ## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist.
@@ -55,10 +59,10 @@ server:
   ## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour.
   tls:
     ## The path to the DER base64/PEM format private key.
-    key: ""
+    key: ''
 
     ## The path to the DER base64/PEM format public certificate.
-    certificate: ""
+    certificate: ''
 
     ## The list of certificates for client authentication.
     client_certificates: []
@@ -67,7 +71,7 @@ server:
   headers:
 
     ## The CSP Template. Read the docs.
-    csp_template: ""
+    csp_template: ''
 
   ## Server Buffers configuration.
   # buffers:
@@ -87,13 +91,13 @@ server:
   # timeouts:
 
     ## Read timeout.
-    # read: 6s
+    # read: '6s'
 
     ## Write timeout.
-    # write: 6s
+    # write: '6s'
 
     ## Idle timeout.
-    # idle: 30s
+    # idle: '30s'
 
   ## Server Endpoints configuration.
   ## This section is considered advanced and it SHOULD NOT be configured unless you've read the relevant documentation.
@@ -107,16 +111,16 @@ server:
     ## Configure the authz endpoints.
     # authz:
       # forward-auth:
-        # implementation: ForwardAuth
+        # implementation: 'ForwardAuth'
         # authn_strategies: []
       # ext-authz:
-        # implementation: ExtAuthz
+        # implementation: 'ExtAuthz'
         # authn_strategies: []
       # auth-request:
-        # implementation: AuthRequest
+        # implementation: 'AuthRequest'
         # authn_strategies: []
       # legacy:
-        # implementation: Legacy
+        # implementation: 'Legacy'
         # authn_strategies: []
 
 ##
@@ -124,13 +128,13 @@ server:
 ##
 log:
   ## Level of verbosity for logs: info, debug, trace.
-  level: debug
+  level: 'debug'
 
   ## Format the logs are written as: json, text.
-  # format: json
+  # format: 'json'
 
   ## File path where the logs will be written. If not set logs are written to stdout.
-  # file_path: /config/authelia.log
+  # file_path: '/config/authelia.log'
 
   ## Whether to also log to stdout when a log_file_path is defined.
   # keep_stdout: false
@@ -147,8 +151,13 @@ telemetry:
     ## Enable Metrics.
     enabled: false
 
-    ## The address to listen on for metrics. This should be on a different port to the main server.port value.
+    ## The address for the Metrics server to listen on in the address common syntax.
-    address: tcp://0.0.0.0:9959
+    ## Formats:
+    ##  - [<scheme>://]<hostname>[:<port>]
+    ##  - [<scheme>://][hostname]:<port>
+    ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix'.
+    ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '9959'.
+    address: 'tcp://:9959'
 
     ## Metrics Server Buffers configuration.
     # buffers:
@@ -163,13 +172,13 @@ telemetry:
     # timeouts:
 
       ## Read timeout.
-      # read: 6s
+      # read: '6s'
 
       ## Write timeout.
-      # write: 6s
+      # write: '6s'
 
       ## Idle timeout.
-      # idle: 30s
+      # idle: '30s'
 
 ##
 ## TOTP Configuration
@@ -180,12 +189,12 @@ totp:
   disable: false
 
   ## The issuer name displayed in the Authenticator application of your choice.
-  issuer: authelia.com
+  issuer: 'authelia.com'
 
   ## The TOTP algorithm to use.
   ## It is CRITICAL you read the documentation before changing this option:
   ## https://www.authelia.com/c/totp#algorithm
-  algorithm: sha1
+  algorithm: 'sha1'
 
   ## The number of digits a user has to input. Must either be 6 or 8.
   ## Changing this option only affects newly generated TOTP configurations.
@@ -215,18 +224,18 @@ webauthn:
   disable: false
 
   ## Adjust the interaction timeout for WebAuthn dialogues.
-  timeout: 60s
+  timeout: '60s'
 
   ## The display name the browser should show the user for when using WebAuthn to login/register.
-  display_name: Authelia
+  display_name: 'Authelia'
 
   ## Conveyance preference controls if we collect the attestation statement including the AAGUID from the device.
   ## Options are none, indirect, direct.
-  attestation_conveyance_preference: indirect
+  attestation_conveyance_preference: 'indirect'
 
   ## User verification controls if the user must make a gesture or action to confirm they are present.
   ## Options are required, preferred, discouraged.
-  user_verification: preferred
+  user_verification: 'preferred'
 
 ##
 ## Duo Push API Configuration
@@ -235,10 +244,10 @@ webauthn:
 ## "Partner Auth API" in the management panel.
 # duo_api:
   # disable: false
-  # hostname: api-123456789.example.com
+  # hostname: 'api-123456789.example.com'
-  # integration_key: ABCDEF
+  # integration_key: 'ABCDEF'
   ## Secret can also be set using a secret: https://www.authelia.com/c/secrets
-  # secret_key: 1234567890abcdefghifjkl
+  # secret_key: '1234567890abcdefghifjkl'
   # enable_self_enrollment: false
 
 ##
@@ -246,14 +255,17 @@ webauthn:
 ##
 ## This is used to validate the servers time is accurate enough to validate TOTP.
 ntp:
-  ## NTP server address.
+  ## The address of the NTP server to connect to in the address common syntax.
-  address: "time.cloudflare.com:123"
+  ## Format: [<scheme>://]<hostname>[:<port>].
+  ## Square brackets indicate optional portions of the format. Scheme must be 'udp', 'udp4', or 'udp6'.
+  ## The default scheme is 'udp'. The default port is '123'.
+  address: 'udp://time.cloudflare.com:123'
 
   ## NTP version.
   version: 4
 
-  ## Maximum allowed time offset between the host and the NTP server.
+  ## Maximum allowed time offset between the host and the NTP server in duration common syntax.
-  max_desync: 3s
+  max_desync: '3s'
 
   ## Disables the NTP check on startup entirely. This means Authelia will not contact a remote service at all if you
   ## set this to true, and can operate in a truly offline mode.
@@ -279,14 +291,14 @@ authentication_backend:
 
     ## External reset password url that redirects the user to an external reset portal. This disables the internal reset
     ## functionality.
-    custom_url: ""
+    custom_url: ''
 
   ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation.
   ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
   ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
   ## To force update on every request you can set this to '0' or 'always', this will increase processor demand.
   ## See the below documentation for more information.
-  ## Duration Notation docs:  https://www.authelia.com/c/common#duration-notation-format
+  ## Duration Notation docs:  https://www.authelia.com/c/common#duration
   ## Refresh Interval docs: https://www.authelia.com/c/1fa#refresh-interval
   refresh_interval: 5m
 
@@ -297,6 +309,13 @@ authentication_backend:
   ## because it allows Authelia to offload the stateful operations
   ## onto the LDAP service.
   # ldap:
+    ## The address of the LDAP server to connect to in the address common syntax.
+    ## Format: [<scheme>://]<hostname>[:<port>].
+    ## Square brackets indicate optional portions of the format. Scheme must be 'ldap', 'ldaps', or 'ldapi`.
+    ## The default scheme is 'ldapi' if the address is an absolute path otherwise it's 'ldaps'.
+    ## The default port is '636', unless the scheme is 'ldap' in which case it's '389'.
+    # address: 'ldaps://127.0.0.1:636'
+
     ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
     ## Acceptable options are as follows:
     ## - 'activedirectory' - for Microsoft Active Directory.
@@ -308,22 +327,18 @@ authentication_backend:
     ## Depending on the option here certain other values in this section have a default value, notably all of the
     ## attribute mappings have a default value that this config overrides, you can read more about these default values
     ## at https://www.authelia.com/c/ldap#defaults
-    # implementation: custom
+    # implementation: 'custom'
 
-    ## The url to the ldap server. Format: <scheme>://<address>[:<port>].
+    ## The dial timeout for LDAP in the duration common syntax.
-    ## Scheme can be ldap or ldaps in the format (port optional).
+    # timeout: '5s'
-    # url: ldap://127.0.0.1
-
-    ## The dial timeout for LDAP.
-    # timeout: 5s
 
     ## Use StartTLS with the LDAP connection.
     # start_tls: false
 
     # tls:
       ## The server subject name to check the servers certificate against during the validation process.
-      ## This option is not required if the certificate has a SAN which matches the host portion of the url option.
+      ## This option is not required if the certificate has a SAN which matches the address options hostname.
-      # server_name: ldap.example.com
+      # server_name: 'ldap.example.com'
 
       ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
       ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
@@ -334,10 +349,10 @@ authentication_backend:
       # skip_verify: false
 
       ## Minimum TLS version for the connection.
-      # minimum_version: TLS1.2
+      # minimum_version: 'TLS1.2'
 
       ## Maximum TLS version for the connection.
-      # maximum_version: TLS1.3
+      # maximum_version: 'TLS1.3'
 
       ## The certificate chain used with the private_key if the server requests TLS Client Authentication
       ## i.e. Mutual TLS.
@@ -414,7 +429,7 @@ authentication_backend:
 
     ## The distinguished name of the container searched for objects in the directory information tree.
     ## See also: additional_users_dn, additional_groups_dn.
-    # base_dn: dc=example,dc=com
+    # base_dn: 'dc=example,dc=com'
 
     ## The attribute holding the username of the user. This attribute is used to populate the username in the session
     ## information. For your information, Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually
@@ -424,11 +439,11 @@ authentication_backend:
     ## non-unique attributes like 'mail' can also be used but we don't recommend using them, we instead advise to use
     ## a filter to perform alternative lookups and the attributes mentioned above (sAMAccountName and uid) to
     ## follow https://datatracker.ietf.org/doc/html/rfc2307.
-    # username_attribute: uid
+    # username_attribute: 'uid'
 
     ## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users.
     ## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users.
-    # additional_users_dn: ou=users
+    # additional_users_dn: 'ou=users'
 
     ## The users filter used in search queries to find the user profile based on input filled in login form.
     ## Various placeholders are available in the user filter which you can read about in the documentation which can
@@ -442,11 +457,11 @@ authentication_backend:
     ##
     ## To allow sign in both with username and email, one can use a filter like
     ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
-    # users_filter: (&({username_attribute}={input})(objectClass=person))
+    # users_filter: '(&({username_attribute}={input})(objectClass=person))'
 
     ## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups.
     ## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups.
-    # additional_groups_dn: ou=groups
+    # additional_groups_dn: 'ou=groups'
 
     ## The groups filter used in search queries to find the groups based on relevant authenticated user.
     ## Various placeholders are available in the groups filter which you can read about in the documentation which can
@@ -454,17 +469,17 @@ authentication_backend:
     ##
     ## If your groups use the `groupOfUniqueNames` structure use this instead:
     ##    (&(uniqueMember={dn})(objectClass=groupOfUniqueNames))
-    # groups_filter: (&(member={dn})(objectClass=groupOfNames))
+    # groups_filter: '(&(member={dn})(objectClass=groupOfNames))'
 
     ## The attribute holding the name of the group.
-    # group_name_attribute: cn
+    # group_name_attribute: 'cn'
 
     ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
     ## first one returned by the LDAP server is used.
-    # mail_attribute: mail
+    # mail_attribute: 'mail'
 
     ## The attribute holding the display name of the user. This will be used to greet an authenticated user.
-    # display_name_attribute: displayName
+    # display_name_attribute: 'displayName'
 
     ## Follow referrals returned by the server.
     ## This is especially useful for environments where read-only servers exist. Only implemented for write operations.
@@ -473,7 +488,7 @@ authentication_backend:
     ## The username and password of the admin user.
     # user: cn=admin,dc=example,dc=com
     ## Password can also be set using a secret: https://www.authelia.com/c/secrets
-    # password: password
+    # password: 'password'
 
   ##
   ## File (Authentication Provider)
@@ -488,15 +503,15 @@ authentication_backend:
   ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
   ##
   # file:
-    # path: /config/users_database.yml
+    # path: '/config/users_database.yml'
     # watch: false
     # search:
       # email: false
       # case_insensitive: false
     # password:
-      # algorithm: argon2
+      # algorithm: 'argon2'
       # argon2:
-        # variant: argon2id
+        # variant: 'argon2id'
         # iterations: 3
         # memory: 65536
         # parallelism: 4
@@ -509,15 +524,15 @@ authentication_backend:
         # key_length: 32
         # salt_length: 16
       # pbkdf2:
-        # variant: sha512
+        # variant: 'sha512'
         # iterations: 310000
         # salt_length: 16
       # sha2crypt:
-        # variant: sha512
+        # variant: 'sha512'
         # iterations: 50000
         # salt_length: 16
       # bcrypt:
-        # variant: standard
+        # variant: 'standard'
         # cost: 12
 
 ##
@@ -601,91 +616,91 @@ privacy_policy:
 access_control:
   ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
   ## resource if there is no policy to be applied to the user.
-  default_policy: deny
+  default_policy: 'deny'
 
   # networks:
-    # - name: internal
+    # - name: 'internal'
     #   networks:
-        # - 10.10.0.0/16
+        # - '10.10.0.0/16'
-        # - 192.168.2.0/24
+        # - '192.168.2.0/24'
     # - name: VPN
-    #   networks: 10.9.0.0/16
+    #   networks: '10.9.0.0/16'
 
   # rules:
     ## Rules applied to everyone
     # - domain: 'public.example.com'
-    #   policy: bypass
+    #   policy: 'bypass'
 
     ## Domain Regex examples. Generally we recommend just using a standard domain.
     # - domain_regex: '^(?P<User>\w+)\.example\.com$'
-    #   policy: one_factor
+    #   policy: 'one_factor'
     # - domain_regex: '^(?P<Group>\w+)\.example\.com$'
-    #   policy: one_factor
+    #   policy: 'one_factor'
     # - domain_regex:
       #  - '^appgroup-.*\.example\.com$'
       #  - '^appgroup2-.*\.example\.com$'
-    #   policy: one_factor
+    #   policy: 'one_factor'
     # - domain_regex: '^.*\.example\.com$'
-    #   policy: two_factor
+    #   policy: 'two_factor'
 
     # - domain: 'secure.example.com'
-    #   policy: one_factor
+    #   policy: 'one_factor'
     ## Network based rule, if not provided any network matches.
     #   networks:
-        # - internal
+        # - 'internal'
-        # - VPN
+        # - 'VPN'
-        # - 192.168.1.0/24
+        # - '192.168.1.0/24'
-        # - 10.0.0.1
+        # - '10.0.0.1'
 
     # - domain:
         # - 'secure.example.com'
         # - 'private.example.com'
-    #   policy: two_factor
+    #   policy: 'two_factor'
 
     # - domain: 'singlefactor.example.com'
-    #   policy: one_factor
+    #   policy: 'one_factor'
 
     ## Rules applied to 'admins' group
     # - domain: 'mx2.mail.example.com'
     #   subject: 'group:admins'
-    #   policy: deny
+    #   policy: 'deny'
 
     # - domain: '*.example.com'
     #   subject:
         # - 'group:admins'
         # - 'group:moderators'
-    #   policy: two_factor
+    #   policy: 'two_factor'
 
     ## Rules applied to 'dev' group
     # - domain: 'dev.example.com'
     #   resources:
         # - '^/groups/dev/.*$'
     #   subject: 'group:dev'
-    #   policy: two_factor
+    #   policy: 'two_factor'
 
     ## Rules applied to user 'john'
     # - domain: 'dev.example.com'
     #   resources:
         # - '^/users/john/.*$'
     #   subject: 'user:john'
-    #   policy: two_factor
+    #   policy: 'two_factor'
 
     ## Rules applied to user 'harry'
     # - domain: 'dev.example.com'
     #   resources:
         # - '^/users/harry/.*$'
     #   subject: 'user:harry'
-    #   policy: two_factor
+    #   policy: 'two_factor'
 
     ## Rules applied to user 'bob'
     # - domain: '*.mail.example.com'
     #   subject: 'user:bob'
-    #   policy: two_factor
+    #   policy: 'two_factor'
     # - domain: 'dev.example.com'
     #   resources:
     #     - '^/users/bob/.*$'
     #   subject: 'user:bob'
-    #   policy: two_factor
+    #   policy: 'two_factor'
 
 ##
 ## Session Provider Configuration
@@ -720,8 +735,8 @@ session:
       ## Please read https://www.authelia.com/c/session#same_site
       # same_site: 'lax'
 
-      ## The value for inactivity, expiration, and remember_me are in seconds or the duration notation format.
+      ## The value for inactivity, expiration, and remember_me are in seconds or the duration common syntax.
-      ## See: https://www.authelia.com/c/common#duration-notation-format
+      ## See: https://www.authelia.com/c/common#duration
       ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure
       ## because a stolen cookie will last longer giving attackers more time to spy or attack.
 
@@ -745,8 +760,8 @@ session:
   ## or strict. Please read https://www.authelia.com/c/session#same_site
   same_site: 'lax'
 
-  ## The value for inactivity, expiration, and remember_me are in seconds or the duration notation format.
+  ## The value for inactivity, expiration, and remember_me are in seconds or the duration common syntax.
-  ## See: https://www.authelia.com/c/common#duration-notation-format
+  ## See: https://www.authelia.com/c/common#duration
   ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure
   ## because a stolen cookie will last longer giving attackers more time to spy or attack.
 
@@ -770,16 +785,16 @@ session:
   ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
   ##
   # redis:
-    # host: 127.0.0.1
+    # host: '127.0.0.1'
     # port: 6379
     ## Use a unix socket instead
-    # host: /var/run/redis/redis.sock
+    # host: '/var/run/redis/redis.sock'
 
     ## Username used for redis authentication. This is optional and a new feature in redis 6.0.
-    # username: authelia
+    # username: 'authelia'
 
     ## Password can also be set using a secret: https://www.authelia.com/c/secrets
-    # password: authelia
+    # password: 'authelia'
 
     ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
     # database_index: 0
@@ -794,7 +809,7 @@ session:
     # tls:
       ## The server subject name to check the servers certificate against during the validation process.
       ## This option is not required if the certificate has a SAN which matches the host option.
-      # server_name: myredis.example.com
+      # server_name: 'myredis.example.com'
 
       ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
       ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
@@ -805,10 +820,10 @@ session:
       # skip_verify: false
 
       ## Minimum TLS version for the connection.
-      # minimum_version: TLS1.2
+      # minimum_version: 'TLS1.2'
 
       ## Maximum TLS version for the connection.
-      # maximum_version: TLS1.3
+      # maximum_version: 'TLS1.3'
 
       ## The certificate chain used with the private_key if the server requests TLS Client Authentication
       ## i.e. Mutual TLS.
@@ -887,21 +902,21 @@ session:
     ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
     # high_availability:
       ## Sentinel Name / Master Name.
-      # sentinel_name: mysentinel
+      # sentinel_name: 'mysentinel'
 
       ## Specific username for Redis Sentinel. The node username and password is configured above.
-      # sentinel_username: sentinel_specific_user
+      # sentinel_username: 'sentinel_specific_user'
 
       ## Specific password for Redis Sentinel. The node username and password is configured above.
-      # sentinel_password: sentinel_specific_pass
+      # sentinel_password: 'sentinel_specific_pass'
 
       ## The additional nodes to pre-seed the redis provider with (for sentinel).
       ## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
       ## For high availability to be used you must have either defined; the host above or at least one node below.
       # nodes:
-        # - host: sentinel-node1
+        # - host: 'sentinel-node1'
         #   port: 6379
-        # - host: sentinel-node2
+        # - host: 'sentinel-node2'
         #   port: 6379
 
       ## Choose the host with the lowest latency.
@@ -919,14 +934,12 @@ regulation:
   ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
   max_retries: 3
 
-  ## The time range during which the user can attempt login before being banned. The user is banned if the
+  ## The time range in duration common syntax during which the user can attempt login before being banned. The user is
-  ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.
+  ## banned if the authentication failed 'max_retries' times in a 'find_time' seconds window.
-  ## See: https://www.authelia.com/c/common#duration-notation-format
+  find_time: '2m'
-  find_time: 2m
 
-  ## The length of time before a banned user can login again. Ban Time accepts duration notation.
+  ## The length of time in duration common syntax before a banned user can login again.
-  ## See: https://www.authelia.com/c/common#duration-notation-format
+  ban_time: '5m'
-  ban_time: 5m
 
 ##
 ## Storage Provider Configuration
@@ -936,7 +949,7 @@ regulation:
   ## The encryption key that is used to encrypt sensitive information in the database. Must be a string with a minimum
   ## length of 20. Please see the docs if you configure this with an undesirable key and need to change it, you MUST use
   ## the CLI to change this in the database if you want to change it from a previously configured value.
-  # encryption_key: you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this
+  # encryption_key: 'you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this'
 
   ##
   ## Local (Storage Provider)
@@ -948,25 +961,36 @@ regulation:
   ##
   # local:
     ## Path to the SQLite3 Database.
-    # path: /config/db.sqlite3
+    # path: '/config/db.sqlite3'
 
   ##
   ## MySQL / MariaDB (Storage Provider)
   ##
   # mysql:
-    # host: 127.0.0.1
+    ## The address of the MySQL server to connect to in the address common syntax.
-    # port: 3306
+    ## Format: [<scheme>://]<hostname>[:<port>].
-    # database: authelia
+    ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix`.
-    # username: authelia
+    ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '3306'.
-    ## Password can also be set using a secret: https://www.authelia.com/c/secrets
+    # address: 'tcp://127.0.0.1:3306'
-    # password: mypassword
+
-    # timeout: 5s
+    ## The database name to use.
+    # database: 'authelia'
+
+    ## The username used for SQL authentication.
+    # username: 'authelia'
+
+    ## The password used for SQL authentication.
+    ## Can also be set using a secret: https://www.authelia.com/c/secrets
+    # password: 'mypassword'
+
+    ## The connection timeout in the duration common syntax.
+    # timeout: '5s'
 
     ## MySQL TLS settings. Configuring this requires TLS.
     # tls:
       ## The server subject name to check the servers certificate against during the validation process.
-      ## This option is not required if the certificate has a SAN which matches the host option.
+      ## This option is not required if the certificate has a SAN which matches the address options hostname.
-      # server_name: mysql.example.com
+      # server_name: 'mysql.example.com'
 
       ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
       ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
@@ -977,10 +1001,10 @@ regulation:
       # skip_verify: false
 
       ## Minimum TLS version for the connection.
-      # minimum_version: TLS1.2
+      # minimum_version: 'TLS1.2'
 
       ## Maximum TLS version for the connection.
-      # maximum_version: TLS1.3
+      # maximum_version: 'TLS1.3'
 
       ## The certificate chain used with the private_key if the server requests TLS Client Authentication
       ## i.e. Mutual TLS.
@@ -1059,20 +1083,33 @@ regulation:
   ## PostgreSQL (Storage Provider)
   ##
   # postgres:
-    # host: 127.0.0.1
+    ## The address of the PostgreSQL server to connect to in the address common syntax.
-    # port: 5432
+    ## Format: [<scheme>://]<hostname>[:<port>].
-    # database: authelia
+    ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix`.
-    # schema: public
+    ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '5432'.
-    # username: authelia
+    # address: 'tcp://127.0.0.1:5432'
-    ## Password can also be set using a secret: https://www.authelia.com/c/secrets
+
-    # password: mypassword
+    ## The database name to use.
-    # timeout: 5s
+    # database: 'authelia'
+
+    ## The schema name to use.
+    # schema: 'public'
+
+    ## The username used for SQL authentication.
+    # username: 'authelia'
+
+    ## The password used for SQL authentication.
+    ## Can also be set using a secret: https://www.authelia.com/c/secrets
+    # password: 'mypassword'
+
+    ## The connection timeout in the duration common syntax.
+    # timeout: '5s'
 
     ## PostgreSQL TLS settings. Configuring this requires TLS.
     # tls:
       ## The server subject name to check the servers certificate against during the validation process.
-      ## This option is not required if the certificate has a SAN which matches the host option.
+      ## This option is not required if the certificate has a SAN which matches the address options hostname.
-      # server_name: postgres.example.com
+      # server_name: 'postgres.example.com'
 
       ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
       ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
@@ -1083,10 +1120,10 @@ regulation:
       # skip_verify: false
 
       ## Minimum TLS version for the connection.
-      # minimum_version: TLS1.2
+      # minimum_version: 'TLS1.2'
 
       ## Maximum TLS version for the connection.
-      # maximum_version: TLS1.3
+      # maximum_version: 'TLS1.3'
 
       ## The certificate chain used with the private_key if the server requests TLS Client Authentication
       ## i.e. Mutual TLS.
@@ -1176,7 +1213,7 @@ notifier:
   ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
   ##
   # filesystem:
-    # filename: /config/notification.txt
+    # filename: '/config/notification.txt'
 
   ##
   ## SMTP (Notification Provider)
@@ -1189,36 +1226,33 @@ notifier:
   ##   - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates
   ##     (configure in tls section)
   # smtp:
-    ## The SMTP host to connect to.
+    ## The address of the SMTP server to connect to in the address common syntax.
-    # host: 127.0.0.1
+    # address: 'smtp://127.0.0.1:25'
 
-    ## The port to connect to the SMTP host on.
+    ## The connection timeout in the duration common syntax.
-    # port: 1025
+    # timeout: '5s'
-
-    ## The connection timeout.
-    # timeout: 5s
 
     ## The username used for SMTP authentication.
-    # username: test
+    # username: 'test'
 
     ## The password used for SMTP authentication.
     ## Can also be set using a secret: https://www.authelia.com/c/secrets
-    # password: password
+    # password: 'password'
 
     ## The sender is used to is used for the MAIL FROM command and the FROM header.
     ## If this is not defined and the username is an email, we use the username as this value. This can either be just
     ## an email address or the RFC5322 'Name <email address>' format.
-    # sender: "Authelia <admin@example.com>"
+    # sender: 'Authelia <admin@example.com>'
 
     ## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost.
-    # identifier: localhost
+    # identifier: 'localhost'
 
     ## Subject configuration of the emails sent. {title} is replaced by the text from the notifier.
-    # subject: "[Authelia] {title}"
+    # subject: '[Authelia] {title}'
 
     ## This address is used during the startup check to verify the email configuration is correct.
     ## It's not important what it is except if your email server only allows local delivery.
-    # startup_check_address: test@authelia.com
+    # startup_check_address: 'test@authelia.com'
 
     ## By default we require some form of TLS. This disables this check though is not advised.
     # disable_require_tls: false
@@ -1228,8 +1262,8 @@ notifier:
 
     # tls:
       ## The server subject name to check the servers certificate against during the validation process.
-      ## This option is not required if the certificate has a SAN which matches the host option.
+      ## This option is not required if the certificate has a SAN which matches the address options hostname.
-      # server_name: smtp.example.com
+      # server_name: 'smtp.example.com'
 
       ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
       ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
@@ -1240,10 +1274,10 @@ notifier:
       # skip_verify: false
 
       ## Minimum TLS version for the connection.
-      # minimum_version: TLS1.2
+      # minimum_version: 'TLS1.2'
 
       ## Maximum TLS version for the connection.
-      # maximum_version: TLS1.3
+      # maximum_version: 'TLS1.3'
 
       ## The certificate chain used with the private_key if the server requests TLS Client Authentication
       ## i.e. Mutual TLS.
@@ -1331,7 +1365,7 @@ notifier:
   # oidc:
     ## The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens).
     ## HMAC Secret can also be set using a secret: https://www.authelia.com/c/secrets
-    # hmac_secret: this_is_a_secret_abc123abc123abc
+    # hmac_secret: 'this_is_a_secret_abc123abc123abc'
 
     ## The issuer_certificate_chain is an optional PEM encoded certificate chain. It's used in conjunction with the
     ## issuer_private_key to sign JWT's. All certificates in the chain must be within the validity period, and every
@@ -1408,10 +1442,10 @@ notifier:
       # -----END RSA PRIVATE KEY-----
 
     ## The lifespans configure the expiration for these token types.
-    # access_token_lifespan: 1h
+    # access_token_lifespan: '1h'
-    # authorize_code_lifespan: 1m
+    # authorize_code_lifespan: '1m'
-    # id_token_lifespan: 1h
+    # id_token_lifespan: '1h'
-    # refresh_token_lifespan: 90m
+    # refresh_token_lifespan: '90m'
 
     ## Enables additional debug messages.
     # enable_client_debug_messages: false
@@ -1421,23 +1455,23 @@ notifier:
 
     ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it set to 'never'
     ## for security reasons.
-    # enforce_pkce: public_clients_only
+    # enforce_pkce: 'public_clients_only'
 
     ## Cross-Origin Resource Sharing (CORS) settings.
     # cors:
       ## List of endpoints in addition to the metadata endpoints to permit cross-origin requests on.
       # endpoints:
-        #  - authorization
+        #  - 'authorization'
-        #  - token
+        #  - 'token'
-        #  - revocation
+        #  - 'revocation'
-        #  - introspection
+        #  - 'introspection'
-        #  - userinfo
+        #  - 'userinfo'
 
       ## List of allowed origins.
       ## Any origin with https is permitted unless this option is configured or the
       ## allowed_origins_from_client_redirect_uris option is enabled.
       # allowed_origins:
-        # - https://example.com
+        # - 'https://example.com'
 
       ## Automatically adds the origin portion of all redirect URI's on all clients to the list of allowed_origins,
       ## provided they have the scheme http or https and do not have the hostname of localhost.
@@ -1447,71 +1481,72 @@ notifier:
     # clients:
       # -
         ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
-        # id: myapp
+        # id: 'myapp'
 
         ## The description to show to users when they end up on the consent screen. Defaults to the ID above.
-        # description: My Application
+        # description: 'My Application'
 
         ## The client secret is a shared secret between Authelia and the consumer of this client.
-        # secret: this_is_a_secret
+        # yamllint disable-line rule:line-length
+        # secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
 
         ## Sector Identifiers are occasionally used to generate pairwise subject identifiers. In most cases this is not
         ## necessary. Read the documentation for more information.
         ## The subject identifier must be the host component of a URL, which is a domain name with an optional port.
-        # sector_identifier: example.com
+        # sector_identifier: 'example.com'
 
         ## Sets the client to public. This should typically not be set, please see the documentation for usage.
         # public: false
 
         ## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
         # redirect_uris:
-        # - https://oidc.example.com:8080/oauth2/callback
+        # - 'https://oidc.example.com:8080/oauth2/callback'
 
         ## Audience this client is allowed to request.
         # audience: []
 
         ## Scopes this client is allowed to request.
         # scopes:
-          # - openid
+          # - 'openid'
-          # - groups
+          # - 'groups'
-          # - email
+          # - 'email'
-          # - profile
+          # - 'profile'
 
         ## Response Types configures which responses this client can be sent.
         ## It's not recommended to define this unless you know what you're doing.
         # response_types:
-          # - code
+          # - 'code'
 
         ## Response Modes configures which response modes this client supports.
         # response_modes:
-          # - form_post
+          # - 'form_post'
-          # - query
+          # - 'query'
 
         ## Grant Types configures which grants this client can obtain.
         ## It's not recommended to define this unless you know what you're doing.
         # grant_types:
-        # - authorization_code
+        # - 'authorization_code'
 
         ## The permitted client authentication method for the Token Endpoint for this client.
-        # token_endpoint_auth_method: client_secret_basic
+        # token_endpoint_auth_method: 'client_secret_basic'
 
         ## The policy to require for this client; one_factor or two_factor.
-        # authorization_policy: two_factor
+        # authorization_policy: 'two_factor'
 
         ## Enforces the use of PKCE for this client when set to true.
         # enforce_pkce: false
 
         ## Enforces the use of PKCE for this client when configured, and enforces the specified challenge method.
         ## Options are 'plain' and 'S256'.
-        # pkce_challenge_method: S256
+        # pkce_challenge_method: 'S256'
 
         ## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
-        # userinfo_signing_algorithm: none
+        # userinfo_signing_algorithm: 'none'
 
         ## The consent mode controls how consent is obtained.
-        # consent_mode: auto
+        # consent_mode: 'auto'
 
         ## This value controls the duration a consent on this client remains remembered when the consent mode is
         ## configured as 'auto' or 'pre-configured'.
-        # pre_configured_consent_duration: 1w
+        # pre_configured_consent_duration: '1w'
 ...

crowdin.yml

@@ -1,9 +1,9 @@
 ---
-pull_request_title: "i18n: update translations"
+pull_request_title: 'i18n: update translations'
-commit_message: "i18n: update translation for %original_file_name% (%language%)"
+commit_message: 'i18n: update translation for %original_file_name% (%language%)'
 append_commit_message: false
 files:
-  - source: /internal/server/locales/en/*
+  - source: '/internal/server/locales/en/*'
-    translation: /internal/server/locales/%locale%/%original_file_name%
+    translation: '/internal/server/locales/%locale%/%original_file_name%'
     skip_untranslated_files: true
 ...

docs/content/en/configuration/first-factor/file.md

@@ -21,15 +21,15 @@ aliases:
 ```yaml
 authentication_backend:
   file:
-    path: /config/users.yml
+    path: '/config/users.yml'
     watch: false
     search:
       email: false
       case_insensitive: false
     password:
-      algorithm: argon2
+      algorithm: 'argon2'
       argon2:
-        variant: argon2id
+        variant: 'argon2id'
         iterations: 3
         memory: 65536
         parallelism: 4
@@ -42,15 +42,15 @@ authentication_backend:
         key_length: 32
         salt_length: 16
       pbkdf2:
-        variant: sha512
+        variant: 'sha512'
         iterations: 310000
         salt_length: 16
       sha2crypt:
-        variant: sha512
+        variant: 'sha512'
         iterations: 50000
         salt_length: 16
       bcrypt:
-        variant: standard
+        variant: 'standard'
         cost: 12
 ```
 

docs/content/en/configuration/first-factor/ldap.md

@@ -22,15 +22,15 @@ aliases:
 ```yaml
 authentication_backend:
   ldap:
-    implementation: custom
+    address: 'ldap://127.0.0.1'
-    url: ldap://127.0.0.1
+    implementation: 'custom'
-    timeout: 5s
+    timeout: '5s'
     start_tls: false
     tls:
-      server_name: ldap.example.com
+      server_name: 'ldap.example.com'
       skip_verify: false
-      minimum_version: TLS1.2
+      minimum_version: 'TLS1.2'
-      maximum_version: TLS1.3
+      maximum_version: 'TLS1.3'
       certificate_chain: |
         -----BEGIN CERTIFICATE-----
         MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw
@@ -98,25 +98,54 @@ authentication_backend:
         27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid..
         DO NOT USE==
         -----END RSA PRIVATE KEY-----
-    base_dn: DC=example,DC=com
+    base_dn: 'DC=example,DC=com'
-    additional_users_dn: OU=users
+    additional_users_dn: 'OU=users'
-    users_filter: (&({username_attribute}={input})(objectClass=person))
+    users_filter: '(&({username_attribute}={input})(objectClass=person))'
-    username_attribute: uid
+    username_attribute: 'uid'
-    mail_attribute: mail
+    mail_attribute: 'mail'
-    display_name_attribute: displayName
+    display_name_attribute: 'displayName'
-    additional_groups_dn: OU=groups
+    additional_groups_dn: 'OU=groups'
-    groups_filter: (&(member={dn})(objectClass=groupOfNames))
+    groups_filter: '(&(member={dn})(objectClass=groupOfNames))'
-    group_name_attribute: cn
+    group_name_attribute: 'cn'
     permit_referrals: false
     permit_unauthenticated_bind: false
-    user: CN=admin,DC=example,DC=com
+    user: 'CN=admin,DC=example,DC=com'
-    password: password
+    password: 'password'
 ```
 
 ## Options
 
 This section describes the individual configuration options.
 
+### address
+
+{{< confkey type="string" required="yes" >}}
+
+*__Reference Note:__ This configuration option uses the [Address](../prologue/common.md#address) format. Please see the
+[documentation](../prologue/common.md#address) on this format for more information.*
+
+The LDAP URL which consists of a scheme, hostname, and port. Format is `[<scheme>://]<hostname>[:<port>]`. The default
+scheme is `ldapi` if the path is absolute otherwise it's `ldaps`, and the permitted schemes are `ldap`, `ldaps`, or
+`ldapi` (a unix domain socket).
+
+If the scheme is `ldapi` it must be followed by an absolute path to an existing unix domain socket that the
+user/group the Authelia process is running as has the appropriate permissions to access. For example if the socket is
+located at `/var/run/slapd.sock` the address should be `ldapi:///var/run/slapd.sock`.
+
+__Examples:__
+
+```yaml
+authentication_backend:
+  ldap:
+    address: 'ldaps://dc1.example.com'
+```
+
+```yaml
+authentication_backend:
+  ldap:
+    address: 'ldap://[fd00:1111:2222:3333::1]'
+```
+
 ### implementation
 
 {{< confkey type="string" default="custom" required="no" >}}
@@ -125,27 +154,6 @@ Configures the LDAP implementation used by Authelia.
 
 See the [Implementation Guide](../../reference/guides/ldap.md#implementation-guide) for information.
 
-### url
-
-{{< confkey type="string" required="yes" >}}
-
-The LDAP URL which consists of a scheme, address, and port. Format is `<scheme>://<address>:<port>` or
-`<scheme>://<address>` where scheme is either `ldap` or `ldaps`.
-
-```yaml
-authentication_backend:
-  ldap:
-    url: ldaps://dc1.example.com
-```
-
-If utilising an IPv6 literal address it must be enclosed by square brackets:
-
-```yaml
-authentication_backend:
-  ldap:
-    url: ldap://[fd00:1111:2222:3333::1]
-```
-
 ### timeout
 
 {{< confkey type="duration" default="5s" required="no" >}}

docs/content/en/configuration/identity-providers/open-id-connect.md

@@ -33,7 +33,7 @@ More information about the beta can be found in the [roadmap](../../roadmap/acti
 ```yaml
 identity_providers:
   oidc:
-    hmac_secret: this_is_a_secret_abc123abc123abc
+    hmac_secret: 'this_is_a_secret_abc123abc123abc'
     issuer_certificate_chain: |
       -----BEGIN CERTIFICATE-----
       MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw
@@ -101,48 +101,48 @@ identity_providers:
       27GoE2i5mh6Yez6VAYbUuns3FcwIsMyWLq043Tu2DNkx9ijOOAuQzw^invalid..
       DO NOT USE==
       -----END RSA PRIVATE KEY-----
-    access_token_lifespan: 1h
+    access_token_lifespan: '1h'
-    authorize_code_lifespan: 1m
+    authorize_code_lifespan: '1m'
-    id_token_lifespan: 1h
+    id_token_lifespan: '1h'
-    refresh_token_lifespan: 90m
+    refresh_token_lifespan: '90m'
     enable_client_debug_messages: false
-    enforce_pkce: public_clients_only
+    enforce_pkce: 'public_clients_only'
     cors:
       endpoints:
-        - authorization
+        - 'authorization'
-        - token
+        - 'token'
-        - revocation
+        - 'revocation'
-        - introspection
+        - 'introspection'
       allowed_origins:
-        - https://example.com
+        - 'https://example.com'
       allowed_origins_from_client_redirect_uris: false
     clients:
-      - id: myapp
+      - id: 'myapp'
-        description: My Application
+        description: 'My Application'
         secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
         sector_identifier: ''
         public: false
-        authorization_policy: two_factor
+        authorization_policy: 'two_factor'
-        consent_mode: explicit
+        consent_mode: 'explicit'
-        pre_configured_consent_duration: 1w
+        pre_configured_consent_duration: '1w'
         audience: []
         scopes:
-          - openid
+          - 'openid'
-          - groups
+          - 'groups'
-          - email
+          - 'email'
-          - profile
+          - 'profile'
         redirect_uris:
-          - https://oidc.example.com:8080/oauth2/callback
+          - 'https://oidc.example.com:8080/oauth2/callback'
         grant_types:
-          - refresh_token
+          - 'refresh_token'
-          - authorization_code
+          - 'authorization_code'
         response_types:
-          - code
+          - 'code'
         response_modes:
-          - form_post
+          - 'form_post'
-          - query
+          - 'query'
-          - fragment
+          - 'fragment'
-        userinfo_signing_algorithm: none
+        userinfo_signing_algorithm: 'none'
 ```
 
 ## Options

docs/content/en/configuration/methods/environment.md

@@ -39,7 +39,7 @@ For example this YAML configuration:
 
 ```yaml
 log:
-  level: info
+  level: 'info'
 server:
   buffers:
     read: 4096

docs/content/en/configuration/miscellaneous/introduction.md

@@ -20,14 +20,16 @@ aliases:
 {{< config-alert-example >}}
 
 ```yaml
-certificates_directory: /config/certs/
+certificates_directory: '/config/certs/'
-default_redirection_url: https://home.example.com:8080/
+default_redirection_url: 'https://home.example.com:8080/'
-jwt_secret: v3ry_important_s3cr3t
+jwt_secret: 'v3ry_important_s3cr3t'
-theme: light
+theme: 'light'
 ```
 
 ## Options
 
+This section describes the individual configuration options.
+
 ### certificates_directory
 
 This option defines the location of additional certificates to load into the trust chain specifically for Authelia.

docs/content/en/configuration/miscellaneous/logging.md

@@ -22,14 +22,16 @@ The logging section tunes the logging settings.
 
 ```yaml
 log:
-  level: info
+  level: 'info'
-  format: text
+  format: 'text'
-  file_path: ""
+  file_path: ''
   keep_stdout: false
 ```
 
 ## Options
 
+This section describes the individual configuration options.
+
 ### level
 
 {{< confkey type="string" default="info" required="no" >}}

docs/content/en/configuration/miscellaneous/ntp.md

@@ -27,15 +27,17 @@ unless configured otherwise.
 
 ```yaml
 ntp:
-  address: "time.cloudflare.com:123"
+  address: 'udp://time.cloudflare.com:123'
   version: 3
-  max_desync: 3s
+  max_desync: '3s'
   disable_startup_check: false
   disable_failure: false
 ```
 
 ## Options
 
+This section describes the individual configuration options.
+
 ### address
 
 {{< confkey type="string" default="time.cloudflare.com:123" required="no" >}}
@@ -43,6 +45,28 @@ ntp:
 Determines the address of the NTP server to retrieve the time from. The format is `<host>:<port>`, and both of these are
 required.
 
+### address
+
+{{< confkey type="address" default="udp://time.cloudflare.com:123" required="no" >}}
+
+*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please
+see the [documentation](../prologue/common.md#address) on this format for more information.*
+
+Configures the address for the NTP Server. The address itself is a connector and the scheme must be `udp`,
+`udp4`, or `udp6`.
+
+__Examples:__
+
+```yaml
+ntp:
+  address: 'udp://127.0.0.1:123'
+```
+
+```yaml
+ntp:
+  address: 'udp6://[fd00:1111:2222:3333::1]:123'
+```
+
 ### version
 
 {{< confkey type="integer" default="4" required="no" >}}

docs/content/en/configuration/miscellaneous/privacy-policy.md

@@ -25,6 +25,8 @@ privacy_policy:
 
 ## Options
 
+This section describes the individual configuration options.
+
 ### enabled
 
 {{< confkey type="boolean" default="false" required="no" >}}

docs/content/en/configuration/miscellaneous/server-endpoints-authz.md

@@ -23,16 +23,16 @@ server:
   endpoints:
     authz:
       forward-auth:
-        implementation: ForwardAuth
+        implementation: 'ForwardAuth'
         authn_strategies: []
       ext-authz:
-        implementation: ExtAuthz
+        implementation: 'ExtAuthz'
         authn_strategies: []
       auth-request:
-        implementation: AuthRequest
+        implementation: 'AuthRequest'
         authn_strategies: []
       legacy:
-        implementation: Legacy
+        implementation: 'Legacy'
         authn_strategies: []
 ```
 

docs/content/en/configuration/miscellaneous/server.md

@@ -21,37 +21,37 @@ aliases:
 
 ```yaml
 server:
-  address: "tcp://:9091"
+  address: 'tcp://:9091'
-  path: ""
+  path: ''
   disable_healthcheck: false
   tls:
-    key: ""
+    key: ''
-    certificate: ""
+    certificate: ''
     client_certificates: []
   headers:
-    csp_template: ""
+    csp_template: ''
   buffers:
     read: 4096
     write: 4096
   timeouts:
-    read: 6s
+    read: '6s'
-    write: 6s
+    write: '6s'
-    idle: 30s
+    idle: '30s'
   endpoints:
     enable_pprof: false
     enable_expvars: false
     authz:
       forward-auth:
-        implementation: ForwardAuth
+        implementation: 'ForwardAuth'
         authn_strategies: []
       ext-authz:
-        implementation: ExtAuthz
+        implementation: 'ExtAuthz'
         authn_strategies: []
       auth-request:
-        implementation: AuthRequest
+        implementation: 'AuthRequest'
         authn_strategies: []
       legacy:
-        implementation: Legacy
+        implementation: 'Legacy'
         authn_strategies: []
 ```
 

docs/content/en/configuration/notifications/file.md

@@ -27,7 +27,7 @@ This method will use the plain text email template for readability purposes.
 notifier:
   disable_startup_check: false
   filesystem:
-    filename: /config/notification.txt
+    filename: '/config/notification.txt'
 ```
 
 ## Options

docs/content/en/configuration/notifications/smtp.md

@@ -23,23 +23,22 @@ aliases:
 notifier:
   disable_startup_check: false
   smtp:
-    host: 127.0.0.1
+    address: 'smtp://127.0.0.1:25'
-    port: 1025
+    timeout: '5s'
-    timeout: 5s
+    username: 'test'
-    username: test
+    password: 'password'
-    password: password
     sender: "Authelia <admin@example.com>"
-    identifier: localhost
+    identifier: 'localhost'
     subject: "[Authelia] {title}"
-    startup_check_address: test@authelia.com
+    startup_check_address: 'test@authelia.com'
     disable_require_tls: false
     disable_starttls: false
     disable_html_emails: false
     tls:
-      server_name: smtp.example.com
+      server_name: 'smtp.example.com'
       skip_verify: false
-      minimum_version: TLS1.2
+      minimum_version: 'TLS1.2'
-      maximum_version: TLS1.3
+      maximum_version: 'TLS1.3'
       certificate_chain: |
         -----BEGIN CERTIFICATE-----
         MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw
@@ -113,31 +112,34 @@ notifier:
 
 This section describes the individual configuration options.
 
-### host
+### address
 
-{{< confkey type="integer" required="yes" >}}
+{{< confkey type="address" required="yes" >}}
 
-The hostname of the SMTP server.
+*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please
+see the [documentation](../prologue/common.md#address) on this format for more information.*
 
-If utilising an IPv6 literal address it must be enclosed by square brackets and quoted:
+Configures the address for the SMTP Server. The address itself is a connector and the scheme must be `smtp`,
-
+`submission`, or `submissions`. The only difference between these schemes are the default ports and `submissions`
-```yaml
+requires a TLS transport per [SMTP Ports Security Measures][docs-security-smtp-port], whereas `submission` and `smtp`
-host: "[fd00:1111:2222:3333::1]"
+use a standard TCP transport and typically enforce StartTLS.
-```
-
-### port
-
-{{< confkey type="integer" required="yes" >}}
-
-The port the SMTP service is listening on.
-
-A connection is securely established with TLS after a succesful STARTTLS negotiation.
-
-[Port 465 is an exception][docs-security-smtp-port] when supported by the mail server as a `submissions` service port.
-STARTTLS negotiation is not required for this port, the connection is implicitly established with TLS.
 
 [docs-security-smtp-port]: ../../overview/security/measures.md#smtp-ports
 
+__Examples:__
+
+```yaml
+notifier:
+  smtp:
+    address: 'smtp://127.0.0.1:25'
+```
+
+```yaml
+notifier:
+  smtp:
+    address: 'submissions://[fd00:1111:2222:3333::1]:465'
+```
+
 ### timeout
 
 {{< confkey type="duration" default="5s" required="no" >}}
@@ -241,10 +243,10 @@ You need to generate an app password in order to use Gmail SMTP servers. The pro
 ```yaml
 notifier:
   smtp:
-    username: myaccount@gmail.com
+    username: 'myaccount@gmail.com'
     # Password can also be set using a secret: https://www.authelia.com/configuration/methods/secrets/
-    password: yourapppassword
+    password: 'yourapppassword'
-    sender: admin@example.com
+    sender: 'admin@example.com'
-    host: smtp.gmail.com
+    host: 'smtp.gmail.com'
     port: 587
 ```

docs/content/en/configuration/prologue/common.md

@@ -92,17 +92,31 @@ These values are more human readable but have only been available since v4.38.0.
 
 The base type for this syntax is a string.
 
-The address type is a string that indicates how to configure a listener or connector, which are the two primary
+The address type is a string that indicates how to configure a listener (i.e. listening for connections) or connector
-categories of addresses.
+(i.e. opening remote connections), which are the two primary categories of addresses.
 
-The address values take the following formats:
+
+#### Format
+
+This section outlines the format for these strings. The formats use a conventional POSIX format to indicate optional and
+required elements. The square brackets `[]` surround optional portions, and the angled brackets `<>` surround required
+portions. Required portions may exist within optional portions, in which case they are often accompanied with other
+format specific text which indicates if the accompanying text exists then it is actually required, otherwise it's
+entirely optional.
+
+The connector address values take the following formats:
 
 ```text
 [<scheme>://]<hostname>[:<port>]
-[<scheme>://]:<port>
 unix://<path>
 ```
 
+The listener address values take the following additional formats:
+
+```text
+[<scheme>://]:<port>
+```
+
 Examples:
 
 ```text
@@ -121,7 +135,7 @@ The square brackets indicate optional sections, and the angled brackets indicate
 sections elaborate on this. Sections may only be optional for the purposes of parsing, there may be a configuration
 requirement that one of these is provided.
 
-### scheme
+#### scheme
 
 The entire scheme is optional, but if the scheme host delimiter `://` is in the string, the scheme must be present. The
 scheme must be one of the following (the listeners and connectors columns indicate support for the scheme on the
@@ -147,7 +161,7 @@ If the scheme is absent, the default scheme is assumed. If the address has a `/`
 otherwise it's assumed to be`tcp`. If the scheme is `unix` it must be suffixed with an absolute path i.e.
 `/var/local/authelia.sock` would be represented as `unix:///var/run/authelia.sock`.
 
-### hostname
+#### hostname
 
 The hostname is required if the scheme is one of the `tcp` or `udp` schemes and there is no [port](#port) specified. It
 can be any IP that is locally addressable or a hostname which resolves to a locally addressable IP.
@@ -155,7 +169,7 @@ can be any IP that is locally addressable or a hostname which resolves to a loca
 If specifying an IPv6 it should be wrapped in square brackets. For example for the IPv6 address `::1` with the `tcp`
 scheme and port `80` the correct address would be `tcp://[::1]:80`.
 
-### port
+#### port
 
 The hostname is required if the scheme is one of the `tcp` or `udp` schemes and there is no [hostname](#hostname)
 specified.

docs/content/en/configuration/second-factor/duo.md

@@ -30,9 +30,9 @@ section of the configuration.
 ```yaml
 duo_api:
   disable: false
-  hostname: api-123456789.example.com
+  hostname: 'api-123456789.example.com'
-  integration_key: ABCDEF
+  integration_key: 'ABCDEF'
-  secret_key: 1234567890abcdefghifjkl
+  secret_key: '1234567890abcdefghifjkl'
   enable_self_enrollment: false
 ```
 

docs/content/en/configuration/second-factor/time-based-one-time-password.md

@@ -31,8 +31,8 @@ and many only support SHA1.
 ```yaml
 totp:
   disable: false
-  issuer: authelia.com
+  issuer: 'authelia.com'
-  algorithm: sha1
+  algorithm: 'sha1'
   digits: 6
   period: 30
   skew: 1

docs/content/en/configuration/second-factor/webauthn.md

@@ -21,10 +21,10 @@ aliases:
 ```yaml
 webauthn:
   disable: false
-  display_name: Authelia
+  display_name: 'Authelia'
-  attestation_conveyance_preference: indirect
+  attestation_conveyance_preference: 'indirect'
-  user_verification: preferred
+  user_verification: 'preferred'
-  timeout: 60s
+  timeout: '60s'
 ```
 
 ## Options

docs/content/en/configuration/security/access-control.md

@@ -21,9 +21,9 @@ aliases:
 
 ```yaml
 access_control:
-  default_policy: deny
+  default_policy: 'deny'
   networks:
-  - name: internal
+  - name: 'internal'
     networks:
     - '10.0.0.0/8'
     - '172.16.0.0/12'
@@ -31,7 +31,7 @@ access_control:
   rules:
   - domain: 'private.example.com'
     domain_regex: '^(\d+\-)?priv-img.example.com$'
-    policy: one_factor
+    policy: 'one_factor'
     networks:
     - 'internal'
     - '1.1.1.1'
@@ -40,8 +40,8 @@ access_control:
     - ['user:fred']
     - ['group:admins']
     methods:
-    - GET
+    - 'GET'
-    - HEAD
+    - 'HEAD'
     resources:
     - '^/api.*'
     query:
@@ -154,10 +154,10 @@ different ways.*
 access_control:
   rules:
   - domain: '*.example.com'
-    policy: bypass
+    policy: 'bypass'
   - domain:
     - '*.example.com'
-    policy: bypass
+    policy: 'bypass'
 ```
 
 *Multiple domains matched. These rules will match either `apple.example.com` or `orange.example.com`. All rules in this
@@ -167,11 +167,11 @@ list are effectively the same rule just expressed in different ways.*
 access_control:
   rules:
   - domain: ['apple.example.com', 'banana.example.com']
-    policy: bypass
+    policy: 'bypass'
   - domain:
-    - apple.example.com
+    - 'apple.example.com'
-    - banana.example.com
+    - 'banana.example.com'
-    policy: bypass
+    policy: 'bypass'
 ```
 
 *Multiple domains matched either via a static domain or via a [domain_regex]. This rule will match
@@ -217,7 +217,7 @@ access_control:
   - domain_regex:
     - '^user-(?P<User>\w+)\.example\.com$'
     - '^group-(?P<Group>\w+)\.example\.com$'
-    policy: one_factor
+    policy: 'one_factor'
 ```
 
 *Multiple domains example, one with a static domain and one with a regex domain. This will match requests to
@@ -228,7 +228,7 @@ access_control:
   rules:
   - domain: 'protected.example.com'
   - domain_regex: '^(img|data)-private\.example\.com'
-    policy: one_factor
+    policy: 'one_factor'
 ```
 
 #### policy
@@ -267,14 +267,14 @@ ways.*
 ```yaml
 access_control:
   rules:
-  - domain: example.com
+  - domain: 'example.com'
-    policy: two_factor
+    policy: 'two_factor'
     subject:
     - 'user:john'
     - ['group:admin', 'group:app-name']
     - 'group:super-admin'
-  - domain: example.com
+  - domain: 'example.com'
-    policy: two_factor
+    policy: 'two_factor'
     subject:
     - ['user:john']
     - ['group:admin', 'group:app-name']
@@ -287,15 +287,15 @@ expressed in different ways.*
 ```yaml
 access_control:
   rules:
-  - domain: example.com
+  - domain: 'example.com'
-    policy: one_factor
+    policy: 'one_factor'
     subject: 'group:super-admin'
-  - domain: example.com
+  - domain: 'example.com'
-    policy: one_factor
+    policy: 'one_factor'
     subject:
     - 'group:super-admin'
-  - domain: example.com
+  - domain: 'example.com'
-    policy: one_factor
+    policy: 'one_factor'
     subject:
     - ['group:super-admin']
 ```
@@ -332,10 +332,10 @@ relevant methods are listed in this table:
 ```yaml
 access_control:
   rules:
-  - domain: example.com
+  - domain: 'example.com'
-    policy: bypass
+    policy: 'bypass'
     methods:
-    - OPTIONS
+    - 'OPTIONS'
 ```
 
 #### networks
@@ -369,28 +369,28 @@ rules in this list are effectively the same rule just expressed in different way
 
 ```yaml
 access_control:
-  default_policy: two_factor
+  default_policy: 'two_factor'
   networks:
-  - name: internal
+  - name: 'internal'
     networks:
       - '10.0.0.0/8'
       - '172.16.0.0/12'
       - '192.168.0.0/18'
   rules:
-  - domain: secure.example.com
+  - domain: 'secure.example.com'
-    policy: one_factor
+    policy: 'one_factor'
     networks:
     - '10.0.0.0/8'
     - '172.16.0.0/12'
     - '192.168.0.0/18'
     - '112.134.145.167/32'
-  - domain: secure.example.com
+  - domain: 'secure.example.com'
-    policy: one_factor
+    policy: 'one_factor'
     networks:
     - 'internal'
     - '112.134.145.167/32'
-  - domain: secure.example.com
+  - domain: 'secure.example.com'
-    policy: two_factor
+    policy: 'two_factor'
 ```
 
 #### resources
@@ -425,8 +425,8 @@ likely save you a lot of time if you do it for all resource rules.
 ```yaml
 access_control:
   rules:
-  - domain: app.example.com
+  - domain: 'app.example.com'
-    policy: bypass
+    policy: 'bypass'
     resources:
     - '^/api([/?].*)?$'
 ```
@@ -471,8 +471,8 @@ defaults to `present`.
 ```yaml
 access_control:
   rules:
-    - domain: app.example.com
+    - domain: 'app.example.com'
-      policy: bypass
+      policy: 'bypass'
       query:
       - - operator: 'present'
           key: 'secure'
@@ -549,13 +549,13 @@ a match for that request.
 - domain:
     - 'example.com'
     - '*.example.com'
-  policy: bypass
+  policy: 'bypass'
   resources:
     - '^/api$'
     - '^/api/'
 - domain:
     - 'app.example.com'
-  policy: two_factor
+  policy: 'two_factor'
 ```
 
 [Rule Matching Concept 1]: #rule-matching-concept-1-sequential-order
@@ -607,25 +607,25 @@ Here is a detailed example of an example access control section:
 
 ```yaml
 access_control:
-  default_policy: deny
+  default_policy: 'deny'
   networks:
-    - name: internal
+    - name: 'internal'
       networks:
         - '10.10.0.0/16'
         - '192.168.2.0/24'
-    - name: VPN
+    - name: 'VPN'
-      networks: 10.9.0.0/16
+      networks: '10.9.0.0/16'
   rules:
     - domain: 'public.example.com'
-      policy: bypass
+      policy: 'bypass'
 
     - domain: '*.example.com'
-      policy: bypass
+      policy: 'bypass'
       methods:
-        - OPTIONS
+        - 'OPTIONS'
 
     - domain: 'secure.example.com'
-      policy: one_factor
+      policy: 'one_factor'
       networks:
         - 'internal'
         - 'VPN'
@@ -635,37 +635,37 @@ access_control:
     - domain:
       - 'secure.example.com'
       - 'private.example.com'
-      policy: two_factor
+      policy: 'two_factor'
 
     - domain: 'singlefactor.example.com'
-      policy: one_factor
+      policy: 'one_factor'
 
     - domain: 'mx2.mail.example.com'
       subject: 'group:admins'
-      policy: deny
+      policy: 'deny'
 
     - domain: '*.example.com'
       subject:
         - 'group:admins'
         - 'group:moderators'
-      policy: two_factor
+      policy: 'two_factor'
 
-    - domain: dev.example.com
+    - domain: 'dev.example.com'
       resources:
       - '^/groups/dev/.*$'
       subject: 'group:dev'
-      policy: two_factor
+      policy: 'two_factor'
 
-    - domain: dev.example.com
+    - domain: 'dev.example.com'
       resources:
       - '^/users/john/.*$'
       subject:
       - ['group:dev', 'user:john']
       - 'group:admins'
-      policy: two_factor
+      policy: 'two_factor'
 
     - domain: '{user}.example.com'
-      policy: bypass
+      policy: 'bypass'
 ```
 
 [RFC7231]: https://datatracker.ietf.org/doc/html/rfc7231

docs/content/en/configuration/security/regulation.md

@@ -25,8 +25,8 @@ authentication attempts. This helps prevent brute-force attacks.
 ```yaml
 regulation:
   max_retries: 3
-  find_time: 2m
+  find_time: '2m'
-  ban_time: 5m
+  ban_time: '5m'
 ```
 
 ## Options

docs/content/en/configuration/session/introduction.md

@@ -24,22 +24,20 @@ the session cookie behaviour and the domains which Authelia can service authoriz
 
 ```yaml
 session:
-  secret: insecure_session_secret
+  secret: 'insecure_session_secret'
-
+  name: 'authelia_session'
-  name: authelia_session
+  same_site: 'lax'
-  same_site: lax
+  inactivity: '5m'
-  inactivity: 5m
+  expiration: '1h'
-  expiration: 1h
+  remember_me: '1M'
-  remember_me: 1M
-
   cookies:
-    - domain: example.com
+    - domain: 'example.com'
-      authelia_url: https://auth.example.com
+      authelia_url: 'https://auth.example.com'
-      name: authelia_session
+      name: 'authelia_session'
-      same_site: lax
+      same_site: 'lax'
-      inactivity: 5m
+      inactivity: '5m'
-      expiration: 1h
+      expiration: '1h'
-      remember_me: 1d
+      remember_me: '1d'
 ```
 
 ## Providers

docs/content/en/configuration/session/redis.md

@@ -25,18 +25,18 @@ this option and we highly recommend it in production environments. It requires y
 ```yaml
 session:
   redis:
-    host: 127.0.0.1
+    host: '127.0.0.1'
     port: 6379
-    username: authelia
+    username: 'authelia'
-    password: authelia
+    password: 'authelia'
     database_index: 0
     maximum_active_connections: 8
     minimum_idle_connections: 0
     tls:
-      server_name: myredis.example.com
+      server_name: 'myredis.example.com'
       skip_verify: false
-      minimum_version: TLS1.2
+      minimum_version: 'TLS1.2'
-      maximum_version: TLS1.3
+      maximum_version: 'TLS1.3'
       certificate_chain: |
         -----BEGIN CERTIFICATE-----
         MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw
@@ -105,15 +105,15 @@ session:
         DO NOT USE==
         -----END RSA PRIVATE KEY-----
     high_availability:
-      sentinel_name: mysentinel
+      sentinel_name: 'mysentinel'
       # If `sentinel_username` is supplied, Authelia will connect using ACL-based
       # authentication. Otherwise, it will use traditional `requirepass` auth.
-      sentinel_username: sentinel_user
+      sentinel_username: 'sentinel_user'
-      sentinel_password: sentinel_specific_pass
+      sentinel_password: 'sentinel_specific_pass'
       nodes:
-        - host: sentinel-node1
+        - host: 'sentinel-node1'
           port: 26379
-        - host: sentinel-node2
+        - host: 'sentinel-node2'
           port: 26379
       route_by_latency: false
       route_randomly: false

docs/content/en/configuration/storage/introduction.md

@@ -25,7 +25,7 @@ The available storage backends are listed in the table of contents below.
 
 ```yaml
 storage:
-  encryption_key: a_very_important_secret
+  encryption_key: 'a_very_important_secret'
   local: {}
   mysql: {}
   postgres: {}

docs/content/en/configuration/storage/mysql.md

@@ -26,19 +26,18 @@ guide for supported version information.
 
 ```yaml
 storage:
-  encryption_key: a_very_important_secret
+  encryption_key: 'a_very_important_secret'
   mysql:
-    host: 127.0.0.1
+    address: 'tcp://127.0.0.1:3306'
-    port: 3306
+    database: 'authelia'
-    database: authelia
+    username: 'authelia'
-    username: authelia
+    password: 'mypassword'
-    password: mypassword
+    timeout: '5s'
-    timeout: 5s
     tls:
-      server_name: mysql.example.com
+      server_name: 'mysql.example.com'
       skip_verify: false
-      minimum_version: TLS1.2
+      minimum_version: 'TLS1.2'
-      maximum_version: TLS1.3
+      maximum_version: 'TLS1.3'
       certificate_chain: |
         -----BEGIN CERTIFICATE-----
         MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw
@@ -116,33 +115,35 @@ This section describes the individual configuration options.
 
 See the [encryption_key docs](introduction.md#encryption_key).
 
-### host
+### address
 
-{{< confkey type="string" default="localhost" required="no" >}}
+{{< confkey type="address" required="yes" >}}
 
-The database server host. This can also be a unix socket.
+*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please
+see the [documentation](../prologue/common.md#address) on this format for more information.*
 
-If utilising an IPv6 literal address it must be enclosed by square brackets and quoted:
+Configures the address for the MySQL/MariaDB Server. The address itself is a connector and the scheme must either be
+the `unix` scheme or one of the `tcp` schemes.
+
+__Examples:__
 
 ```yaml
 storage:
   mysql:
-    host: "[fd00:1111:2222:3333::1]"
+    address: 'tcp://127.0.0.1:3306'
 ```
 
-If utilizing a unix socket it must have the `/` prefix:
-
 ```yaml
 storage:
   mysql:
-    host: /var/run/mysqld.sock
+    address: 'tcp://[fd00:1111:2222:3333::1]:3306'
 ```
 
-### port
+```yaml
-
+storage:
-{{< confkey type="integer" default="3306" required="no" >}}
+  mysql:
-
+    address: 'unix:///var/run/mysqld.sock'
-The port the database server is listening on.
+```
 
 ### database
 

docs/content/en/configuration/storage/postgres.md

@@ -25,19 +25,18 @@ guide for supported version information.
 
 ```yaml
 storage:
-  encryption_key: a_very_important_secret
+  encryption_key: 'a_very_important_secret'
   postgres:
-    host: 127.0.0.1
+    address: 'tcp://127.0.0.1:5432'
-    port: 5432
+    database: 'authelia'
-    database: authelia
+    schema: 'public'
-    schema: public
+    username: 'authelia'
-    username: authelia
+    password: 'mypassword'
-    password: mypassword
     tls:
-      server_name: postgres.example.com
+      server_name: 'postgres.example.com'
       skip_verify: false
-      minimum_version: TLS1.2
+      minimum_version: 'TLS1.2'
-      maximum_version: TLS1.3
+      maximum_version: 'TLS1.3'
       certificate_chain: |
         -----BEGIN CERTIFICATE-----
         MIIC5jCCAc6gAwIBAgIRAK4Sj7FiN6PXo/urPfO4E7owDQYJKoZIhvcNAQELBQAw
@@ -113,35 +112,37 @@ This section describes the individual configuration options.
 
 ### encryption_key
 
-See the [encryption_key docs](introduction.md#encryption_key).
+See the [encryption_key docs](introduction.md#encryptionkey).
 
-### host
+### address
 
-{{< confkey type="string" required="yes" >}}
+{{< confkey type="address" required="yes" >}}
 
-The database server host. This can also be a unix socket.
+*__Reference Note:__ This configuration option uses the [address common syntax](../prologue/common.md#address). Please
+see the [documentation](../prologue/common.md#address) on this format for more information.*
 
-If utilising an IPv6 literal address it must be enclosed by square brackets and quoted:
+Configures the address for the PostgreSQL Server. The address itself is a connector and the scheme must either be
+the `unix` scheme or one of the `tcp` schemes.
+
+__Examples:__
 
 ```yaml
 storage:
   postgres:
-    host: "[fd00:1111:2222:3333::1]"
+    address: 'tcp://127.0.0.1:5432'
 ```
 
-If utilizing a unix socket it must have the `/` prefix:
-
 ```yaml
 storage:
   postgres:
-    host: /var/run/postgres.sock
+    address: 'tcp://[fd00:1111:2222:3333::1]:5432'
 ```
 
-### port
+```yaml
-
+storage:
-{{< confkey type="integer" default="5432" required="no" >}}
+  postgres:
-
+    address: 'unix:///var/run/postgres.sock'
-The port the database server is listening on.
+```
 
 ### database
 

docs/content/en/configuration/storage/sqlite.md

@@ -28,9 +28,9 @@ but this requires you setup an external database such as [PostgreSQL](postgres.m
 
 ```yaml
 storage:
-  encryption_key: a_very_important_secret
+  encryption_key: 'a_very_important_secret'
   local:
-    path: /config/db.sqlite3
+    path: '/config/db.sqlite3'
 ```
 
 ## Options

docs/content/en/configuration/telemetry/metrics.md

@@ -22,14 +22,14 @@ toc: true
 telemetry:
   metrics:
     enabled: false
-    address: "tcp://:9959"
+    address: 'tcp://:9959'
     buffers:
       read: 4096
       write: 4096
     timeouts:
-      read: 6s
+      read: '6s'
-      write: 6s
+      write: '6s'
-      idle: 30s
+      idle: '30s'
 ```
 
 ## Options

docs/content/en/integration/kubernetes/istio.md

@@ -30,8 +30,8 @@ This is an example IstioOperator manifest adjusted to authenticate with Authelia
 portions of the resource that you add as well as context. You will need to adapt it to your needs.
 
 ```yaml
-apiVersion: install.istio.io/v1alpha1
+apiVersion: 'install.istio.io/v1alpha1'
-kind: IstioOperator
+kind: 'IstioOperator'
 spec:
   meshConfig:
     extensionProviders:
@@ -63,13 +63,13 @@ spec:
 The following [Authorization Policy] applies the above filter extension provider to the `nextcloud.example.com` domain:
 
 ```yaml
-apiVersion: security.istio.io/v1beta1
+apiVersion: 'security.istio.io/v1beta1'
-kind: AuthorizationPolicy
+kind: 'AuthorizationPolicy'
 metadata:
-  name: nextcloud
+  name: 'nextcloud'
-  namespace: apps
+  namespace: 'apps'
 spec:
-  action: CUSTOM
+  action: 'CUSTOM'
   provider:
     name:  'authelia'
   rules:

docs/content/en/integration/kubernetes/traefik-ingress.md

@@ -51,14 +51,14 @@ __SHOULD NOT__ be applied to the Authelia [Ingress] / [IngressRoute] itself.*
 {{< details "middleware.yml" >}}
 ```yaml
 ---
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: 'traefik.containo.us/v1alpha1'
-kind: Middleware
+kind: 'Middleware'
 metadata:
-  name: forwardauth-authelia
+  name: 'forwardauth-authelia'
-  namespace: default
+  namespace: 'default'
   labels:
-    app.kubernetes.io/instance: authelia
+    app.kubernetes.io/instance: 'authelia'
-    app.kubernetes.io/name: authelia
+    app.kubernetes.io/name: 'authelia'
 spec:
   forwardAuth:
     address: 'http://authelia.default.svc.cluster.local/api/authz/forward-auth'
@@ -85,25 +85,25 @@ the `default` [Namespace] with TCP port `80` configured to route to the applicat
 {{< details "ingress.yml" >}}
 ```yaml
 ---
-apiVersion: networking.k8s.io/v1
+apiVersion: 'networking.k8s.io/v1'
-kind: Ingress
+kind: 'Ingress'
 metadata:
-  name: app
+  name: 'app'
-  namespace: default
+  namespace: 'default'
   annotations:
-    traefik.ingress.kubernetes.io/router.entryPoints: websecure
+    traefik.ingress.kubernetes.io/router.entryPoints: 'websecure'
-    traefik.ingress.kubernetes.io/router.middlewares: default-forwardauth-authelia@kubernetescrd
+    traefik.ingress.kubernetes.io/router.middlewares: 'default-forwardauth-authelia@kubernetescrd'
-    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.tls: 'true'
 spec:
   rules:
-    - host: app.example.com
+    - host: 'app.example.com'
       http:
         paths:
-          - path: /bar
+          - path: '/bar'
-            pathType: Prefix
+            pathType: 'Prefix'
             backend:
               service:
-                name:  app
+                name:  'app'
                 port:
                   number: 80
 ...
@@ -119,27 +119,27 @@ the `default` [Namespace] with TCP port `80` configured to route to the applicat
 {{< details "ingressRoute.yml" >}}
 ```yaml
 ---
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: 'traefik.containo.us/v1alpha1'
-kind: IngressRoute
+kind: 'IngressRoute'
 metadata:
-  name: app
+  name: 'app'
-  namespace: default
+  namespace: 'default'
 spec:
   entryPoints:
-    - websecure
+    - 'websecure'
   routes:
-    - kind: Rule
+    - kind: 'Rule'
-      match: Host(`app.example.com`)
+      match: 'Host(`app.example.com`)'
       middlewares:
-        - name: forwardauth-authelia
+        - name: 'forwardauth-authelia'
-          namespace: default
+          namespace: 'default'
       services:
-        - kind: Service
+        - kind: 'Service'
-          name: app
+          name: 'app'
-          namespace: default
+          namespace: 'default'
           port: 80
-          scheme: http
+          scheme: 'http'
-          strategy: RoundRobin
+          strategy: 'RoundRobin'
           weight: 10
 ...
 ```

docs/content/en/integration/ldap/introduction.md

@@ -44,8 +44,8 @@ In your Authelia configuration you will need to enter and update the following v
 
 ```yaml
   ldap:
+    address: 'ldap://OpenLDAP:1389'
     implementation: custom
-    url: ldap://OpenLDAP:1389
     timeout: 5s
     start_tls: false
     tls:
@@ -91,8 +91,8 @@ In your Authelia configuration you will need to enter and update the following v
 
 ```yaml
  ldap:
+    address: 'ldaps://ldap.example.com'
     implementation: custom
-    url: ldaps://ldap.example.com
     timeout: 5s
     start_tls: false
     tls:
@@ -134,8 +134,8 @@ In your Authelia configuration you will need to enter and update the following v
 
 ```yaml
 ldap:
+    address: 'ldap://lldap:3890'
     implementation: custom
-    url: ldap://lldap:3890
     timeout: 5s
     start_tls: false
     base_dn: dc=example,DC=com

docs/content/en/integration/openid-connect/apache-guacamole/index.md

@@ -62,23 +62,23 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: guacamole
+    - id: 'guacamole'
-      description: Apache Guacamole
+      description: 'Apache Guacamole'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://guacamole.example.com
+        - 'https://guacamole.example.com'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - groups
+        - 'groups'
-        - email
+        - 'email'
       response_types:
-        - id_token
+        - 'id_token'
       grant_types:
-        - implicit
+        - 'implicit'
-      userinfo_signing_algorithm: none
+      userinfo_signing_algorithm: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/argocd/index.md

@@ -65,32 +65,32 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: argocd
+    - id: 'argocd'
-      description: Argo CD
+      description: 'Argo CD'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://argocd.example.com/auth/callback
+        - 'https://argocd.example.com/auth/callback'
       scopes:
-        - openid
+        - 'openid'
-        - groups
+        - 'groups'
-        - email
+        - 'email'
-        - profile
+        - 'profile'
-      userinfo_signing_algorithm: none
+      userinfo_signing_algorithm: 'none'
-    - id: argocd-cli
+    - id: 'argocd-cli'
-      description: Argo CD (CLI)
+      description: 'Argo CD (CLI)'
       public: true
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - http://localhost:8085/auth/callback
+        - 'http://localhost:8085/auth/callback'
       scopes:
-        - openid
+        - 'openid'
-        - groups
+        - 'groups'
-        - email
+        - 'email'
-        - profile
+        - 'profile'
-        - offline_access
+        - 'offline_access'
-      userinfo_signing_algorithm: none
+      userinfo_signing_algorithm: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/bookstack/index.md

@@ -67,18 +67,18 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: bookstack
+    - id: 'bookstack'
-      description: BookStack
+      description: 'BookStack'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://bookstack.example.com/oidc/callback
+        - 'https://bookstack.example.com/oidc/callback'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_algorithm: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/cloudflare-zerotrust/index.md

@@ -75,18 +75,18 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: cloudflare
+    - id: 'cloudflare'
-      description: Cloudflare ZeroTrust
+      description: 'Cloudflare ZeroTrust'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://example-team.cloudflareaccess.com/cdn-cgi/access/callback
+        - 'https://example-team.cloudflareaccess.com/cdn-cgi/access/callback'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_algorithm: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/firezone/index.md

@@ -76,20 +76,20 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: firezone
+    - id: 'firezone'
-      description: Firezone
+      description: 'Firezone'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       enforce_pkce: true
-      pkce_challenge_method: S256
+      pkce_challenge_method: 'S256'
       redirect_uris:
-        - https://firezone.example.com/auth/oidc/authelia/callback
+        - 'https://firezone.example.com/auth/oidc/authelia/callback'
       scopes:
-        - openid
+        - 'openid'
-        - email
+        - 'email'
-        - profile
+        - 'profile'
-      userinfo_signing_algorithm: none
+      userinfo_signing_algorithm: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/frequently-asked-questions.md

@@ -132,7 +132,7 @@ services:
       ## Mandatory that the proxy is on the same network as the application, and that it has this alias.
       proxy:
         aliases:
-          - auth.example.com
+          - 'auth.example.com'
   authelia:
     networks:
       proxy: {}
@@ -140,7 +140,7 @@ networks:
   proxy:
     ## An external network can be created manually and shared between multiple compose files. This is NOT mandatory.
     external: true
-    name: proxy-net
+    name: 'proxy-net'
 ```
 
 ```console

docs/content/en/integration/openid-connect/gitea/index.md

@@ -86,18 +86,18 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: gitea
+    - id: 'gitea'
-      description: Gitea
+      description: 'Gitea'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://gitea.example.com/user/oauth2/authelia/callback
+        - 'https://gitea.example.com/user/oauth2/authelia/callback'
       scopes:
-        - openid
+        - 'openid'
-        - email
+        - 'email'
-        - profile
+        - 'profile'
-      userinfo_signing_algorithm: none
+      userinfo_signing_algorithm: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/gitlab/index.md

@@ -78,19 +78,19 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: gitlab
+    - id: 'gitlab'
-      description: GitLab
+      description: 'GitLab'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://gitlab.example.com/users/auth/openid_connect/callback
+        - 'https://gitlab.example.com/users/auth/openid_connect/callback'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - groups
+        - 'groups'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_algorithm: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/grafana/index.md

@@ -96,19 +96,19 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: grafana
+    - id: 'grafana'
-      description: Grafana
+      description: 'Grafana'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://grafana.example.com/login/generic_oauth
+        - 'https://grafana.example.com/login/generic_oauth'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - groups
+        - 'groups'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_algorithm: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/harbor/index.md

@@ -69,19 +69,19 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: harbor
+    - id: 'harbor'
-      description: Harbor
+      description: 'Harbor'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://harbor.example.com/c/oidc/callback
+        - 'https://harbor.example.com/c/oidc/callback'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - groups
+        - 'groups'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_algorithm: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/hashicorp-vault/index.md

@@ -52,20 +52,20 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: vault
+    - id: 'vault'
-      description: HashiCorp Vault
+      description: 'HashiCorp Vault'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://vault.example.com/oidc/callback
+        - 'https://vault.example.com/oidc/callback'
-        - https://vault.example.com/ui/vault/auth/oidc/oidc/callback
+        - 'https://vault.example.com/ui/vault/auth/oidc/oidc/callback'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - groups
+        - 'groups'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_algorithm: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/kasm-workspaces/index.md

@@ -67,20 +67,20 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-      - id: kasm
+      - id: 'kasm'
-        description: Kasm Workspaces
+        description: 'Kasm Workspaces'
         secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
         public: false
-        authorization_policy: two_factor
+        authorization_policy: 'two_factor'
         redirect_uris:
-          - https://kasm.example.com/api/oidc_callback
+          - 'https://kasm.example.com/api/oidc_callback'
         scopes:
-          - openid
+          - 'openid'
-          - profile
+          - 'profile'
-          - groups
+          - 'groups'
-          - email
+          - 'email'
-        consent_mode: implicit
+        consent_mode: 'implicit'
-        userinfo_signing_algorithm: none
+        userinfo_signing_algorithm: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/komga/index.md

@@ -50,16 +50,16 @@ spring:
       client:
         registration:
           authelia:
-            client-id: `komga`
+            client-id: 'komga'
-            client-secret: `insecure_secret`
+            client-secret: 'insecure_secret'
-            client-name: Authelia
+            client-name: 'Authelia'
-            scope: openid,profile,email
+            scope: 'openid,profile,email'
-            authorization-grant-type: authorization_code
+            authorization-grant-type: 'authorization_code'
             redirect-uri: "{baseScheme}://{baseHost}{basePort}{basePath}/login/oauth2/code/authelia"
         provider:
           authelia:
-            issuer-uri: https://auth.example.com
+            issuer-uri: 'https://auth.example.com'
-            user-name-attribute: preferred_username
+            user-name-attribute: 'preferred_username'
 ````
 
 ### Authelia
@@ -74,20 +74,20 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: komga
+    - id: 'komga'
-      description: Komga
+      description: 'Komga'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://komga.example.com/login/oauth2/code/authelia
+        - 'https://komga.example.com/login/oauth2/code/authelia'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - email
+        - 'email'
       grant_types:
-        - authorization_code
+        - 'authorization_code'
-      userinfo_signing_algorithm: none
+      userinfo_signing_algorithm: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/minio/index.md

@@ -72,19 +72,19 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: minio
+    - id: 'minio'
-      description: MinIO
+      description: 'MinIO'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://minio.example.com/apps/oidc_login/oidc
+        - 'https://minio.example.com/apps/oidc_login/oidc'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - email
+        - 'email'
-        - groups
+        - 'groups'
-      userinfo_signing_algorithm: none
+      userinfo_signing_algorithm: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/misago/index.md

@@ -87,23 +87,24 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: misago
+    - id: 'misago'
+      description: 'Misago'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - email
+        - 'email'
       redirect_uris:
-        - https://misago.example.com/oauth2/complete/
+        - 'https://misago.example.com/oauth2/complete/'
       grant_types:
-        - authorization_code
+        - 'authorization_code'
       response_types:
-        - code
+        - 'code'
       response_modes:
-        - query
+        - 'query'
-      userinfo_signing_algorithm: none
+      userinfo_signing_algorithm: 'none'
 ```
 
 ---

docs/content/en/integration/openid-connect/nextcloud/index.md

@@ -95,19 +95,19 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: nextcloud
+    - id: 'nextcloud'
-      description: NextCloud
+      description: 'NextCloud'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://nextcloud.example.com/apps/oidc_login/oidc
+        - 'https://nextcloud.example.com/apps/oidc_login/oidc'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - email
+        - 'email'
-        - groups
+        - 'groups'
-      userinfo_signing_algorithm: none
+      userinfo_signing_algorithm: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/outline/index.md

@@ -69,19 +69,19 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: outline
+    - id: 'outline'
-      description: Outline
+      description: 'Outline'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://outline.example.com/auth/oidc.callback
+        - 'https://outline.example.com/auth/oidc.callback'
       scopes:
-        - openid
+        - 'openid'
-        - offline_access
+        - 'offline_access'
-        - profile
+        - 'profile'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_algorithm: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/portainer/index.md

@@ -70,19 +70,19 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: portainer
+    - id: 'portainer'
-      description: Portainer
+      description: 'Portainer'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://portainer.example.com
+        - 'https://portainer.example.com'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - groups
+        - 'groups'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_algorithm: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/proxmox/index.md

@@ -74,18 +74,18 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: proxmox
+    - id: 'proxmox'
-      description: Proxmox
+      description: 'Proxmox'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://proxmox.example.com
+        - 'https://proxmox.example.com'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_algorithm: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/seafile/index.md

@@ -78,18 +78,18 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: seafile
+    - id: 'seafile'
-      description: Seafile
+      description: 'Seafile'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://seafile.example.com/oauth/callback/
+        - 'https://seafile.example.com/oauth/callback/'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_algorithm: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/synapse/index.md

@@ -72,18 +72,18 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: synapse
+    - id: 'synapse'
-      description: Synapse
+      description: 'Synapse'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://synapse.example.com/_synapse/client/oidc/callback
+        - 'https://synapse.example.com/_synapse/client/oidc/callback'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_algorithm: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/synology-dsm/index.md

@@ -74,19 +74,19 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: synology-dsm
+    - id: 'synology-dsm'
-      description: Synology DSM
+      description: 'Synology DSM'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       public: false
-      authorization_policy: two_factor
+      authorization_policy: 'two_factor'
       redirect_uris:
-        - https://dsm.example.com
+        - 'https://dsm.example.com'
       scopes:
-        - openid
+        - 'openid'
-        - profile
+        - 'profile'
-        - groups
+        - 'groups'
-        - email
+        - 'email'
-      userinfo_signing_algorithm: none
+      userinfo_signing_algorithm: 'none'
 ```
 
 ## See Also

docs/content/en/integration/openid-connect/tailscale/index.md

@@ -84,15 +84,15 @@ identity_providers:
     ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
     ## See: https://www.authelia.com/c/oidc
     clients:
-    - id: tailscale
+    - id: 'tailscale'
-      description: Tailscale SSO
+      description: 'Tailscale'
       secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
       redirect_uris:
-        - https://login.tailscale.com/a/oauth_response
+        - 'https://login.tailscale.com/a/oauth_response'
       scopes:
-        - openid
+        - 'openid'
-        - email
+        - 'email'
-        - profile
+        - 'profile'
 ```
 
 ## See Also

docs/content/en/integration/proxies/caddy.md

@@ -101,7 +101,7 @@ server:
   endpoints:
     authz:
       forward-auth:
-        implementation: ForwardAuth
+        implementation: 'ForwardAuth'
 ```
 
 ## Configuration

docs/content/en/integration/proxies/envoy.md

@@ -75,7 +75,7 @@ server:
   endpoints:
     authz:
       ext-authz:
-        implementation: ExtAuthz
+        implementation: 'ExtAuthz'
 ```
 
 ## Configuration
@@ -97,47 +97,47 @@ Support for [Envoy] is possible with Authelia v4.37.0 and higher via the [Envoy]
 version: "3.8"
 networks:
   net:
-    driver: bridge
+    driver: 'bridge'
 services:
   envoy:
-    container_name: envoy
+    container_name: 'envoy'
-    image: envoyproxy/envoy:v1.24
+    image: 'envoyproxy/envoy:v1.24'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net: {}
     ports:
       - '80:8080'
       - '443:8443'
     volumes:
-      - ${PWD}/data/envoy/envoy.yaml:/etc/envoy/envoy.yaml:ro
+      - '${PWD}/data/envoy/envoy.yaml:/etc/envoy/envoy.yaml:ro'
-      - ${PWD}/data/certificates:/certificates:ro
+      - '${PWD}/data/certificates:/certificates:ro'
   authelia:
-    container_name: authelia
+    container_name: 'authelia'
-    image: authelia/authelia
+    image: 'authelia/authelia'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net: {}
     expose:
       - 9091
     volumes:
-      - ${PWD}/data/authelia/config:/config
+      - '${PWD}/data/authelia/config:/config'
     environment:
-      TZ: "Australia/Melbourne"
+      TZ: 'Australia/Melbourne'
   nextcloud:
-    container_name: nextcloud
+    container_name: 'nextcloud'
-    image: linuxserver/nextcloud
+    image: 'linuxserver/nextcloud'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net: {}
     expose:
       - 443
     volumes:
-      - ${PWD}/data/nextcloud/config:/config
+      - '${PWD}/data/nextcloud/config:/config'
-      - ${PWD}/data/nextcloud/data:/data
+      - '${PWD}/data/nextcloud/data:/data'
     environment:
-      PUID: "1000"
+      PUID: '1000'
-      PGID: "1000"
+      PGID: '1000'
-      TZ: "Australia/Melbourne"
+      TZ: 'Australia/Melbourne'
 ```
 {{< /details >}}
 
@@ -145,92 +145,92 @@ services:
 ```yaml
 static_resources:
   listeners:
-    - name: listener_http
+    - name: 'listener_http'
       address:
         socket_address:
-          address: 0.0.0.0
+          address: '0.0.0.0'
           port_value: 8080
       filter_chains:
         - filters:
-            - name: envoy.filters.network.http_connection_manager
+            - name: 'envoy.filters.network.http_connection_manager'
               typed_config:
-                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                "@type": 'type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager'
-                codec_type: auto
+                codec_type: 'auto'
-                stat_prefix: ingress_http
+                stat_prefix: 'ingress_http'
                 route_config:
-                  name: local_route
+                  name: 'local_route'
                   virtual_hosts:
-                    - name: backend
+                    - name: 'backend'
-                      domains: ["*"]
+                      domains: ['*']
                       routes:
                         - match:
-                            prefix: "/"
+                            prefix: '/'
                           redirect:
                             https_redirect: true
                   http_filters:
-                    - name: envoy.filters.http.router
+                    - name: 'envoy.filters.http.router'
                       typed_config:
-                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+                        "@type": 'type.googleapis.com/envoy.extensions.filters.http.router.v3.Router'
-    - name: listener_https
+    - name: 'listener_https'
       address:
         socket_address:
-          address: 0.0.0.0
+          address: '0.0.0.0'
           port_value: 8443
       filter_chains:
         - filters:
-            - name: envoy.filters.network.http_connection_manager
+            - name: 'envoy.filters.network.http_connection_manager'
               typed_config:
-                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                "@type": 'type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager'
-                stat_prefix: ingress_http
+                stat_prefix: 'ingress_http'
                 use_remote_address: true
                 skip_xff_append: false
                 route_config:
-                  name: local_route
+                  name: 'local_route'
                   virtual_hosts:
-                    - name: whoami_service
+                    - name: 'whoami_service'
                       domains: ["nextcloud.example.com"]
                       routes:
                         - match:
                             prefix: "/"
                           route:
-                            cluster: nextcloud
+                            cluster: 'nextcloud'
-                    - name: authelia_service
+                    - name: 'authelia_service'
-                      domains: ["auth.example.com"]
+                      domains: ['auth.example.com']
                       typed_per_filter_config:
                         envoy.filters.http.ext_authz:
-                          "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
+                          "@type": 'type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute'
                           disabled: true
                       routes:
                         - match:
-                            prefix: "/"
+                            prefix: '/'
                           route:
-                            cluster: authelia
+                            cluster: 'authelia'
                 http_filters:
-                  - name: envoy.filters.http.ext_authz
+                  - name: 'envoy.filters.http.ext_authz'
                     typed_config:
-                      "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
+                      "@type": 'type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz'
-                      transport_api_version: v3
+                      transport_api_version: 'v3'
                       allowed_headers:
                         patterns:
-                          - exact: authorization
+                          - exact: 'authorization'
-                          - exact: proxy-authorization
+                          - exact: 'proxy-authorization'
-                          - exact: accept
+                          - exact: 'accept'
-                          - exact: cookie
+                          - exact: 'cookie'
                       http_service:
-                        path_prefix: /api/authz/ext-authz/
+                        path_prefix: '/api/authz/ext-authz/'
                         server_uri:
-                          uri: authelia:9091
+                          uri: 'authelia:9091'
-                          cluster: authelia
+                          cluster: 'authelia'
-                          timeout: 0.25s
+                          timeout: '0.25s'
                         authorization_request:
                           allowed_headers:
                             patterns:
-                              - exact: authorization
+                              - exact: 'authorization'
-                              - exact: proxy-authorization
+                              - exact: 'proxy-authorization'
-                              - exact: accept
+                              - exact: 'accept'
-                              - exact: cookie
+                              - exact: 'cookie'
                           headers_to_add:
-                            - key: X-Forwarded-Proto
+                            - key: 'X-Forwarded-Proto'
                               value: '%REQ(:SCHEME)%'
                             ## The following commented lines are for configuring the Authelia URL in the proxy. We
                             ## strongly suggest this is configured in the Session Cookies section of the Authelia configuration.
@@ -239,52 +239,52 @@ static_resources:
                         authorization_response:
                           allowed_upstream_headers:
                             patterns:
-                              - exact: authorization
+                              - exact: 'authorization'
-                              - exact: proxy-authorization
+                              - exact: 'proxy-authorization'
-                              - prefix: remote-
+                              - prefix: 'remote-'
-                              - prefix: authelia-
+                              - prefix: 'authelia-'
                           allowed_client_headers:
                             patterns:
-                              - exact: set-cookie
+                              - exact: 'set-cookie'
                           allowed_client_headers_on_success:
                             patterns:
-                              - exact: set-cookie
+                              - exact: 'set-cookie'
                       failure_mode_allow: false
-                  - name: envoy.filters.http.router
+                  - name: 'envoy.filters.http.router'
                     typed_config:
-                      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+                      "@type": 'type.googleapis.com/envoy.extensions.filters.http.router.v3.Router'
   clusters:
-    - name: nextcloud
+    - name: 'nextcloud'
-      connect_timeout: 0.25s
+      connect_timeout: '0.25s'
-      type: logical_dns
+      type: 'logical_dns'
-      dns_lookup_family: v4_only
+      dns_lookup_family: 'v4_only'
-      lb_policy: round_robin
+      lb_policy: 'round_robin'
       load_assignment:
-        cluster_name: nextcloud
+        cluster_name: 'nextcloud'
         endpoints:
           - lb_endpoints:
               - endpoint:
                   address:
                     socket_address:
-                      address: nextcloud
+                      address: 'nextcloud'
                       port_value: 80
-    - name: authelia
+    - name: 'authelia'
-      connect_timeout: 0.25s
+      connect_timeout: '0.25s'
-      type: logical_dns
+      type: 'logical_dns'
-      dns_lookup_family: v4_only
+      dns_lookup_family: 'v4_only'
-      lb_policy: round_robin
+      lb_policy: 'round_robin'
       load_assignment:
-        cluster_name: authelia
+        cluster_name: 'authelia'
         endpoints:
           - lb_endpoints:
               - endpoint:
                   address:
                     socket_address:
-                      address: authelia
+                      address: 'authelia'
                       port_value: 9091
 layered_runtime:
   layers:
-    - name: static_layer_0
+    - name: 'static_layer_0'
       static_layer:
         envoy:
           resource_limits:

docs/content/en/integration/proxies/haproxy.md

@@ -104,7 +104,7 @@ server:
   endpoints:
     authz:
       forward-auth:
-        implementation: ForwardAuth
+        implementation: 'ForwardAuth'
 ```
 
 ## Configuration

docs/content/en/integration/proxies/nginx-proxy-manager/index.md

@@ -75,13 +75,13 @@ version: "3.8"
 
 networks:
   net:
-    driver: bridge
+    driver: 'bridge'
 
 services:
   nginx:
-    container_name: nginx
+    container_name: 'nginx'
-    image: jc21/nginx-proxy-manager
+    image: 'jc21/nginx-proxy-manager'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net:
         aliases: []
@@ -90,44 +90,44 @@ services:
       - '81:81'
       - '443:443'
     volumes:
-      - ${PWD}/data/nginx-proxy-manager/data:/data
+      - '${PWD}/data/nginx-proxy-manager/data:/data'
-      - ${PWD}/data/nginx-proxy-manager/letsencrypt:/etc/letsencrypt
+      - '${PWD}/data/nginx-proxy-manager/letsencrypt:/etc/letsencrypt'
-      - ${PWD}/data/nginx/snippets:/snippets:ro
+      - '${PWD}/data/nginx/snippets:/snippets:ro'
     environment:
       TZ: 'Australia/Melbourne'
   authelia:
-    container_name: authelia
+    container_name: 'authelia'
-    image: authelia/authelia
+    image: 'authelia/authelia'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net:
         aliases: []
     expose:
       - 9091
     volumes:
-      - ${PWD}/data/authelia/config:/config
+      - '${PWD}/data/authelia/config:/config'
     environment:
       TZ: 'Australia/Melbourne'
   nextcloud:
-    container_name: nextcloud
+    container_name: 'nextcloud'
-    image: lscr.io/linuxserver/nextcloud
+    image: 'lscr.io/linuxserver/nextcloud'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net:
         aliases: []
     expose:
       - 443
     volumes:
-      - ${PWD}/data/nextcloud/config:/config
+      - '${PWD}/data/nextcloud/config:/config'
-      - ${PWD}/data/nextcloud/data:/data
+      - '${PWD}/data/nextcloud/data:/data'
     environment:
       PUID: '1000'
       PGID: '1000'
       TZ: 'Australia/Melbourne'
   whoami:
-    container_name: whoami
+    container_name: 'whoami'
-    image: docker.io/traefik/whoami
+    image: 'docker.io/traefik/whoami'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net:
         aliases: []

docs/content/en/integration/proxies/nginx.md

@@ -90,7 +90,7 @@ server:
   endpoints:
     authz:
       auth-request:
-        implementation: AuthRequest
+        implementation: 'AuthRequest'
 ```
 
 ## Docker Compose

docs/content/en/integration/proxies/swag.md

@@ -156,13 +156,13 @@ version: "3.8"
 
 networks:
   net:
-    driver: bridge
+    driver: 'bridge'
 
 services:
   swag:
-    container_name: swag
+    container_name: 'swag'
-    image: lscr.io/linuxserver/swag
+    image: 'lscr.io/linuxserver/swag'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net:
         aliases: []
@@ -170,7 +170,7 @@ services:
       - '80:80'
       - '443:443'
     volumes:
-      - ${PWD}/data/swag:/config
+      - '${PWD}/data/swag:/config'
       ## Uncomment the line below if you want to use the Authelia configuration snippets.
       #- ${PWD}/data/nginx/snippets:/snippets:ro
     environment:
@@ -184,40 +184,40 @@ services:
       ONLY_SUBDOMAINS: 'false'
       STAGING: 'true'
     cap_add:
-      - NET_ADMIN
+      - 'NET_ADMIN'
   authelia:
-    container_name: authelia
+    container_name: 'authelia'
-    image: authelia/authelia
+    image: 'authelia/authelia'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net:
         aliases: []
     expose:
       - 9091
     volumes:
-      - ${PWD}/data/authelia/config:/config
+      - '${PWD}/data/authelia/config:/config'
     environment:
       TZ: 'Australia/Melbourne'
   nextcloud:
-    container_name: nextcloud
+    container_name: 'nextcloud'
-    image: lscr.io/linuxserver/nextcloud
+    image: 'lscr.io/linuxserver/nextcloud'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net:
         aliases: []
     expose:
       - 443
     volumes:
-      - ${PWD}/data/nextcloud/config:/config
+      - '${PWD}/data/nextcloud/config:/config'
-      - ${PWD}/data/nextcloud/data:/data
+      - '${PWD}/data/nextcloud/data:/data'
     environment:
       PUID: '1000'
       PGID: '1000'
       TZ: 'Australia/Melbourne'
   whoami:
-    container_name: whoami
+    container_name: 'whoami'
-    image: docker.io/traefik/whoami
+    image: 'docker.io/traefik/whoami'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net:
         aliases: []

docs/content/en/integration/proxies/traefik.md

@@ -75,7 +75,7 @@ server:
   endpoints:
     authz:
       forward-auth:
-        implementation: ForwardAuth
+        implementation: 'ForwardAuth'
 ```
 
 ## Configuration
@@ -130,9 +130,9 @@ networks:
     driver: bridge
 services:
   traefik:
-    container_name: traefik
+    container_name: 'traefik'
-    image: traefik:v2.9
+    image: 'traefik:v2.9'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     command:
       - '--api=true'
       - '--api.dashboard=true'
@@ -164,11 +164,11 @@ services:
     networks:
       net: {}
     ports:
-      - "80:8080"
+      - '80:8080'
-      - "443:8443"
+      - '443:8443'
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
+      - '/var/run/docker.sock:/var/run/docker.sock'
-      - ${PWD}/data/traefik:/config
+      - '${PWD}/data/traefik:/config'
     labels:
       - 'traefik.enable=true'
       - 'traefik.http.routers.api.rule=Host(`traefik.example.com`)'
@@ -177,15 +177,15 @@ services:
       - 'traefik.http.routers.api.service=api@internal'
       - 'traefik.http.routers.api.middlewares=authelia@docker'
   authelia:
-    container_name: authelia
+    container_name: 'authelia'
-    image: authelia/authelia
+    image: 'authelia/authelia'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net: {}
     expose:
       - 9091
     volumes:
-      - ${PWD}/data/authelia/config:/config
+      - '${PWD}/data/authelia/config:/config'
     environment:
       TZ: "Australia/Melbourne"
     labels:
@@ -200,20 +200,20 @@ services:
       - 'traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader=true'
       - 'traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders=Authorization,Proxy-Authorization,Remote-User,Remote-Groups,Remote-Email,Remote-Name'
   nextcloud:
-    container_name: nextcloud
+    container_name: 'nextcloud'
-    image: linuxserver/nextcloud
+    image: 'linuxserver/nextcloud'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net: {}
     expose:
       - 443
     volumes:
-      - ${PWD}/data/nextcloud/config:/config
+      - '${PWD}/data/nextcloud/config:/config'
-      - ${PWD}/data/nextcloud/data:/data
+      - '${PWD}/data/nextcloud/data:/data'
     environment:
-      PUID: "1000"
+      PUID: '1000'
-      PGID: "1000"
+      PGID: '1000'
-      TZ: "Australia/Melbourne"
+      TZ: 'Australia/Melbourne'
     labels:
       - 'traefik.enable=true'
       - 'traefik.http.routers.nextcloud.rule=Host(`nextcloud.example.com`)'
@@ -221,19 +221,19 @@ services:
       - 'traefik.http.routers.nextcloud.tls=true'
       - 'traefik.http.routers.nextcloud.middlewares=authelia@docker'
   heimdall:
-    container_name: heimdall
+    container_name: 'heimdall'
-    image: linuxserver/heimdall
+    image: 'linuxserver/heimdall'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net: {}
     expose:
       - 443
     volumes:
-      - ${PWD}/data/heimdall/config:/config
+      - '${PWD}/data/heimdall/config:/config'
     environment:
-      PUID: "1000"
+      PUID: '1000'
-      PGID: "1000"
+      PGID: '1000'
-      TZ: "Australia/Melbourne"
+      TZ: 'Australia/Melbourne'
     labels:
       - 'traefik.enable=true'
       - 'traefik.http.routers.heimdall.rule=Host(`heimdall.example.com`)'
@@ -264,12 +264,12 @@ This example uses a `docker-compose.yml` similar to the one above however it has
 version: "3.8"
 networks:
   net:
-    driver: bridge
+    driver: 'bridge'
 services:
   traefik:
-    container_name: traefik
+    container_name: 'traefik'
-    image: traefik:v2.9
+    image: 'traefik:v2.9'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     command:
       - '--api=true'
       - '--api.dashboard=true'
@@ -294,74 +294,74 @@ services:
     networks:
       net: {}
     ports:
-      - "80:8080"
+      - '80:8080'
-      - "443:8443"
+      - '443:8443'
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
+      - '/var/run/docker.sock:/var/run/docker.sock'
-      - ${PWD}/data/traefik/config:/config
+      - '${PWD}/data/traefik/config:/config'
-      - ${PWD}/data/traefik/certificates:/certificates
+      - '${PWD}/data/traefik/certificates:/certificates'
     labels:
       - 'traefik.enable=true'
   authelia:
-    container_name: authelia
+    container_name: 'authelia'
-    image: authelia/authelia
+    image: 'authelia/authelia'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net: {}
     expose:
       - 9091
     volumes:
-      - ${PWD}/data/authelia/config:/config
+      - '${PWD}/data/authelia/config:/config'
-      - ${PWD}/data/authelia/certificates:/certificates
+      - '${PWD}/data/authelia/certificates:/certificates'
     environment:
-      TZ: "Australia/Melbourne"
+      TZ: 'Australia/Melbourne'
     labels:
       - 'traefik.enable=true'
   nextcloud:
-    container_name: nextcloud
+    container_name: 'nextcloud'
-    image: linuxserver/nextcloud
+    image: 'linuxserver/nextcloud'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net: {}
     expose:
       - 443
     volumes:
-      - ${PWD}/data/nextcloud/config:/config
+      - '${PWD}/data/nextcloud/config:/config'
-      - ${PWD}/data/nextcloud/data:/data
+      - '${PWD}/data/nextcloud/data:/data'
     environment:
-      PUID: "1000"
+      PUID: '1000'
-      PGID: "1000"
+      PGID: '1000'
-      TZ: "Australia/Melbourne"
+      TZ: 'Australia/Melbourne'
     labels:
       - 'traefik.enable=true'
   heimdall:
-    container_name: heimdall
+    container_name: 'heimdall'
-    image: linuxserver/heimdall
+    image: 'linuxserver/heimdall'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net: {}
     expose:
       - 443
     volumes:
-      - ${PWD}/data/heimdall/config:/config
+      - '${PWD}/data/heimdall/config:/config'
     environment:
-      PUID: "1000"
+      PUID: '1000'
-      PGID: "1000"
+      PGID: '1000'
-      TZ: "Australia/Melbourne"
+      TZ: 'Australia/Melbourne'
     labels:
       - 'traefik.enable=true'
   whoami:
-    container_name: whoami
+    container_name: 'whoami'
-    image: traefik/whoami:latest
+    image: 'traefik/whoami:latest'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     networks:
       net: {}
     expose:
       - 80
     environment:
-      TZ: "Australia/Melbourne"
+      TZ: 'Australia/Melbourne'
     labels:
-      - "traefik.enable=true"
+      - 'traefik.enable=true'
 ...
 ```
 {{< /details >}}
@@ -391,16 +391,16 @@ entryPoints:
 tls:
   options:
     modern:
-      minVersion: "VersionTLS13"
+      minVersion: 'VersionTLS13'
     intermediate:
-      minVersion: "VersionTLS12"
+      minVersion: 'VersionTLS12'
       cipherSuites:
-        - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
+        - 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256'
-        - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
+        - 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256'
-        - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
+        - 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384'
-        - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
+        - 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384'
-        - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305"
+        - 'TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305'
-        - "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"
+        - 'TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305'
 http:
   middlewares:
     authelia:
@@ -418,9 +418,9 @@ http:
           - 'Remote-Email'
           - 'Remote-Name'
         tls:
-          ca: /certificates/ca.public.crt
+          ca: '/certificates/ca.public.crt'
-          cert: /certificates/traefik.public.crt
+          cert: '/certificates/traefik.public.crt'
-          key: /certificates/traefik.private.pem
+          key: '/certificates/traefik.private.pem'
     authelia-basic:
       forwardAuth:
         address: 'https://authelia:9091/api/verify?auth=basic'
@@ -433,86 +433,86 @@ http:
           - 'Remote-Email'
           - 'Remote-Name'
         tls:
-          ca: /certificates/ca.public.crt
+          ca: '/certificates/ca.public.crt'
-          cert: /certificates/traefik.public.crt
+          cert: '/certificates/traefik.public.crt'
-          key: /certificates/traefik.private.pem
+          key: '/certificates/traefik.private.pem'
   routers:
     traefik:
-      rule: Host(`traefik.example.com`)
+      rule: 'Host(`traefik.example.com`)'
-      entryPoints: websecure
+      entryPoints: 'websecure'
-      service: api@internal
+      service: 'api@internal'
       middlewares:
-        - authelia@file
+        - 'authelia@file'
       tls:
-        options: modern@file
+        options: 'modern@file'
-        certResolver: default
+        certResolver: 'default'
         domains:
-          - main: "example.com"
+          - main: 'example.com'
             sans:
-              - "*.example.com"
+              - '*.example.com'
     whoami:
-      rule: Host(`whoami.example.com`)
+      rule: 'Host(`whoami.example.com`)'
-      entryPoints: websecure
+      entryPoints: 'websecure'
-      service: whoami-net@docker
+      service: 'whoami-net@docker'
       middlewares:
-        - authelia@file
+        - 'authelia@file'
       tls:
-        options: modern@file
+        options: 'modern@file'
-        certResolver: default
+        certResolver: 'default'
         domains:
-          - main: "example.com"
+          - main: 'example.com'
             sans:
-              - "*.example.com"
+              - '*.example.com'
     nextcloud:
-      rule: Host(`nextcloud.example.com`)
+      rule: 'Host(`nextcloud.example.com`)'
-      entryPoints: websecure
+      entryPoints: 'websecure'
-      service: nextcloud-net@docker
+      service: 'nextcloud-net@docker'
       middlewares:
-        - authelia@file
+        - 'authelia@file'
       tls:
-        options: modern@file
+        options: 'modern@file'
-        certResolver: default
+        certResolver: 'default'
         domains:
-          - main: "example.com"
+          - main: 'example.com'
             sans:
-              - "*.example.com"
+              - '*.example.com'
     heimdall:
-      rule: Host(`heimdall.example.com`)
+      rule: 'Host(`heimdall.example.com`)'
-      entryPoints: websecure
+      entryPoints: 'websecure'
-      service: heimdall-net@docker
+      service: 'heimdall-net@docker'
       middlewares:
-        - authelia-basic@file
+        - 'authelia-basic@file'
       tls:
-        options: modern@file
+        options: 'modern@file'
-        certResolver: default
+        certResolver: 'default'
         domains:
-          - main: "example.com"
+          - main: 'example.com'
             sans:
-              - "*.example.com"
+              - '*.example.com'
     authelia:
-      rule: Host(`auth.example.com`)
+      rule: 'Host(`auth.example.com`)'
-      entryPoints: websecure
+      entryPoints: 'websecure'
-      service: authelia@file
+      service: 'authelia@file'
       tls:
-        options: modern@file
+        options: 'modern@file'
-        certResolver: default
+        certResolver: 'default'
         domains:
-          - main: "example.com"
+          - main: 'example.com'
             sans:
-              - "*.example.com"
+              - '*.example.com'
   services:
     authelia:
       loadBalancer:
         servers:
-          - url: https://authelia:9091/
+          - url: 'https://authelia:9091/'
-        serversTransport: autheliaMutualTLS
+        serversTransport: 'autheliaMutualTLS'
   serversTransports:
     autheliaMutualTLS:
       certificates:
-        - certFile: /certificates/traefik.public.crt
+        - certFile: '/certificates/traefik.public.crt'
-          keyFile: /certificates/traefik.private.pem
+          keyFile: '/certificates/traefik.private.pem'
       rootCAs:
-        - /certificates/ca.public.crt
+        - '/certificates/ca.public.crt'
 ...
 ```
 {{< /details >}}

docs/content/en/integration/proxies/traefikv1.md

@@ -88,7 +88,7 @@ server:
   endpoints:
     authz:
       forward-auth:
-        implementation: ForwardAuth
+        implementation: 'ForwardAuth'
 ```
 
 ## Configuration
@@ -119,15 +119,15 @@ version: '3'
 
 networks:
   net:
-    driver: bridge
+    driver: 'bridge'
 services:
   traefik:
-    image: traefik:v1.7.34-alpine
+    image: 'traefik:v1.7.34-alpine'
-    container_name: traefik
+    container_name: 'traefik'
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
+      - '/var/run/docker.sock:/var/run/docker.sock'
     networks:
-      - net
+      - 'net'
     labels:
       - 'traefik.frontend.rule=Host:traefik.example.com'
       - 'traefik.port=8081'
@@ -135,7 +135,7 @@ services:
       - '80:80'
       - '443:443'
       - '8081:8081'
-    restart: unless-stopped
+    restart: 'unless-stopped'
     command:
       - '--api'
       - '--api.entrypoint=api'
@@ -151,27 +151,27 @@ services:
       # - '--entryPoints=Name:https Address::443 TLS ForwardedHeaders.TrustedIPs:10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7 ProxyProtocol.TrustedIPs:10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7'
       - '--entryPoints=Name:api Address::8081'
   authelia:
-    image: authelia/authelia
+    image: 'authelia/authelia'
-    container_name: authelia
+    container_name: 'authelia'
     volumes:
-      - /path/to/authelia:/config
+      - '/path/to/authelia:/config'
     networks:
-      - net
+      - 'net'
     labels:
       - 'traefik.frontend.rule=Host:auth.example.com'
     expose:
       - 9091
-    restart: unless-stopped
+    restart: 'unless-stopped'
     environment:
-      - TZ=Australia/Melbourne
+      TZ: 'Australia/Melbourne'
   nextcloud:
-    image: linuxserver/nextcloud
+    image: 'linuxserver/nextcloud'
-    container_name: nextcloud
+    container_name: 'nextcloud'
     volumes:
-      - /path/to/nextcloud/config:/config
+      - '/path/to/nextcloud/config:/config'
-      - /path/to/nextcloud/data:/data
+      - '/path/to/nextcloud/data:/data'
     networks:
-      - net
+      - 'net'
     labels:
       - 'traefik.frontend.rule=Host:nextcloud.example.com'
       - 'traefik.frontend.auth.forward.address=http://authelia:9091/api/authz/forward-auth'
@@ -182,18 +182,18 @@ services:
       - 'traefik.frontend.auth.forward.authResponseHeaders=Authorization,Proxy-Authorization,Remote-User,Remote-Groups,Remote-Email,Remote-Name'
     expose:
       - 443
-    restart: unless-stopped
+    restart: 'unless-stopped'
     environment:
-      - PUID=1000
+      PUID: '1000'
-      - PGID=1000
+      PGID: '1000'
-      - TZ=Australia/Melbourne
+      TZ: 'Australia/Melbourne'
   heimdall:
-    image: linuxserver/heimdall
+    image: 'linuxserver/heimdall'
-    container_name: heimdall
+    container_name: 'heimdall'
     volumes:
-      - /path/to/heimdall/config:/config
+      - '/path/to/heimdall/config:/config'
     networks:
-      - net
+      - 'net'
     labels:
       - 'traefik.frontend.rule=Host:heimdall.example.com'
       - 'traefik.frontend.auth.forward.address=http://authelia:9091/api/authz/forward-auth/basic'
@@ -201,11 +201,11 @@ services:
       - 'traefik.frontend.auth.forward.authResponseHeaders=Authorization,Proxy-Authorization,Remote-User,Remote-Groups,Remote-Email,Remote-Name'
     expose:
       - 443
-    restart: unless-stopped
+    restart: 'unless-stopped'
     environment:
-      - PUID=1000
+      PUID: '1000'
-      - PGID=1000
+      PGID: '1000'
-      - TZ=Australia/Melbourne
+      TZ: 'Australia/Melbourne'
 ```
 
 ## See Also

docs/content/en/overview/security/measures.md

@@ -160,7 +160,7 @@ values.
 
 As such all SMTP connections require the following:
 
-1. A TLS Connection (STARTTLS or implicit) has been negotiated before authentication or sending emails (_unauthenticated
+1. A TLS Connection (StartTLS or implicit) has been negotiated before authentication or sending emails (_unauthenticated
  connections require it as well_)
 2. Valid X509 Certificate presented to the client during the TLS handshake
 
@@ -207,22 +207,22 @@ for SMTP servers that allow unauthenticated relaying (bad practice).
 
 ### SMTP Ports
 
-All SMTP connections begin as [cleartext], and then negotiate to upgrade to a secure TLS connection via STARTTLS.
+All SMTP connections begin as [cleartext], and then negotiate to upgrade to a secure TLS connection via StartTLS.
 
 The [`submissions` service][service-submissions] (_typically port 465_) is an exception to this rule, where the
-connection begins immediately secured with TLS (_similar to HTTPS_). When the configured [port for
+connection begins immediately secured with TLS (_similar to HTTPS_). When the configured [scheme for
-SMTP][docs-config-smtp-port] is set to `465`, Authelia will initiate TLS connections without requiring STARTTLS
+SMTP][docs-config-smtp-port] is set to `submissions`, Authelia will initiate TLS connections without requiring StartTLS
 negotiation.
 
-When the `submissions` service port is available, it [should be preferred][port-465] over any STARTTLS port for
+When the `submissions` service port is available, it [should be preferred][port-465] over any StartTLS port for
 submitting mail.
 
 **NOTE:** Prior to 2018, port 465 was previously assigned for a similar purpose known as [`smtps`][port-465] (_A TLS
 only equivalent of the `smtp` port 25_), which it had been deprecated for. Port 465 has since been re-assigned for only
 supporting mail submission (_which unlike SMTP transfers via port 25, [requires authentication][smtp-auth]_), similar
-to port 587 (_the `submission` port, a common alternative that uses STARTTLS instead_).
+to port 587 (_the `submission` port, a common alternative that uses StartTLS instead_).
 
-[docs-config-smtp-port]: ../../configuration/notifications/smtp.md#port
+[docs-config-smtp-port]: ../../configuration/notifications/smtp.md#address
 [cleartext]: https://cwe.mitre.org/data/definitions/312.html
 [service-submissions]: https://datatracker.ietf.org/doc/html/rfc8314#section-7.3
 [port-465]: https://datatracker.ietf.org/doc/html/rfc8314#section-3.3

docs/content/en/reference/guides/passwords.md

@@ -26,30 +26,31 @@ The format of the [YAML] file is as follows:
 users:
   john:
     disabled: false
-    displayname: "John Doe"
+    displayname: 'John Doe'
-    password: "$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM"
+    password: '$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM'
-    email: john.doe@authelia.com
+    email: 'john.doe@authelia.com'
     groups:
-      - admins
+      - 'admins'
-      - dev
+      - 'dev'
   harry:
     disabled: false
-    displayname: "Harry Potter"
+    displayname: 'Harry Potter'
-    password: "$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM"
+    password: '$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM'
-    email: harry.potter@authelia.com
+    email: 'harry.potter@authelia.com'
     groups: []
   bob:
     disabled: false
-    displayname: "Bob Dylan"
+    displayname: 'Bob Dylan'
-    password: "$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM"
+    password: '$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM'
-    email: bob.dylan@authelia.com
+    email: 'bob.dylan@authelia.com'
     groups:
-      - dev
+      - 'dev'
   james:
     disabled: false
-    displayname: "James Dean"
+    displayname: 'James Dean'
-    password: "$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM"
+    password: '$argon2id$v=19$m=65536,t=3,p=2$BpLnfgDsc2WD8F2q$o/vzA4myCqZZ36bUGsDY//8mKUYNZZaR0t4MFFSs+iM'
-    email: james.dean@authelia.com
+    email: 'james.dean@authelia.com'
+    groups: []
 ```
 
 ## Passwords

docs/content/en/reference/guides/troubleshooting.md

@@ -2,7 +2,7 @@
 title: "Troubleshooting"
 description: "This guide describes and helps users provide information during troubleshooting including sanitization etc"
 lead: "This guide describes and helps users provide troubleshooting information."
-date: 2023-05-01T11:30:07+10:00
+date: 2023-05-01T12:36:02+10:00
 draft: false
 images: []
 menu:

docs/i18n/en.yaml

@@ -1,19 +1,19 @@
 ---
-- id: get-started
+- id: 'get-started'
-  translation: "Get Started"
+  translation: 'Get Started'
 
-- id: on-this-page
+- id: 'on-this-page'
-  translation: "On this page"
+  translation: 'On this page'
 
-- id: search-text
+- id: 'search-text'
-  translation: "Search..."
+  translation: 'Search...'
 
-- id: 404-title
+- id: '404-title'
-  translation: "Page not found :("
+  translation: 'Page not found :('
 
-- id: 404-text
+- id: '404-text'
   translation: "The page you are looking for doesn't exist or has been moved. If you followed a link to get to this page please report it if it was on this site, the official GitHub repository, or the logs on the latest version."  # yamllint disable-line rule:line-length
 
-- id: browse
+- id: 'browse'
-  translation: "Browse"
+  translation: 'Browse'
 ...

examples/compose/lite/authelia/configuration.yml

@@ -8,8 +8,7 @@ jwt_secret: a_very_important_secret
 default_redirection_url: https://public.example.com
 
 server:
-  host: 0.0.0.0
+  address: 'tcp://:9091'
-  port: 9091
 
 log:
   level: debug

examples/compose/local/authelia/configuration.yml

@@ -7,8 +7,7 @@ jwt_secret: a_very_important_secret
 default_redirection_url: https://public.example.com
 
 server:
-  host: 0.0.0.0
+  address: 'tcp://:9091'
-  port: 9091
 
 log:
   level: debug

internal/authentication/const_test.go

@@ -0,0 +1,24 @@
+package authentication
+
+import (
+	"github.com/authelia/authelia/v4/internal/configuration/schema"
+)
+
+const (
+	testLDAPURL  = "ldap://127.0.0.1:389"
+	testLDAPSURL = "ldaps://127.0.0.1:389"
+)
+
+var (
+	testLDAPAddress  = MustParseAddress(testLDAPURL)
+	testLDAPSAddress = MustParseAddress(testLDAPSURL)
+)
+
+func MustParseAddress(input string) *schema.AddressLDAP {
+	address, err := schema.NewAddress(input)
+	if err != nil {
+		panic(err)
+	}
+
+	return &schema.AddressLDAP{Address: *address}
+}

internal/authentication/ldap_user_provider.go

@@ -107,7 +107,7 @@ func (p *LDAPUserProvider) CheckUserPassword(username string, password string) (
 		return false, err
 	}
 
-	if clientUser, err = p.connectCustom(p.config.URL, profile.DN, password, p.config.StartTLS, p.dialOpts...); err != nil {
+	if clientUser, err = p.connectCustom(p.config.Address.String(), profile.DN, password, p.config.StartTLS, p.dialOpts...); err != nil {
 		return false, fmt.Errorf("authentication failed. Cause: %w", err)
 	}
 
@@ -234,7 +234,7 @@ func (p *LDAPUserProvider) UpdatePassword(username, password string) (err error)
 }
 
 func (p *LDAPUserProvider) connect() (client LDAPClient, err error) {
-	return p.connectCustom(p.config.URL, p.config.User, p.config.Password, p.config.StartTLS, p.dialOpts...)
+	return p.connectCustom(p.config.Address.String(), p.config.User, p.config.Password, p.config.StartTLS, p.dialOpts...)
 }
 
 func (p *LDAPUserProvider) connectCustom(url, username, password string, startTLS bool, opts ...ldap.DialOpt) (client LDAPClient, err error) {

internal/authentication/ldap_user_provider_startup.go

@@ -31,7 +31,7 @@ func (p *LDAPUserProvider) StartupCheck() (err error) {
 			"attribute when users reset their password via Authelia.")
 	}
 
-	if p.features.Extensions.TLS && !p.config.StartTLS && !strings.HasPrefix(p.config.URL, "ldaps://") {
+	if p.features.Extensions.TLS && !p.config.StartTLS && !p.config.Address.IsExplicitlySecure() {
 		p.log.Error("Your LDAP Server supports TLS but you don't appear to be utilizing it. We strongly " +
 			"recommend using the scheme 'ldaps://' or enabling the StartTLS option to secure connections with your " +
 			"LDAP Server.")

internal/authentication/ldap_user_provider_test.go

@@ -25,7 +25,7 @@ func TestShouldCreateRawConnectionWhenSchemeIsLDAP(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:      "ldap://127.0.0.1:389",
+			Address:  testLDAPAddress,
 			User:     "cn=admin,dc=example,dc=com",
 			Password: "password",
 		},
@@ -57,7 +57,7 @@ func TestShouldCreateTLSConnectionWhenSchemeIsLDAPS(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:      "ldaps://127.0.0.1:389",
+			Address:  testLDAPSAddress,
 			User:     "cn=admin,dc=example,dc=com",
 			Password: "password",
 		},
@@ -107,7 +107,7 @@ func TestEscapeSpecialCharsInGroupsFilter(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:          "ldaps://127.0.0.1:389",
+			Address:      testLDAPSAddress,
 			GroupsFilter: "(|(member={dn})(uid={username})(uid={input}))",
 		},
 		false,
@@ -165,7 +165,7 @@ func TestShouldCheckLDAPServerExtensions(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			UsersFilter:          "(|({username_attribute}={input})({mail_attribute}={input}))",
 			UsernameAttribute:    "uid",
@@ -230,7 +230,7 @@ func TestShouldNotCheckLDAPServerExtensionsWhenRootDSEReturnsMoreThanOneEntry(t
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			UsersFilter:          "(|({username_attribute}={input})({mail_attribute}={input}))",
 			UsernameAttribute:    "uid",
@@ -296,7 +296,7 @@ func TestShouldCheckLDAPServerControlTypes(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			UsersFilter:          "(|({username_attribute}={input})({mail_attribute}={input}))",
 			UsernameAttribute:    "uid",
@@ -361,7 +361,7 @@ func TestShouldNotEnablePasswdModifyExtensionOrControlTypes(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			UsersFilter:          "(|({username_attribute}={input})({mail_attribute}={input}))",
 			UsernameAttribute:    "uid",
@@ -426,7 +426,7 @@ func TestShouldReturnCheckServerConnectError(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			UsersFilter:          "(|({username_attribute}={input})({mail_attribute}={input}))",
 			UsernameAttribute:    "uid",
@@ -459,7 +459,7 @@ func TestShouldReturnCheckServerSearchError(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			UsersFilter:          "(|({username_attribute}={input})({mail_attribute}={input}))",
 			UsernameAttribute:    "uid",
@@ -521,7 +521,7 @@ func TestShouldEscapeUserInput(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			UsersFilter:          "(|({username_attribute}={input})({mail_attribute}={input}))",
 			UsernameAttribute:    "uid",
@@ -555,7 +555,7 @@ func TestShouldReturnEmailWhenAttributeSameAsUsername(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "mail",
@@ -626,7 +626,7 @@ func TestShouldReturnUsernameAndBlankDisplayNameWhenAttributesTheSame(t *testing
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -697,7 +697,7 @@ func TestShouldReturnBlankEmailAndDisplayNameWhenAttrsLenZero(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -771,7 +771,7 @@ func TestShouldCombineUsernameFilterAndUsersFilter(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			UsernameAttribute:    "uid",
 			UsersFilter:          "(&({username_attribute}={input})(&(objectCategory=person)(objectClass=user)))",
@@ -822,7 +822,7 @@ func TestShouldNotCrashWhenGroupsAreNotRetrievedFromLDAP(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -895,7 +895,7 @@ func TestShouldNotCrashWhenEmailsAreNotRetrievedFromLDAP(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:               "ldap://127.0.0.1:389",
+			Address:           testLDAPAddress,
 			User:              "cn=admin,dc=example,dc=com",
 			Password:          "password",
 			UsernameAttribute: "uid",
@@ -956,7 +956,7 @@ func TestShouldReturnUsernameFromLDAP(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -1029,7 +1029,7 @@ func TestShouldReturnUsernameFromLDAPWithReferrals(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -1121,7 +1121,7 @@ func TestShouldReturnUsernameFromLDAPWithReferralsInErrorAndResult(t *testing.T)
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -1246,7 +1246,7 @@ func TestShouldReturnUsernameFromLDAPWithReferralsErr(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -1333,7 +1333,7 @@ func TestShouldNotUpdateUserPasswordConnect(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -1400,7 +1400,7 @@ func TestShouldNotUpdateUserPasswordGetDetails(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -1477,7 +1477,7 @@ func TestShouldUpdateUserPassword(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -1585,7 +1585,7 @@ func TestShouldUpdateUserPasswordMSAD(t *testing.T) {
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
 			Implementation:       "activedirectory",
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -1695,7 +1695,7 @@ func TestShouldUpdateUserPasswordMSADWithReferrals(t *testing.T) {
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
 			Implementation:       "activedirectory",
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -1823,7 +1823,7 @@ func TestShouldUpdateUserPasswordMSADWithReferralsWithReferralConnectErr(t *test
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
 			Implementation:       "activedirectory",
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -1942,7 +1942,7 @@ func TestShouldUpdateUserPasswordMSADWithReferralsWithReferralModifyErr(t *testi
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
 			Implementation:       "activedirectory",
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -2074,7 +2074,7 @@ func TestShouldUpdateUserPasswordMSADWithoutReferrals(t *testing.T) {
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
 			Implementation:       "activedirectory",
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -2187,7 +2187,7 @@ func TestShouldUpdateUserPasswordPasswdModifyExtension(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -2294,7 +2294,7 @@ func TestShouldUpdateUserPasswordPasswdModifyExtensionWithReferrals(t *testing.T
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -2421,7 +2421,7 @@ func TestShouldUpdateUserPasswordPasswdModifyExtensionWithoutReferrals(t *testin
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -2534,7 +2534,7 @@ func TestShouldUpdateUserPasswordPasswdModifyExtensionWithReferralsReferralConne
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -2652,7 +2652,7 @@ func TestShouldUpdateUserPasswordPasswdModifyExtensionWithReferralsReferralPassw
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -2784,7 +2784,7 @@ func TestShouldUpdateUserPasswordActiveDirectoryWithServerPolicyHints(t *testing
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
 			Implementation:       "activedirectory",
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "sAMAccountName",
@@ -2895,7 +2895,7 @@ func TestShouldUpdateUserPasswordActiveDirectoryWithServerPolicyHintsDeprecated(
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
 			Implementation:       "activedirectory",
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "sAMAccountName",
@@ -3006,7 +3006,7 @@ func TestShouldUpdateUserPasswordActiveDirectory(t *testing.T) {
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
 			Implementation:       "activedirectory",
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "sAMAccountName",
@@ -3117,7 +3117,7 @@ func TestShouldUpdateUserPasswordBasic(t *testing.T) {
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
 			Implementation:       "custom",
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "uid=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -3224,7 +3224,7 @@ func TestShouldReturnErrorWhenMultipleUsernameAttributes(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -3290,7 +3290,7 @@ func TestShouldReturnErrorWhenZeroUsernameAttributes(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -3356,7 +3356,7 @@ func TestShouldReturnErrorWhenUsernameAttributeNotReturned(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -3418,7 +3418,7 @@ func TestShouldReturnErrorWhenMultipleUsersFound(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -3501,7 +3501,7 @@ func TestShouldReturnErrorWhenNoDN(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -3567,7 +3567,7 @@ func TestShouldCheckValidUserPassword(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -3635,7 +3635,7 @@ func TestShouldNotCheckValidUserPasswordWithConnectError(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -3674,7 +3674,7 @@ func TestShouldCheckInvalidUserPassword(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -3742,7 +3742,7 @@ func TestShouldCallStartTLSWhenEnabled(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -3817,7 +3817,7 @@ func TestShouldParseDynamicConfiguration(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -3866,7 +3866,7 @@ func TestShouldCallStartTLSWithInsecureSkipVerifyWhenSkipVerifyTrue(t *testing.T
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldap://127.0.0.1:389",
+			Address:              testLDAPAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",
@@ -3949,7 +3949,7 @@ func TestShouldReturnLDAPSAlreadySecuredWhenStartTLSAttempted(t *testing.T) {
 
 	provider := NewLDAPUserProviderWithFactory(
 		schema.LDAPAuthenticationBackend{
-			URL:                  "ldaps://127.0.0.1:389",
+			Address:              testLDAPSAddress,
 			User:                 "cn=admin,dc=example,dc=com",
 			Password:             "password",
 			UsernameAttribute:    "uid",

internal/configuration/config.template.yml

@@ -9,14 +9,14 @@
 ## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to
 ## the system certificates store.
 ## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem.
-# certificates_directory: /config/certificates/
+# certificates_directory: '/config/certificates/'
 
 ## The theme to display: light, dark, grey, auto.
-theme: light
+theme: 'light'
 
 ## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be
 ## set using a secret: https://www.authelia.com/c/secrets
-jwt_secret: a_very_important_secret
+jwt_secret: 'a_very_important_secret'
 
 ## Default redirection URL
 ##
@@ -25,28 +25,32 @@ jwt_secret: a_very_important_secret
 ## in such a case.
 ##
 ## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
-default_redirection_url: https://home.example.com/
+default_redirection_url: 'https://home.example.com/'
 
 ## Set the default 2FA method for new users and for when a user has a preferred method configured that has been
 ## disabled. This setting must be a method that is enabled.
 ## Options are totp, webauthn, mobile_push.
-default_2fa_method: ""
+default_2fa_method: ''
 
 ##
 ## Server Configuration
 ##
 server:
-
+  ## The address for the Main server to listen on in the address common syntax.
-  ## The address to listen on. This must be a TCP or unix socket.
+  ## Formats:
-  address: "tcp://:9091"
+  ##  - [<scheme>://]<hostname>[:<port>]
+  ##  - [<scheme>://][hostname]:<port>
+  ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix'.
+  ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '9091'.
+  address: 'tcp://:9091'
 
   ## Set the single level path Authelia listens on.
   ## Must be alphanumeric chars and should not contain any slashes.
-  path: ""
+  path: ''
 
   ## Set the path on disk to Authelia assets.
   ## Useful to allow overriding of specific static assets.
-  # asset_path: /config/assets/
+  # asset_path: '/config/assets/'
 
   ## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0.
   ## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist.
@@ -55,10 +59,10 @@ server:
   ## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour.
   tls:
     ## The path to the DER base64/PEM format private key.
-    key: ""
+    key: ''
 
     ## The path to the DER base64/PEM format public certificate.
-    certificate: ""
+    certificate: ''
 
     ## The list of certificates for client authentication.
     client_certificates: []
@@ -67,7 +71,7 @@ server:
   headers:
 
     ## The CSP Template. Read the docs.
-    csp_template: ""
+    csp_template: ''
 
   ## Server Buffers configuration.
   # buffers:
@@ -87,13 +91,13 @@ server:
   # timeouts:
 
     ## Read timeout.
-    # read: 6s
+    # read: '6s'
 
     ## Write timeout.
-    # write: 6s
+    # write: '6s'
 
     ## Idle timeout.
-    # idle: 30s
+    # idle: '30s'
 
   ## Server Endpoints configuration.
   ## This section is considered advanced and it SHOULD NOT be configured unless you've read the relevant documentation.
@@ -107,16 +111,16 @@ server:
     ## Configure the authz endpoints.
     # authz:
       # forward-auth:
-        # implementation: ForwardAuth
+        # implementation: 'ForwardAuth'
         # authn_strategies: []
       # ext-authz:
-        # implementation: ExtAuthz
+        # implementation: 'ExtAuthz'
         # authn_strategies: []
       # auth-request:
-        # implementation: AuthRequest
+        # implementation: 'AuthRequest'
         # authn_strategies: []
       # legacy:
-        # implementation: Legacy
+        # implementation: 'Legacy'
         # authn_strategies: []
 
 ##
@@ -124,13 +128,13 @@ server:
 ##
 log:
   ## Level of verbosity for logs: info, debug, trace.
-  level: debug
+  level: 'debug'
 
   ## Format the logs are written as: json, text.
-  # format: json
+  # format: 'json'
 
   ## File path where the logs will be written. If not set logs are written to stdout.
-  # file_path: /config/authelia.log
+  # file_path: '/config/authelia.log'
 
   ## Whether to also log to stdout when a log_file_path is defined.
   # keep_stdout: false
@@ -147,8 +151,13 @@ telemetry:
     ## Enable Metrics.
     enabled: false
 
-    ## The address to listen on for metrics. This should be on a different port to the main server.port value.
+    ## The address for the Metrics server to listen on in the address common syntax.
-    address: tcp://0.0.0.0:9959
+    ## Formats:
+    ##  - [<scheme>://]<hostname>[:<port>]
+    ##  - [<scheme>://][hostname]:<port>
+    ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix'.
+    ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '9959'.
+    address: 'tcp://:9959'
 
     ## Metrics Server Buffers configuration.
     # buffers:
@@ -163,13 +172,13 @@ telemetry:
     # timeouts:
 
       ## Read timeout.
-      # read: 6s
+      # read: '6s'
 
       ## Write timeout.
-      # write: 6s
+      # write: '6s'
 
       ## Idle timeout.
-      # idle: 30s
+      # idle: '30s'
 
 ##
 ## TOTP Configuration
@@ -180,12 +189,12 @@ totp:
   disable: false
 
   ## The issuer name displayed in the Authenticator application of your choice.
-  issuer: authelia.com
+  issuer: 'authelia.com'
 
   ## The TOTP algorithm to use.
   ## It is CRITICAL you read the documentation before changing this option:
   ## https://www.authelia.com/c/totp#algorithm
-  algorithm: sha1
+  algorithm: 'sha1'
 
   ## The number of digits a user has to input. Must either be 6 or 8.
   ## Changing this option only affects newly generated TOTP configurations.
@@ -215,18 +224,18 @@ webauthn:
   disable: false
 
   ## Adjust the interaction timeout for WebAuthn dialogues.
-  timeout: 60s
+  timeout: '60s'
 
   ## The display name the browser should show the user for when using WebAuthn to login/register.
-  display_name: Authelia
+  display_name: 'Authelia'
 
   ## Conveyance preference controls if we collect the attestation statement including the AAGUID from the device.
   ## Options are none, indirect, direct.
-  attestation_conveyance_preference: indirect
+  attestation_conveyance_preference: 'indirect'
 
   ## User verification controls if the user must make a gesture or action to confirm they are present.
   ## Options are required, preferred, discouraged.
-  user_verification: preferred
+  user_verification: 'preferred'
 
 ##
 ## Duo Push API Configuration
@@ -235,10 +244,10 @@ webauthn:
 ## "Partner Auth API" in the management panel.
 # duo_api:
   # disable: false
-  # hostname: api-123456789.example.com
+  # hostname: 'api-123456789.example.com'
-  # integration_key: ABCDEF
+  # integration_key: 'ABCDEF'
   ## Secret can also be set using a secret: https://www.authelia.com/c/secrets
-  # secret_key: 1234567890abcdefghifjkl
+  # secret_key: '1234567890abcdefghifjkl'
   # enable_self_enrollment: false
 
 ##
@@ -246,14 +255,17 @@ webauthn:
 ##
 ## This is used to validate the servers time is accurate enough to validate TOTP.
 ntp:
-  ## NTP server address.
+  ## The address of the NTP server to connect to in the address common syntax.
-  address: "time.cloudflare.com:123"
+  ## Format: [<scheme>://]<hostname>[:<port>].
+  ## Square brackets indicate optional portions of the format. Scheme must be 'udp', 'udp4', or 'udp6'.
+  ## The default scheme is 'udp'. The default port is '123'.
+  address: 'udp://time.cloudflare.com:123'
 
   ## NTP version.
   version: 4
 
-  ## Maximum allowed time offset between the host and the NTP server.
+  ## Maximum allowed time offset between the host and the NTP server in duration common syntax.
-  max_desync: 3s
+  max_desync: '3s'
 
   ## Disables the NTP check on startup entirely. This means Authelia will not contact a remote service at all if you
   ## set this to true, and can operate in a truly offline mode.
@@ -279,14 +291,14 @@ authentication_backend:
 
     ## External reset password url that redirects the user to an external reset portal. This disables the internal reset
     ## functionality.
-    custom_url: ""
+    custom_url: ''
 
   ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation.
   ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
   ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
   ## To force update on every request you can set this to '0' or 'always', this will increase processor demand.
   ## See the below documentation for more information.
-  ## Duration Notation docs:  https://www.authelia.com/c/common#duration-notation-format
+  ## Duration Notation docs:  https://www.authelia.com/c/common#duration
   ## Refresh Interval docs: https://www.authelia.com/c/1fa#refresh-interval
   refresh_interval: 5m
 
@@ -297,6 +309,13 @@ authentication_backend:
   ## because it allows Authelia to offload the stateful operations
   ## onto the LDAP service.
   # ldap:
+    ## The address of the LDAP server to connect to in the address common syntax.
+    ## Format: [<scheme>://]<hostname>[:<port>].
+    ## Square brackets indicate optional portions of the format. Scheme must be 'ldap', 'ldaps', or 'ldapi`.
+    ## The default scheme is 'ldapi' if the address is an absolute path otherwise it's 'ldaps'.
+    ## The default port is '636', unless the scheme is 'ldap' in which case it's '389'.
+    # address: 'ldaps://127.0.0.1:636'
+
     ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
     ## Acceptable options are as follows:
     ## - 'activedirectory' - for Microsoft Active Directory.
@@ -308,22 +327,18 @@ authentication_backend:
     ## Depending on the option here certain other values in this section have a default value, notably all of the
     ## attribute mappings have a default value that this config overrides, you can read more about these default values
     ## at https://www.authelia.com/c/ldap#defaults
-    # implementation: custom
+    # implementation: 'custom'
 
-    ## The url to the ldap server. Format: <scheme>://<address>[:<port>].
+    ## The dial timeout for LDAP in the duration common syntax.
-    ## Scheme can be ldap or ldaps in the format (port optional).
+    # timeout: '5s'
-    # url: ldap://127.0.0.1
-
-    ## The dial timeout for LDAP.
-    # timeout: 5s
 
     ## Use StartTLS with the LDAP connection.
     # start_tls: false
 
     # tls:
       ## The server subject name to check the servers certificate against during the validation process.
-      ## This option is not required if the certificate has a SAN which matches the host portion of the url option.
+      ## This option is not required if the certificate has a SAN which matches the address options hostname.
-      # server_name: ldap.example.com
+      # server_name: 'ldap.example.com'
 
       ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
       ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
@@ -334,10 +349,10 @@ authentication_backend:
       # skip_verify: false
 
       ## Minimum TLS version for the connection.
-      # minimum_version: TLS1.2
+      # minimum_version: 'TLS1.2'
 
       ## Maximum TLS version for the connection.
-      # maximum_version: TLS1.3
+      # maximum_version: 'TLS1.3'
 
       ## The certificate chain used with the private_key if the server requests TLS Client Authentication
       ## i.e. Mutual TLS.
@@ -414,7 +429,7 @@ authentication_backend:
 
     ## The distinguished name of the container searched for objects in the directory information tree.
     ## See also: additional_users_dn, additional_groups_dn.
-    # base_dn: dc=example,dc=com
+    # base_dn: 'dc=example,dc=com'
 
     ## The attribute holding the username of the user. This attribute is used to populate the username in the session
     ## information. For your information, Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually
@@ -424,11 +439,11 @@ authentication_backend:
     ## non-unique attributes like 'mail' can also be used but we don't recommend using them, we instead advise to use
     ## a filter to perform alternative lookups and the attributes mentioned above (sAMAccountName and uid) to
     ## follow https://datatracker.ietf.org/doc/html/rfc2307.
-    # username_attribute: uid
+    # username_attribute: 'uid'
 
     ## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users.
     ## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users.
-    # additional_users_dn: ou=users
+    # additional_users_dn: 'ou=users'
 
     ## The users filter used in search queries to find the user profile based on input filled in login form.
     ## Various placeholders are available in the user filter which you can read about in the documentation which can
@@ -442,11 +457,11 @@ authentication_backend:
     ##
     ## To allow sign in both with username and email, one can use a filter like
     ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
-    # users_filter: (&({username_attribute}={input})(objectClass=person))
+    # users_filter: '(&({username_attribute}={input})(objectClass=person))'
 
     ## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups.
     ## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups.
-    # additional_groups_dn: ou=groups
+    # additional_groups_dn: 'ou=groups'
 
     ## The groups filter used in search queries to find the groups based on relevant authenticated user.
     ## Various placeholders are available in the groups filter which you can read about in the documentation which can
@@ -454,17 +469,17 @@ authentication_backend:
     ##
     ## If your groups use the `groupOfUniqueNames` structure use this instead:
     ##    (&(uniqueMember={dn})(objectClass=groupOfUniqueNames))
-    # groups_filter: (&(member={dn})(objectClass=groupOfNames))
+    # groups_filter: '(&(member={dn})(objectClass=groupOfNames))'
 
     ## The attribute holding the name of the group.
-    # group_name_attribute: cn
+    # group_name_attribute: 'cn'
 
     ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
     ## first one returned by the LDAP server is used.
-    # mail_attribute: mail
+    # mail_attribute: 'mail'
 
     ## The attribute holding the display name of the user. This will be used to greet an authenticated user.
-    # display_name_attribute: displayName
+    # display_name_attribute: 'displayName'
 
     ## Follow referrals returned by the server.
     ## This is especially useful for environments where read-only servers exist. Only implemented for write operations.
@@ -473,7 +488,7 @@ authentication_backend:
     ## The username and password of the admin user.
     # user: cn=admin,dc=example,dc=com
     ## Password can also be set using a secret: https://www.authelia.com/c/secrets
-    # password: password
+    # password: 'password'
 
   ##
   ## File (Authentication Provider)
@@ -488,15 +503,15 @@ authentication_backend:
   ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
   ##
   # file:
-    # path: /config/users_database.yml
+    # path: '/config/users_database.yml'
     # watch: false
     # search:
       # email: false
       # case_insensitive: false
     # password:
-      # algorithm: argon2
+      # algorithm: 'argon2'
       # argon2:
-        # variant: argon2id
+        # variant: 'argon2id'
         # iterations: 3
         # memory: 65536
         # parallelism: 4
@@ -509,15 +524,15 @@ authentication_backend:
         # key_length: 32
         # salt_length: 16
       # pbkdf2:
-        # variant: sha512
+        # variant: 'sha512'
         # iterations: 310000
         # salt_length: 16
       # sha2crypt:
-        # variant: sha512
+        # variant: 'sha512'
         # iterations: 50000
         # salt_length: 16
       # bcrypt:
-        # variant: standard
+        # variant: 'standard'
         # cost: 12
 
 ##
@@ -601,91 +616,91 @@ privacy_policy:
 access_control:
   ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
   ## resource if there is no policy to be applied to the user.
-  default_policy: deny
+  default_policy: 'deny'
 
   # networks:
-    # - name: internal
+    # - name: 'internal'
     #   networks:
-        # - 10.10.0.0/16
+        # - '10.10.0.0/16'
-        # - 192.168.2.0/24
+        # - '192.168.2.0/24'
     # - name: VPN
-    #   networks: 10.9.0.0/16
+    #   networks: '10.9.0.0/16'
 
   # rules:
     ## Rules applied to everyone
     # - domain: 'public.example.com'
-    #   policy: bypass
+    #   policy: 'bypass'
 
     ## Domain Regex examples. Generally we recommend just using a standard domain.
     # - domain_regex: '^(?P<User>\w+)\.example\.com$'
-    #   policy: one_factor
+    #   policy: 'one_factor'
     # - domain_regex: '^(?P<Group>\w+)\.example\.com$'
-    #   policy: one_factor
+    #   policy: 'one_factor'
     # - domain_regex:
       #  - '^appgroup-.*\.example\.com$'
       #  - '^appgroup2-.*\.example\.com$'
-    #   policy: one_factor
+    #   policy: 'one_factor'
     # - domain_regex: '^.*\.example\.com$'
-    #   policy: two_factor
+    #   policy: 'two_factor'
 
     # - domain: 'secure.example.com'
-    #   policy: one_factor
+    #   policy: 'one_factor'
     ## Network based rule, if not provided any network matches.
     #   networks:
-        # - internal
+        # - 'internal'
-        # - VPN
+        # - 'VPN'
-        # - 192.168.1.0/24
+        # - '192.168.1.0/24'
-        # - 10.0.0.1
+        # - '10.0.0.1'
 
     # - domain:
         # - 'secure.example.com'
         # - 'private.example.com'
-    #   policy: two_factor
+    #   policy: 'two_factor'
 
     # - domain: 'singlefactor.example.com'
-    #   policy: one_factor
+    #   policy: 'one_factor'
 
     ## Rules applied to 'admins' group
     # - domain: 'mx2.mail.example.com'
     #   subject: 'group:admins'
-    #   policy: deny
+    #   policy: 'deny'
 
     # - domain: '*.example.com'
     #   subject:
         # - 'group:admins'
         # - 'group:moderators'
-    #   policy: two_factor
+    #   policy: 'two_factor'
 
     ## Rules applied to 'dev' group
     # - domain: 'dev.example.com'
     #   resources:
         # - '^/groups/dev/.*$'
     #   subject: 'group:dev'
-    #   policy: two_factor
+    #   policy: 'two_factor'
 
     ## Rules applied to user 'john'
     # - domain: 'dev.example.com'
     #   resources:
         # - '^/users/john/.*$'
     #   subject: 'user:john'
-    #   policy: two_factor
+    #   policy: 'two_factor'
 
     ## Rules applied to user 'harry'
     # - domain: 'dev.example.com'
     #   resources:
         # - '^/users/harry/.*$'
     #   subject: 'user:harry'
-    #   policy: two_factor
+    #   policy: 'two_factor'
 
     ## Rules applied to user 'bob'
     # - domain: '*.mail.example.com'
     #   subject: 'user:bob'
-    #   policy: two_factor
+    #   policy: 'two_factor'
     # - domain: 'dev.example.com'
     #   resources:
     #     - '^/users/bob/.*$'
     #   subject: 'user:bob'
-    #   policy: two_factor
+    #   policy: 'two_factor'
 
 ##
 ## Session Provider Configuration
@@ -720,8 +735,8 @@ session:
       ## Please read https://www.authelia.com/c/session#same_site
       # same_site: 'lax'
 
-      ## The value for inactivity, expiration, and remember_me are in seconds or the duration notation format.
+      ## The value for inactivity, expiration, and remember_me are in seconds or the duration common syntax.
-      ## See: https://www.authelia.com/c/common#duration-notation-format
+      ## See: https://www.authelia.com/c/common#duration
       ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure
       ## because a stolen cookie will last longer giving attackers more time to spy or attack.
 
@@ -745,8 +760,8 @@ session:
   ## or strict. Please read https://www.authelia.com/c/session#same_site
   same_site: 'lax'
 
-  ## The value for inactivity, expiration, and remember_me are in seconds or the duration notation format.
+  ## The value for inactivity, expiration, and remember_me are in seconds or the duration common syntax.
-  ## See: https://www.authelia.com/c/common#duration-notation-format
+  ## See: https://www.authelia.com/c/common#duration
   ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure
   ## because a stolen cookie will last longer giving attackers more time to spy or attack.
 
@@ -770,16 +785,16 @@ session:
   ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
   ##
   # redis:
-    # host: 127.0.0.1
+    # host: '127.0.0.1'
     # port: 6379
     ## Use a unix socket instead
-    # host: /var/run/redis/redis.sock
+    # host: '/var/run/redis/redis.sock'
 
     ## Username used for redis authentication. This is optional and a new feature in redis 6.0.
-    # username: authelia
+    # username: 'authelia'
 
     ## Password can also be set using a secret: https://www.authelia.com/c/secrets
-    # password: authelia
+    # password: 'authelia'
 
     ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
     # database_index: 0
@@ -794,7 +809,7 @@ session:
     # tls:
       ## The server subject name to check the servers certificate against during the validation process.
       ## This option is not required if the certificate has a SAN which matches the host option.
-      # server_name: myredis.example.com
+      # server_name: 'myredis.example.com'
 
       ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
       ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
@@ -805,10 +820,10 @@ session:
       # skip_verify: false
 
       ## Minimum TLS version for the connection.
-      # minimum_version: TLS1.2
+      # minimum_version: 'TLS1.2'
 
       ## Maximum TLS version for the connection.
-      # maximum_version: TLS1.3
+      # maximum_version: 'TLS1.3'
 
       ## The certificate chain used with the private_key if the server requests TLS Client Authentication
       ## i.e. Mutual TLS.
@@ -887,21 +902,21 @@ session:
     ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
     # high_availability:
       ## Sentinel Name / Master Name.
-      # sentinel_name: mysentinel
+      # sentinel_name: 'mysentinel'
 
       ## Specific username for Redis Sentinel. The node username and password is configured above.
-      # sentinel_username: sentinel_specific_user
+      # sentinel_username: 'sentinel_specific_user'
 
       ## Specific password for Redis Sentinel. The node username and password is configured above.
-      # sentinel_password: sentinel_specific_pass
+      # sentinel_password: 'sentinel_specific_pass'
 
       ## The additional nodes to pre-seed the redis provider with (for sentinel).
       ## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
       ## For high availability to be used you must have either defined; the host above or at least one node below.
       # nodes:
-        # - host: sentinel-node1
+        # - host: 'sentinel-node1'
         #   port: 6379
-        # - host: sentinel-node2
+        # - host: 'sentinel-node2'
         #   port: 6379
 
       ## Choose the host with the lowest latency.
@@ -919,14 +934,12 @@ regulation:
   ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
   max_retries: 3
 
-  ## The time range during which the user can attempt login before being banned. The user is banned if the
+  ## The time range in duration common syntax during which the user can attempt login before being banned. The user is
-  ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.
+  ## banned if the authentication failed 'max_retries' times in a 'find_time' seconds window.
-  ## See: https://www.authelia.com/c/common#duration-notation-format
+  find_time: '2m'
-  find_time: 2m
 
-  ## The length of time before a banned user can login again. Ban Time accepts duration notation.
+  ## The length of time in duration common syntax before a banned user can login again.
-  ## See: https://www.authelia.com/c/common#duration-notation-format
+  ban_time: '5m'
-  ban_time: 5m
 
 ##
 ## Storage Provider Configuration
@@ -936,7 +949,7 @@ regulation:
   ## The encryption key that is used to encrypt sensitive information in the database. Must be a string with a minimum
   ## length of 20. Please see the docs if you configure this with an undesirable key and need to change it, you MUST use
   ## the CLI to change this in the database if you want to change it from a previously configured value.
-  # encryption_key: you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this
+  # encryption_key: 'you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this'
 
   ##
   ## Local (Storage Provider)
@@ -948,25 +961,36 @@ regulation:
   ##
   # local:
     ## Path to the SQLite3 Database.
-    # path: /config/db.sqlite3
+    # path: '/config/db.sqlite3'
 
   ##
   ## MySQL / MariaDB (Storage Provider)
   ##
   # mysql:
-    # host: 127.0.0.1
+    ## The address of the MySQL server to connect to in the address common syntax.
-    # port: 3306
+    ## Format: [<scheme>://]<hostname>[:<port>].
-    # database: authelia
+    ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix`.
-    # username: authelia
+    ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '3306'.
-    ## Password can also be set using a secret: https://www.authelia.com/c/secrets
+    # address: 'tcp://127.0.0.1:3306'
-    # password: mypassword
+
-    # timeout: 5s
+    ## The database name to use.
+    # database: 'authelia'
+
+    ## The username used for SQL authentication.
+    # username: 'authelia'
+
+    ## The password used for SQL authentication.
+    ## Can also be set using a secret: https://www.authelia.com/c/secrets
+    # password: 'mypassword'
+
+    ## The connection timeout in the duration common syntax.
+    # timeout: '5s'
 
     ## MySQL TLS settings. Configuring this requires TLS.
     # tls:
       ## The server subject name to check the servers certificate against during the validation process.
-      ## This option is not required if the certificate has a SAN which matches the host option.
+      ## This option is not required if the certificate has a SAN which matches the address options hostname.
-      # server_name: mysql.example.com
+      # server_name: 'mysql.example.com'
 
       ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
       ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
@@ -977,10 +1001,10 @@ regulation:
       # skip_verify: false
 
       ## Minimum TLS version for the connection.
-      # minimum_version: TLS1.2
+      # minimum_version: 'TLS1.2'
 
       ## Maximum TLS version for the connection.
-      # maximum_version: TLS1.3
+      # maximum_version: 'TLS1.3'
 
       ## The certificate chain used with the private_key if the server requests TLS Client Authentication
       ## i.e. Mutual TLS.
@@ -1059,20 +1083,33 @@ regulation:
   ## PostgreSQL (Storage Provider)
   ##
   # postgres:
-    # host: 127.0.0.1
+    ## The address of the PostgreSQL server to connect to in the address common syntax.
-    # port: 5432
+    ## Format: [<scheme>://]<hostname>[:<port>].
-    # database: authelia
+    ## Square brackets indicate optional portions of the format. Scheme must be 'tcp', 'tcp4', 'tcp6', or 'unix`.
-    # schema: public
+    ## The default scheme is 'unix' if the address is an absolute path otherwise it's 'tcp'. The default port is '5432'.
-    # username: authelia
+    # address: 'tcp://127.0.0.1:5432'
-    ## Password can also be set using a secret: https://www.authelia.com/c/secrets
+
-    # password: mypassword
+    ## The database name to use.
-    # timeout: 5s
+    # database: 'authelia'
+
+    ## The schema name to use.
+    # schema: 'public'
+
+    ## The username used for SQL authentication.
+    # username: 'authelia'
+
+    ## The password used for SQL authentication.
+    ## Can also be set using a secret: https://www.authelia.com/c/secrets
+    # password: 'mypassword'
+
+    ## The connection timeout in the duration common syntax.
+    # timeout: '5s'
 
     ## PostgreSQL TLS settings. Configuring this requires TLS.
     # tls:
       ## The server subject name to check the servers certificate against during the validation process.
-      ## This option is not required if the certificate has a SAN which matches the host option.
+      ## This option is not required if the certificate has a SAN which matches the address options hostname.
-      # server_name: postgres.example.com
+      # server_name: 'postgres.example.com'
 
       ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
       ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
@@ -1083,10 +1120,10 @@ regulation:
       # skip_verify: false
 
       ## Minimum TLS version for the connection.
-      # minimum_version: TLS1.2
+      # minimum_version: 'TLS1.2'
 
       ## Maximum TLS version for the connection.
-      # maximum_version: TLS1.3
+      # maximum_version: 'TLS1.3'
 
       ## The certificate chain used with the private_key if the server requests TLS Client Authentication
       ## i.e. Mutual TLS.
@@ -1176,7 +1213,7 @@ notifier:
   ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
   ##
   # filesystem:
-    # filename: /config/notification.txt
+    # filename: '/config/notification.txt'
 
   ##
   ## SMTP (Notification Provider)
@@ -1189,36 +1226,33 @@ notifier:
   ##   - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates
   ##     (configure in tls section)
   # smtp:
-    ## The SMTP host to connect to.
+    ## The address of the SMTP server to connect to in the address common syntax.
-    # host: 127.0.0.1
+    # address: 'smtp://127.0.0.1:25'
 
-    ## The port to connect to the SMTP host on.
+    ## The connection timeout in the duration common syntax.
-    # port: 1025
+    # timeout: '5s'
-
-    ## The connection timeout.
-    # timeout: 5s
 
     ## The username used for SMTP authentication.
-    # username: test
+    # username: 'test'
 
     ## The password used for SMTP authentication.
     ## Can also be set using a secret: https://www.authelia.com/c/secrets
-    # password: password
+    # password: 'password'
 
     ## The sender is used to is used for the MAIL FROM command and the FROM header.
     ## If this is not defined and the username is an email, we use the username as this value. This can either be just
     ## an email address or the RFC5322 'Name <email address>' format.
-    # sender: "Authelia <admin@example.com>"
+    # sender: 'Authelia <admin@example.com>'
 
     ## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost.
-    # identifier: localhost
+    # identifier: 'localhost'
 
     ## Subject configuration of the emails sent. {title} is replaced by the text from the notifier.
-    # subject: "[Authelia] {title}"
+    # subject: '[Authelia] {title}'
 
     ## This address is used during the startup check to verify the email configuration is correct.
     ## It's not important what it is except if your email server only allows local delivery.
-    # startup_check_address: test@authelia.com
+    # startup_check_address: 'test@authelia.com'
 
     ## By default we require some form of TLS. This disables this check though is not advised.
     # disable_require_tls: false
@@ -1228,8 +1262,8 @@ notifier:
 
     # tls:
       ## The server subject name to check the servers certificate against during the validation process.
-      ## This option is not required if the certificate has a SAN which matches the host option.
+      ## This option is not required if the certificate has a SAN which matches the address options hostname.
-      # server_name: smtp.example.com
+      # server_name: 'smtp.example.com'
 
       ## Skip verifying the server certificate entirely. In preference to setting this we strongly recommend you add the
       ## certificate or the certificate of the authority signing the certificate to the certificates directory which is
@@ -1240,10 +1274,10 @@ notifier:
       # skip_verify: false
 
       ## Minimum TLS version for the connection.
-      # minimum_version: TLS1.2
+      # minimum_version: 'TLS1.2'
 
       ## Maximum TLS version for the connection.
-      # maximum_version: TLS1.3
+      # maximum_version: 'TLS1.3'
 
       ## The certificate chain used with the private_key if the server requests TLS Client Authentication
       ## i.e. Mutual TLS.
@@ -1331,7 +1365,7 @@ notifier:
   # oidc:
     ## The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens).
     ## HMAC Secret can also be set using a secret: https://www.authelia.com/c/secrets
-    # hmac_secret: this_is_a_secret_abc123abc123abc
+    # hmac_secret: 'this_is_a_secret_abc123abc123abc'
 
     ## The issuer_certificate_chain is an optional PEM encoded certificate chain. It's used in conjunction with the
     ## issuer_private_key to sign JWT's. All certificates in the chain must be within the validity period, and every
@@ -1408,10 +1442,10 @@ notifier:
       # -----END RSA PRIVATE KEY-----
 
     ## The lifespans configure the expiration for these token types.
-    # access_token_lifespan: 1h
+    # access_token_lifespan: '1h'
-    # authorize_code_lifespan: 1m
+    # authorize_code_lifespan: '1m'
-    # id_token_lifespan: 1h
+    # id_token_lifespan: '1h'
-    # refresh_token_lifespan: 90m
+    # refresh_token_lifespan: '90m'
 
     ## Enables additional debug messages.
     # enable_client_debug_messages: false
@@ -1421,23 +1455,23 @@ notifier:
 
     ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it set to 'never'
     ## for security reasons.
-    # enforce_pkce: public_clients_only
+    # enforce_pkce: 'public_clients_only'
 
     ## Cross-Origin Resource Sharing (CORS) settings.
     # cors:
       ## List of endpoints in addition to the metadata endpoints to permit cross-origin requests on.
       # endpoints:
-        #  - authorization
+        #  - 'authorization'
-        #  - token
+        #  - 'token'
-        #  - revocation
+        #  - 'revocation'
-        #  - introspection
+        #  - 'introspection'
-        #  - userinfo
+        #  - 'userinfo'
 
       ## List of allowed origins.
       ## Any origin with https is permitted unless this option is configured or the
       ## allowed_origins_from_client_redirect_uris option is enabled.
       # allowed_origins:
-        # - https://example.com
+        # - 'https://example.com'
 
       ## Automatically adds the origin portion of all redirect URI's on all clients to the list of allowed_origins,
       ## provided they have the scheme http or https and do not have the hostname of localhost.
@@ -1447,71 +1481,72 @@ notifier:
     # clients:
       # -
         ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
-        # id: myapp
+        # id: 'myapp'
 
         ## The description to show to users when they end up on the consent screen. Defaults to the ID above.
-        # description: My Application
+        # description: 'My Application'
 
         ## The client secret is a shared secret between Authelia and the consumer of this client.
-        # secret: this_is_a_secret
+        # yamllint disable-line rule:line-length
+        # secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'  # The digest of 'insecure_secret'.
 
         ## Sector Identifiers are occasionally used to generate pairwise subject identifiers. In most cases this is not
         ## necessary. Read the documentation for more information.
         ## The subject identifier must be the host component of a URL, which is a domain name with an optional port.
-        # sector_identifier: example.com
+        # sector_identifier: 'example.com'
 
         ## Sets the client to public. This should typically not be set, please see the documentation for usage.
         # public: false
 
         ## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
         # redirect_uris:
-        # - https://oidc.example.com:8080/oauth2/callback
+        # - 'https://oidc.example.com:8080/oauth2/callback'
 
         ## Audience this client is allowed to request.
         # audience: []
 
         ## Scopes this client is allowed to request.
         # scopes:
-          # - openid
+          # - 'openid'
-          # - groups
+          # - 'groups'
-          # - email
+          # - 'email'
-          # - profile
+          # - 'profile'
 
         ## Response Types configures which responses this client can be sent.
         ## It's not recommended to define this unless you know what you're doing.
         # response_types:
-          # - code
+          # - 'code'
 
         ## Response Modes configures which response modes this client supports.
         # response_modes:
-          # - form_post
+          # - 'form_post'
-          # - query
+          # - 'query'
 
         ## Grant Types configures which grants this client can obtain.
         ## It's not recommended to define this unless you know what you're doing.
         # grant_types:
-        # - authorization_code
+        # - 'authorization_code'
 
         ## The permitted client authentication method for the Token Endpoint for this client.
-        # token_endpoint_auth_method: client_secret_basic
+        # token_endpoint_auth_method: 'client_secret_basic'
 
         ## The policy to require for this client; one_factor or two_factor.
-        # authorization_policy: two_factor
+        # authorization_policy: 'two_factor'
 
         ## Enforces the use of PKCE for this client when set to true.
         # enforce_pkce: false
 
         ## Enforces the use of PKCE for this client when configured, and enforces the specified challenge method.
         ## Options are 'plain' and 'S256'.
-        # pkce_challenge_method: S256
+        # pkce_challenge_method: 'S256'
 
         ## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
-        # userinfo_signing_algorithm: none
+        # userinfo_signing_algorithm: 'none'
 
         ## The consent mode controls how consent is obtained.
-        # consent_mode: auto
+        # consent_mode: 'auto'
 
         ## This value controls the duration a consent on this client remains remembered when the consent mode is
         ## configured as 'auto' or 'pre-configured'.
-        # pre_configured_consent_duration: 1w
+        # pre_configured_consent_duration: '1w'
 ...

internal/configuration/decode_hooks.go

@@ -300,7 +300,7 @@ func StringToAddressHookFunc() mapstructure.DecodeHookFuncType {
 
 			return schema.AddressUDP{Address: *result}, nil
 		case expectedTypeLDAP:
-			if result, err = schema.NewAddressDefault(dataStr, schema.AddressSchemeLDAP, schema.AddressSchemeLDAPI); err != nil {
+			if result, err = schema.NewAddressDefault(dataStr, schema.AddressSchemeLDAPS, schema.AddressSchemeLDAPI); err != nil {
 				return nil, fmt.Errorf(errFmtDecodeHookCouldNotParse, dataStr, prefixType, expectedType, err)
 			}
 

internal/configuration/decode_hooks_test.go

@@ -838,7 +838,7 @@ func TestStringToAddressHookFunc(t *testing.T) {
 			name:     "ShouldFailDecode",
 			have:     "tcp://&!@^#*&!@#&*@!:2020",
 			expected: schema.Address{},
-			err:      "could not decode 'tcp://&!@^#*&!@#&*@!:2020' to a schema.Address: could not parse string 'tcp://&!@^#*&!@#&*@!:2020' as address: expected format is [<scheme>://]<ip>[:<port>]: parse \"tcp://&!@^\": invalid character \"^\" in host name",
+			err:      "could not decode 'tcp://&!@^#*&!@#&*@!:2020' to a schema.Address: could not parse string 'tcp://&!@^#*&!@#&*@!:2020' as address: expected format is [<scheme>://]<hostname>[:<port>]: parse \"tcp://&!@^\": invalid character \"^\" in host name",
 			decode:   false,
 		},
 	}

internal/configuration/deprecation.go

@@ -13,6 +13,7 @@ type Deprecation struct {
 	Key     string
 	NewKey  string
 	AutoMap bool
+	Keep    bool
 	MapFunc func(value any) any
 	ErrFunc func(d Deprecation, keysFinal map[string]any, value any, val *schema.StructValidator)
 }
@@ -183,9 +184,10 @@ var deprecations = map[string]Deprecation{
 		Key:     "server.host",
 		NewKey:  "server.address",
 		AutoMap: false,
+		Keep:    true,
 		MapFunc: nil,
 		ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) {
-			val.PushWarning(fmt.Errorf("configuration key 'server.host' is deprecated in %s and has been replaced by 'server.address' when combined with the 'server.port' in the format of 'tcp://<host>:<port>': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String()))
+			val.PushWarning(fmt.Errorf("configuration key 'server.host' is deprecated in %s and has been replaced by 'server.address' when combined with the 'server.port' in the format of '[tcp://]<hostname>[:<port>]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String()))
 		},
 	},
 	"server.port": {
@@ -193,9 +195,62 @@ var deprecations = map[string]Deprecation{
 		Key:     "server.port",
 		NewKey:  "server.address",
 		AutoMap: false,
+		Keep:    true,
 		MapFunc: nil,
 		ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) {
-			val.PushWarning(fmt.Errorf("configuration key 'server.port' is deprecated in %s and has been replaced by 'server.address' when combined with the 'server.host' in the format of 'tcp://<host>:<port>': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String()))
+			val.PushWarning(fmt.Errorf("configuration key 'server.port' is deprecated in %s and has been replaced by 'server.address' when combined with the 'server.host' in the format of '[tcp://]<hostname>[:<port>]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String()))
 		},
 	},
+	"storage.mysql.host": {
+		Version: model.SemanticVersion{Major: 4, Minor: 38},
+		Key:     "storage.mysql.host",
+		NewKey:  "storage.mysql.address",
+		AutoMap: false,
+		Keep:    true,
+		MapFunc: nil,
+		ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) {
+			val.PushWarning(fmt.Errorf("configuration key 'storage.mysql.host' is deprecated in %s and has been replaced by 'storage.mysql.address' when combined with the 'storage.mysql.port' in the format of '[tcp://]<hostname>[:<port>]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String()))
+		},
+	},
+	"storage.mysql.port": {
+		Version: model.SemanticVersion{Major: 4, Minor: 38},
+		Key:     "storage.mysql.port",
+		NewKey:  "storage.mysql.address",
+		AutoMap: false,
+		Keep:    true,
+		MapFunc: nil,
+		ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) {
+			val.PushWarning(fmt.Errorf("configuration key 'storage.mysql.port' is deprecated in %s and has been replaced by 'storage.mysql.address' when combined with the 'storage.mysql.host' in the format of '[tcp://]<hostname>[:<port>]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String()))
+		},
+	},
+	"storage.postgres.host": {
+		Version: model.SemanticVersion{Major: 4, Minor: 38},
+		Key:     "storage.postgres.host",
+		NewKey:  "storage.postgres.address",
+		AutoMap: false,
+		Keep:    true,
+		MapFunc: nil,
+		ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) {
+			val.PushWarning(fmt.Errorf("configuration key 'storage.postgres.host' is deprecated in %s and has been replaced by 'storage.postgres.address' when combined with the 'storage.postgres.port' in the format of '[tcp://]<hostname>[:<port>]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String()))
+		},
+	},
+	"storage.postgres.port": {
+		Version: model.SemanticVersion{Major: 4, Minor: 38},
+		Key:     "storage.postgres.port",
+		NewKey:  "storage.postgres.address",
+		AutoMap: false,
+		Keep:    true,
+		MapFunc: nil,
+		ErrFunc: func(d Deprecation, _ map[string]any, _ any, val *schema.StructValidator) {
+			val.PushWarning(fmt.Errorf("configuration key 'storage.postgres.port' is deprecated in %s and has been replaced by 'storage.postgres.address' when combined with the 'storage.postgres.host' in the format of '[tcp://]<hostname>[:<port>]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message", d.Version.String()))
+		},
+	},
+	"authentication_backend.ldap.url": {
+		Version: model.SemanticVersion{Major: 4, Minor: 38},
+		Key:     "authentication_backend.ldap.url",
+		NewKey:  "authentication_backend.ldap.address",
+		AutoMap: true,
+		MapFunc: nil,
+		ErrFunc: nil,
+	},
 }

internal/configuration/provider_test.go

@@ -120,7 +120,7 @@ func TestShouldValidateConfigurationWithFilters(t *testing.T) {
 	require.Len(t, val.Warnings(), 0)
 
 	assert.Equal(t, "api-123456789.example.org", config.DuoAPI.Hostname)
-	assert.Equal(t, "10.10.10.10", config.Notifier.SMTP.Host)
+	assert.Equal(t, "smtp://10.10.10.10:1025", config.Notifier.SMTP.Address.String())
 	assert.Equal(t, "10.10.10.10", config.Session.Redis.Host)
 
 	require.Len(t, config.IdentityProviders.OIDC.Clients, 3)
@@ -135,7 +135,7 @@ func TestShouldNotIgnoreInvalidEnvs(t *testing.T) {
 	testSetEnv(t, "STORAGE_MYSQL", "a bad env")
 	testSetEnv(t, "JWT_SECRET", "an env jwt secret")
 	testSetEnv(t, "AUTHENTICATION_BACKEND_LDAP_PASSWORD", "an env authentication backend ldap password")
-	testSetEnv(t, "AUTHENTICATION_BACKEND_LDAP_URL", "an env authentication backend ldap password")
+	testSetEnv(t, "AUTHENTICATION_BACKEND_LDAP_ADDRESS", "an env authentication backend ldap password")
 
 	val := schema.NewStructValidator()
 	keys, _, err := Load(val, NewDefaultSources([]string{"./test_resources/config.yml"}, DefaultEnvPrefix, DefaultEnvDelimiter)...)
@@ -145,9 +145,10 @@ func TestShouldNotIgnoreInvalidEnvs(t *testing.T) {
 	validator.ValidateKeys(keys, DefaultEnvPrefix, val)
 
 	require.Len(t, val.Warnings(), 1)
-	assert.Len(t, val.Errors(), 0)
+	assert.Len(t, val.Errors(), 1)
 
 	assert.EqualError(t, val.Warnings()[0], fmt.Sprintf("configuration environment variable not expected: %sSTORAGE_MYSQL", DefaultEnvPrefix))
+	assert.EqualError(t, val.Errors()[0], "error occurred during unmarshalling configuration: 1 error(s) decoding:\n\n* error decoding 'authentication_backend.ldap.address': could not decode 'an env authentication backend ldap password' to a *schema.AddressLDAP: could not parse string 'an env authentication backend ldap password' as address: expected format is [<scheme>://]<hostname>[:<port>]: parse \"ldaps://an env authentication backend ldap password\": invalid character \" \" in host name")
 }
 
 func TestShouldValidateAndRaiseErrorsOnNormalConfigurationAndSecret(t *testing.T) {
@@ -268,6 +269,75 @@ func TestShouldValidateAndRaiseErrorsOnBadConfiguration(t *testing.T) {
 	assert.Equal(t, "debug", c.Log.Level)
 }
 
+func TestShouldValidateDeprecatedEnvNames(t *testing.T) {
+	testSetEnv(t, "AUTHENTICATION_BACKEND_LDAP_URL", "ldap://from-env")
+
+	val := schema.NewStructValidator()
+	keys, c, err := Load(val, NewDefaultSources([]string{"./test_resources/config.yml"}, DefaultEnvPrefix, DefaultEnvDelimiter)...)
+
+	assert.NoError(t, err)
+
+	validator.ValidateKeys(keys, DefaultEnvPrefix, val)
+
+	assert.Len(t, val.Errors(), 0)
+	require.Len(t, val.Warnings(), 1)
+
+	assert.EqualError(t, val.Warnings()[0], "configuration key 'authentication_backend.ldap.url' is deprecated in 4.38.0 and has been replaced by 'authentication_backend.ldap.address': this has not been automatically mapped for you because the replacement key also exists and you will need to adjust your configuration to remove this message")
+
+	assert.Equal(t, "ldap://127.0.0.1:389", c.AuthenticationBackend.LDAP.Address.String())
+}
+
+func TestShouldValidateDeprecatedEnvNamesWithDeprecatedKeys(t *testing.T) {
+	testSetEnv(t, "AUTHENTICATION_BACKEND_LDAP_URL", "ldap://from-env")
+
+	val := schema.NewStructValidator()
+	keys, c, err := Load(val, NewDefaultSources([]string{"./test_resources/config.deprecated.yml"}, DefaultEnvPrefix, DefaultEnvDelimiter)...)
+
+	assert.NoError(t, err)
+
+	validator.ValidateKeys(keys, DefaultEnvPrefix, val)
+
+	assert.Len(t, val.Errors(), 0)
+
+	warnings := val.Warnings()
+	require.Len(t, warnings, 3)
+
+	sort.Sort(utils.ErrSliceSortAlphabetical(warnings))
+
+	assert.EqualError(t, warnings[0], "configuration key 'authentication_backend.ldap.url' is deprecated in 4.38.0 and has been replaced by 'authentication_backend.ldap.address': this has been automatically mapped for you but you will need to adjust your configuration to remove this message")
+	assert.EqualError(t, warnings[1], "configuration key 'storage.mysql.host' is deprecated in 4.38.0 and has been replaced by 'storage.mysql.address' when combined with the 'storage.mysql.port' in the format of '[tcp://]<hostname>[:<port>]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message")
+	assert.EqualError(t, warnings[2], "configuration key 'storage.mysql.port' is deprecated in 4.38.0 and has been replaced by 'storage.mysql.address' when combined with the 'storage.mysql.host' in the format of '[tcp://]<hostname>[:<port>]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message")
+
+	assert.Equal(t, "ldap://from-env:389", c.AuthenticationBackend.LDAP.Address.String())
+}
+
+func TestShouldValidateDeprecatedEnvNamesWithDeprecatedKeysAlt(t *testing.T) {
+	val := schema.NewStructValidator()
+	keys, c, err := Load(val, NewDefaultSources([]string{"./test_resources/config.deprecated.alt.yml"}, DefaultEnvPrefix, DefaultEnvDelimiter)...)
+
+	assert.NoError(t, err)
+
+	validator.ValidateKeys(keys, DefaultEnvPrefix, val)
+
+	assert.Len(t, val.Errors(), 0)
+
+	warnings := val.Warnings()
+	require.Len(t, warnings, 3)
+
+	sort.Sort(utils.ErrSliceSortAlphabetical(warnings))
+
+	assert.EqualError(t, warnings[0], "configuration key 'authentication_backend.ldap.url' is deprecated in 4.38.0 and has been replaced by 'authentication_backend.ldap.address': this has been automatically mapped for you but you will need to adjust your configuration to remove this message")
+	assert.EqualError(t, warnings[1], "configuration key 'storage.postgres.host' is deprecated in 4.38.0 and has been replaced by 'storage.postgres.address' when combined with the 'storage.postgres.port' in the format of '[tcp://]<hostname>[:<port>]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message")
+	assert.EqualError(t, warnings[2], "configuration key 'storage.postgres.port' is deprecated in 4.38.0 and has been replaced by 'storage.postgres.address' when combined with the 'storage.postgres.host' in the format of '[tcp://]<hostname>[:<port>]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message")
+
+	val.Clear()
+
+	validator.ValidateConfiguration(c, val)
+
+	require.NotNil(t, c.Storage.PostgreSQL.Address)
+	assert.Equal(t, "tcp://127.0.0.1:5432", c.Storage.PostgreSQL.Address.String())
+}
+
 func TestShouldRaiseErrOnInvalidNotifierSMTPSender(t *testing.T) {
 	val := schema.NewStructValidator()
 	keys, _, err := Load(val, NewDefaultSources([]string{"./test_resources/config_smtp_sender_invalid.yml"}, DefaultEnvPrefix, DefaultEnvDelimiter)...)
@@ -411,7 +481,7 @@ func TestShouldLoadDirectoryConfiguration(t *testing.T) {
 	assert.Len(t, val.Errors(), 0)
 	require.Len(t, val.Warnings(), 1)
 
-	assert.EqualError(t, val.Warnings()[0], "configuration key 'server.port' is deprecated in 4.38.0 and has been replaced by 'server.address' when combined with the 'server.host' in the format of 'tcp://<host>:<port>': this should be automatically mapped for you but you will need to adjust your configuration to remove this message")
+	assert.EqualError(t, val.Warnings()[0], "configuration key 'server.port' is deprecated in 4.38.0 and has been replaced by 'server.address' when combined with the 'server.host' in the format of '[tcp://]<hostname>[:<port>]': this should be automatically mapped for you but you will need to adjust your configuration to remove this message")
 }
 
 func testSetEnv(t *testing.T, key, value string) {

internal/configuration/schema/authentication.go

@@ -95,8 +95,8 @@ type SCryptPassword struct {
 
 // LDAPAuthenticationBackend represents the configuration related to LDAP server.
 type LDAPAuthenticationBackend struct {
+	Address        *AddressLDAP  `koanf:"address"`
 	Implementation string        `koanf:"implementation"`
-	URL            string        `koanf:"url"`
 	Timeout        time.Duration `koanf:"timeout"`
 	StartTLS       bool          `koanf:"start_tls"`
 	TLS            *TLSConfig    `koanf:"tls"`

internal/configuration/schema/keys.go

@@ -85,8 +85,8 @@ var Keys = []string{
 	"authentication_backend.file.password.salt_length",
 	"authentication_backend.file.search.email",
 	"authentication_backend.file.search.case_insensitive",
+	"authentication_backend.ldap.address",
 	"authentication_backend.ldap.implementation",
-	"authentication_backend.ldap.url",
 	"authentication_backend.ldap.timeout",
 	"authentication_backend.ldap.start_tls",
 	"authentication_backend.ldap.tls.minimum_version",
@@ -184,24 +184,26 @@ var Keys = []string{
 	"regulation.find_time",
 	"regulation.ban_time",
 	"storage.local.path",
-	"storage.mysql.host",
+	"storage.mysql.address",
-	"storage.mysql.port",
 	"storage.mysql.database",
 	"storage.mysql.username",
 	"storage.mysql.password",
 	"storage.mysql.timeout",
+	"storage.mysql.host",
+	"storage.mysql.port",
 	"storage.mysql.tls.minimum_version",
 	"storage.mysql.tls.maximum_version",
 	"storage.mysql.tls.skip_verify",
 	"storage.mysql.tls.server_name",
 	"storage.mysql.tls.private_key",
 	"storage.mysql.tls.certificate_chain",
-	"storage.postgres.host",
+	"storage.postgres.address",
-	"storage.postgres.port",
 	"storage.postgres.database",
 	"storage.postgres.username",
 	"storage.postgres.password",
 	"storage.postgres.timeout",
+	"storage.postgres.host",
+	"storage.postgres.port",
 	"storage.postgres.schema",
 	"storage.postgres.tls.minimum_version",
 	"storage.postgres.tls.maximum_version",
@@ -216,8 +218,7 @@ var Keys = []string{
 	"storage.encryption_key",
 	"notifier.disable_startup_check",
 	"notifier.filesystem.filename",
-	"notifier.smtp.host",
+	"notifier.smtp.address",
-	"notifier.smtp.port",
 	"notifier.smtp.timeout",
 	"notifier.smtp.username",
 	"notifier.smtp.password",
@@ -234,9 +235,9 @@ var Keys = []string{
 	"notifier.smtp.tls.server_name",
 	"notifier.smtp.tls.private_key",
 	"notifier.smtp.tls.certificate_chain",
+	"notifier.smtp.host",
+	"notifier.smtp.port",
 	"notifier.template_path",
-	"server.host",
-	"server.port",
 	"server.address",
 	"server.umask",
 	"server.path",
@@ -257,6 +258,8 @@ var Keys = []string{
 	"server.timeouts.read",
 	"server.timeouts.write",
 	"server.timeouts.idle",
+	"server.host",
+	"server.port",
 	"telemetry.metrics.enabled",
 	"telemetry.metrics.address",
 	"telemetry.metrics.umask",

internal/configuration/schema/notifier.go

@@ -3,6 +3,7 @@ package schema
 import (
 	"crypto/tls"
 	"net/mail"
+	"net/url"
 	"time"
 )
 
@@ -13,8 +14,7 @@ type FileSystemNotifierConfiguration struct {
 
 // SMTPNotifierConfiguration represents the configuration of the SMTP server to send emails with.
 type SMTPNotifierConfiguration struct {
-	Host                string        `koanf:"host"`
+	Address             *AddressSMTP  `koanf:"address"`
-	Port                int           `koanf:"port"`
 	Timeout             time.Duration `koanf:"timeout"`
 	Username            string        `koanf:"username"`
 	Password            string        `koanf:"password"`
@@ -26,6 +26,12 @@ type SMTPNotifierConfiguration struct {
 	DisableHTMLEmails   bool          `koanf:"disable_html_emails"`
 	DisableStartTLS     bool          `koanf:"disable_starttls"`
 	TLS                 *TLSConfig    `koanf:"tls"`
+
+	// Deprecated: use address instead.
+	Host string `koanf:"host"`
+
+	// Deprecated: use address instead.
+	Port int `koanf:"port"`
 }
 
 // NotifierConfiguration represents the configuration of the notifier to use when sending notifications to users.
@@ -38,6 +44,7 @@ type NotifierConfiguration struct {
 
 // DefaultSMTPNotifierConfiguration represents default configuration parameters for the SMTP notifier.
 var DefaultSMTPNotifierConfiguration = SMTPNotifierConfiguration{
+	Address:             &AddressSMTP{Address{true, false, 25, &url.URL{Scheme: AddressSchemeSMTP, Host: "localhost:25"}}},
 	Timeout:             time.Second * 5,
 	Subject:             "[Authelia] {title}",
 	Identifier:          "localhost",

internal/configuration/schema/ntp.go

@@ -1,12 +1,13 @@
 package schema
 
 import (
+	"net/url"
 	"time"
 )
 
 // NTPConfiguration represents the configuration related to ntp server.
 type NTPConfiguration struct {
-	Address             string        `koanf:"address"`
+	Address             *AddressUDP   `koanf:"address"`
 	Version             int           `koanf:"version"`
 	MaximumDesync       time.Duration `koanf:"max_desync"`
 	DisableStartupCheck bool          `koanf:"disable_startup_check"`
@@ -15,7 +16,7 @@ type NTPConfiguration struct {
 
 // DefaultNTPConfiguration represents default configuration parameters for the NTP server.
 var DefaultNTPConfiguration = NTPConfiguration{
-	Address:       "time.cloudflare.com:123",
+	Address:       &AddressUDP{Address{valid: true, socket: false, port: 123, url: &url.URL{Scheme: AddressSchemeUDP, Host: "time.cloudflare.com:123"}}},
 	Version:       4,
 	MaximumDesync: time.Second * 3,
 }

internal/configuration/schema/storage.go

@@ -2,6 +2,7 @@ package schema
 
 import (
 	"crypto/tls"
+	"net/url"
 	"time"
 )
 
@@ -12,12 +13,17 @@ type LocalStorageConfiguration struct {
 
 // SQLStorageConfiguration represents the configuration of the SQL database.
 type SQLStorageConfiguration struct {
-	Host     string        `koanf:"host"`
+	Address  *AddressTCP   `koanf:"address"`
-	Port     int           `koanf:"port"`
 	Database string        `koanf:"database"`
 	Username string        `koanf:"username"`
 	Password string        `koanf:"password"`
 	Timeout  time.Duration `koanf:"timeout"`
+
+	// Deprecated: use address instead.
+	Host string `koanf:"host"`
+
+	// Deprecated: use address instead.
+	Port int `koanf:"port"`
 }
 
 // MySQLStorageConfiguration represents the configuration of a MySQL database.
@@ -68,6 +74,9 @@ var DefaultMySQLStorageConfiguration = MySQLStorageConfiguration{
 
 // DefaultPostgreSQLStorageConfiguration represents the default PostgreSQL configuration.
 var DefaultPostgreSQLStorageConfiguration = PostgreSQLStorageConfiguration{
+	SQLStorageConfiguration: SQLStorageConfiguration{
+		Address: &AddressTCP{Address{true, false, 5432, &url.URL{Scheme: AddressSchemeTCP, Host: "localhost:5432"}}},
+	},
 	Schema: "public",
 	TLS: &TLSConfig{
 		MinimumVersion: TLSVersion{tls.VersionTLS12},

internal/configuration/schema/types.go

@@ -9,11 +9,7 @@ import (
 	"crypto/x509"
 	"encoding/pem"
 	"fmt"
-	"net"
-	"net/url"
-	"strconv"
 	"strings"
-	"syscall"
 	"time"
 
 	"github.com/go-crypt/crypt"
@@ -21,388 +17,6 @@ import (
 	"github.com/go-crypt/crypt/algorithm/plaintext"
 )
 
-// NewAddress returns an *Address and error depending on the ability to parse the string as an Address.
-// It also assumes any value without a scheme which looks like a path is the 'unix' scheme, and everything else without
-// a scheme is the 'tcp' scheme.
-func NewAddress(value string) (address *Address, err error) {
-	return NewAddressDefault(value, AddressSchemeTCP, AddressSchemeUnix)
-}
-
-// NewAddressDefault returns an *Address and error depending on the ability to parse the string as an Address.
-// It also assumes any value without a scheme which looks like a path is the schemeDefaultPath scheme, and everything
-// else without a scheme is the schemeDefault scheme.
-func NewAddressDefault(value, schemeDefault, schemeDefaultPath string) (address *Address, err error) {
-	if len(value) == 0 {
-		return &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: ":0"}}, nil
-	}
-
-	var u *url.URL
-
-	if regexpHasScheme.MatchString(value) {
-		u, err = url.Parse(value)
-	} else {
-		if strings.HasPrefix(value, "/") {
-			u, err = url.Parse(fmt.Sprintf("%s://%s", schemeDefaultPath, value))
-		} else {
-			u, err = url.Parse(fmt.Sprintf("%s://%s", schemeDefault, value))
-		}
-	}
-
-	if err != nil {
-		return nil, fmt.Errorf("could not parse string '%s' as address: expected format is [<scheme>://]<ip>[:<port>]: %w", value, err)
-	}
-
-	return NewAddressFromURL(u)
-}
-
-// NewAddressUnix returns an *Address from a path value.
-func NewAddressUnix(path string) Address {
-	return Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: path}}
-}
-
-// NewAddressFromNetworkValues returns an *Address from network values.
-func NewAddressFromNetworkValues(network, host string, port int) Address {
-	return Address{true, false, port, &url.URL{Scheme: network, Host: fmt.Sprintf("%s:%d", host, port)}}
-}
-
-// NewAddressFromURL returns an *Address and error depending on the ability to parse the *url.URL as an Address.
-func NewAddressFromURL(u *url.URL) (addr *Address, err error) {
-	addr = &Address{
-		url: u,
-	}
-
-	if err = addr.validate(); err != nil {
-		return nil, err
-	}
-
-	return addr, nil
-}
-
-// AddressTCP is just a type with an underlying type of Address.
-type AddressTCP struct {
-	Address
-}
-
-// AddressUDP is just a type with an underlying type of Address.
-type AddressUDP struct {
-	Address
-}
-
-// AddressLDAP is just a type with an underlying type of Address.
-type AddressLDAP struct {
-	Address
-}
-
-// AddressSMTP is just a type with an underlying type of Address.
-type AddressSMTP struct {
-	Address
-}
-
-// Address represents an address.
-type Address struct {
-	valid  bool
-	socket bool
-	port   int
-
-	url *url.URL
-}
-
-// Valid returns true if the Address is valid.
-func (a *Address) Valid() bool {
-	return a.valid
-}
-
-// ValidateHTTP returns true if the Address is valid for a HTTP connection listener.
-func (a *Address) ValidateHTTP() error {
-	switch a.Scheme() {
-	case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUnix:
-		break
-	default:
-		return fmt.Errorf("scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as '%s'", a.Scheme())
-	}
-
-	return nil
-}
-
-// ValidateListener returns true if the Address is valid for a connection listener.
-func (a *Address) ValidateListener() error {
-	switch a.Scheme() {
-	case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6, AddressSchemeUnix:
-		break
-	default:
-		return fmt.Errorf("scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', or 'unix' but is configured as '%s'", a.Scheme())
-	}
-
-	return nil
-}
-
-// ValidateSMTP returns true if the Address is valid for a remote SMTP connection opener.
-func (a *Address) ValidateSMTP() error {
-	switch a.Scheme() {
-	case AddressSchemeSMTP, AddressSchemeSUBMISSION, AddressSchemeSUBMISSIONS:
-		break
-	default:
-		return fmt.Errorf("scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as '%s'", a.Scheme())
-	}
-
-	return nil
-}
-
-// ValidateLDAP returns true if the Address has a value Scheme for an LDAP connection opener.
-func (a *Address) ValidateLDAP() error {
-	switch a.Scheme() {
-	case AddressSchemeLDAP, AddressSchemeLDAPS, AddressSchemeLDAPI:
-		break
-	default:
-		return fmt.Errorf("scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as '%s'", a.Scheme())
-	}
-
-	return nil
-}
-
-// IsExplicitlySecure returns true if the address is an explicitly secure.
-func (a *Address) IsExplicitlySecure() bool {
-	switch a.Scheme() {
-	case AddressSchemeSUBMISSIONS, AddressSchemeLDAPS:
-		return true
-	default:
-		return false
-	}
-}
-
-// String returns a string representation of the Address.
-func (a *Address) String() string {
-	if !a.valid || a.url == nil {
-		return ""
-	}
-
-	return a.url.String()
-}
-
-// Network returns the Scheme() if it's appropriate for the net packages network arguments otherwise it returns tcp.
-func (a *Address) Network() string {
-	switch scheme := a.Scheme(); scheme {
-	case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6, AddressSchemeUnix:
-		return scheme
-	default:
-		return AddressSchemeTCP
-	}
-}
-
-// Scheme returns the *url.URL Scheme field.
-func (a *Address) Scheme() string {
-	if !a.valid || a.url == nil {
-		return ""
-	}
-
-	return a.url.Scheme
-}
-
-// Hostname returns the output of the *url.URL Hostname func.
-func (a *Address) Hostname() string {
-	if !a.valid || a.url == nil {
-		return ""
-	}
-
-	return a.url.Hostname()
-}
-
-// SocketHostname returns the correct hostname for a socket connection.
-func (a *Address) SocketHostname() string {
-	if !a.valid || a.url == nil {
-		return ""
-	}
-
-	if a.socket {
-		return a.url.Path
-	}
-
-	return a.url.Hostname()
-}
-
-// SetHostname sets the hostname preserving the port.
-func (a *Address) SetHostname(hostname string) {
-	if !a.valid || a.url == nil {
-		return
-	}
-
-	if port := a.url.Port(); port == "" {
-		a.url.Host = hostname
-	} else {
-		a.url.Host = fmt.Sprintf("%s:%s", hostname, port)
-	}
-}
-
-// Port returns the port.
-func (a *Address) Port() int {
-	return a.port
-}
-
-// SetPort sets the port preserving the hostname.
-func (a *Address) SetPort(port int) {
-	if !a.valid || a.url == nil {
-		return
-	}
-
-	a.setport(port)
-}
-
-// Host returns the *url.URL Host field.
-func (a *Address) Host() string {
-	if !a.valid || a.url == nil {
-		return ""
-	}
-
-	return a.url.Host
-}
-
-// NetworkAddress returns a string representation of the Address with just the host and port.
-func (a *Address) NetworkAddress() string {
-	if !a.valid || a.url == nil {
-		return ""
-	}
-
-	if a.socket {
-		return a.url.Path
-	}
-
-	return a.url.Host
-}
-
-// Listener creates and returns a net.Listener.
-func (a *Address) Listener() (net.Listener, error) {
-	return a.listener()
-}
-
-// Dial creates and returns a dialed net.Conn.
-func (a *Address) Dial() (net.Conn, error) {
-	if a.url == nil {
-		return nil, fmt.Errorf("address url is nil")
-	}
-
-	return net.Dial(a.Network(), a.NetworkAddress())
-}
-
-// ListenerWithUMask creates and returns a net.Listener with a temporary UMask if the scheme is `unix`.
-func (a *Address) ListenerWithUMask(umask int) (ln net.Listener, err error) {
-	if !a.socket {
-		return a.listener()
-	}
-
-	if a.url == nil {
-		return nil, fmt.Errorf("address url is nil")
-	}
-
-	umask = syscall.Umask(umask)
-
-	ln, err = net.Listen(a.Network(), a.NetworkAddress())
-
-	_ = syscall.Umask(umask)
-
-	return ln, err
-}
-
-func (a *Address) listener() (net.Listener, error) {
-	if a.url == nil {
-		return nil, fmt.Errorf("address url is nil")
-	}
-
-	return net.Listen(a.Network(), a.NetworkAddress())
-}
-
-func (a *Address) setport(port int) {
-	a.port = port
-	a.url.Host = net.JoinHostPort(a.url.Hostname(), strconv.Itoa(port))
-}
-
-func (a *Address) validate() (err error) {
-	if a.url == nil {
-		return fmt.Errorf("error validating the address: address url was nil")
-	}
-
-	switch {
-	case a.url.RawQuery != "":
-		return fmt.Errorf("error validating the address: the url '%s' appears to have a query but this is not valid for addresses", a.url.String())
-	case a.url.RawFragment != "", a.url.Fragment != "":
-		return fmt.Errorf("error validating the address: the url '%s' appears to have a fragment but this is not valid for addresses", a.url.String())
-	case a.url.User != nil:
-		return fmt.Errorf("error validating the address: the url '%s' appears to have user info but this is not valid for addresses", a.url.String())
-	}
-
-	switch a.url.Scheme {
-	case AddressSchemeUnix, AddressSchemeLDAPI:
-		if err = a.validateUnixSocket(); err != nil {
-			return err
-		}
-	case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6:
-		if err = a.validateTCPUDP(); err != nil {
-			return err
-		}
-	case AddressSchemeLDAP, AddressSchemeLDAPS, AddressSchemeSMTP, AddressSchemeSUBMISSION, AddressSchemeSUBMISSIONS:
-		if err = a.validateProtocol(); err != nil {
-			return err
-		}
-	}
-
-	a.valid = true
-
-	return nil
-}
-
-func (a *Address) validateProtocol() (err error) {
-	port := a.url.Port()
-
-	switch port {
-	case "":
-		switch a.url.Scheme {
-		case AddressSchemeLDAP:
-			a.setport(389)
-		case AddressSchemeLDAPS:
-			a.setport(636)
-		case AddressSchemeSMTP:
-			a.setport(25)
-		case AddressSchemeSUBMISSION:
-			a.setport(587)
-		case AddressSchemeSUBMISSIONS:
-			a.setport(465)
-		}
-	default:
-		actualPort, _ := strconv.Atoi(port)
-
-		a.setport(actualPort)
-	}
-
-	return nil
-}
-
-func (a *Address) validateTCPUDP() (err error) {
-	port := a.url.Port()
-
-	switch port {
-	case "":
-		a.setport(0)
-	default:
-		actualPort, _ := strconv.Atoi(port)
-
-		a.setport(actualPort)
-	}
-
-	return nil
-}
-
-func (a *Address) validateUnixSocket() (err error) {
-	switch {
-	case a.url.Path == "" && a.url.Scheme != AddressSchemeLDAPI:
-		return fmt.Errorf("error validating the unix socket address: could not determine path from '%s'", a.url.String())
-	case a.url.Host != "":
-		return fmt.Errorf("error validating the unix socket address: the url '%s' appears to have a host but this is not valid for unix sockets: this may occur if you omit the leading forward slash from the socket path", a.url.String())
-	}
-
-	a.socket = true
-
-	return nil
-}
-
 var cdecoder algorithm.DecoderRegister
 
 // DecodePasswordDigest returns a new PasswordDigest if it can be decoded.

internal/configuration/schema/types_address.go

@@ -0,0 +1,482 @@
+package schema
+
+import (
+	"fmt"
+	"net"
+	"net/url"
+	"strconv"
+	"strings"
+	"syscall"
+)
+
+// NewAddress returns an *Address and error depending on the ability to parse the string as an Address.
+// It also assumes any value without a scheme which looks like a path is the 'unix' scheme, and everything else without
+// a scheme is the 'tcp' scheme.
+func NewAddress(value string) (address *Address, err error) {
+	return NewAddressDefault(value, AddressSchemeTCP, AddressSchemeUnix)
+}
+
+// NewAddressDefault returns an *Address and error depending on the ability to parse the string as an Address.
+// It also assumes any value without a scheme which looks like a path is the schemeDefaultPath scheme, and everything
+// else without a scheme is the schemeDefault scheme.
+func NewAddressDefault(value, schemeDefault, schemeDefaultPath string) (address *Address, err error) {
+	if len(value) == 0 {
+		return &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: ":0"}}, nil
+	}
+
+	var u *url.URL
+
+	if regexpHasScheme.MatchString(value) {
+		u, err = url.Parse(value)
+	} else {
+		if strings.HasPrefix(value, "/") {
+			u, err = url.Parse(fmt.Sprintf("%s://%s", schemeDefaultPath, value))
+		} else {
+			u, err = url.Parse(fmt.Sprintf("%s://%s", schemeDefault, value))
+		}
+	}
+
+	if err != nil {
+		return nil, fmt.Errorf("could not parse string '%s' as address: expected format is [<scheme>://]<hostname>[:<port>]: %w", value, err)
+	}
+
+	return NewAddressFromURL(u)
+}
+
+// NewAddressFromNetworkValuesDefault returns an *Address and error depending on the ability to parse the string as an Address.
+// It also assumes any value without a scheme which looks like a path is the schemeDefaultPath scheme, and everything
+// else without a scheme is the schemeDefault scheme.
+func NewAddressFromNetworkValuesDefault(value string, port int, schemeDefault, schemeDefaultPath string) (address *Address, err error) {
+	var u *url.URL
+
+	if regexpHasScheme.MatchString(value) {
+		u, err = url.Parse(value)
+	} else {
+		switch {
+		case strings.HasPrefix(value, "/"):
+			u, err = url.Parse(fmt.Sprintf("%s://%s", schemeDefaultPath, value))
+		case port > 0:
+			u, err = url.Parse(fmt.Sprintf("%s://%s:%d", schemeDefault, value, port))
+		default:
+			u, err = url.Parse(fmt.Sprintf("%s://%s", schemeDefault, value))
+		}
+	}
+
+	if err != nil {
+		return nil, fmt.Errorf("could not parse string '%s' as address: expected format is [<scheme>://]<hostname>[:<port>]: %w", value, err)
+	}
+
+	return NewAddressFromURL(u)
+}
+
+// NewAddressUnix returns an *Address from a path value.
+func NewAddressUnix(path string) Address {
+	return Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: path}}
+}
+
+// NewAddressFromNetworkValues returns an *Address from network values.
+func NewAddressFromNetworkValues(network, host string, port int) Address {
+	return Address{true, false, port, &url.URL{Scheme: network, Host: fmt.Sprintf("%s:%d", host, port)}}
+}
+
+// NewSMTPAddress returns an *AddressSMTP from SMTP values.
+func NewSMTPAddress(scheme, host string, port int) *AddressSMTP {
+	if port == 0 {
+		switch scheme {
+		case AddressSchemeSUBMISSIONS:
+			port = 465
+		case AddressSchemeSUBMISSION:
+			port = 587
+		default:
+			port = 25
+		}
+	}
+
+	if scheme == "" {
+		switch port {
+		case 465:
+			scheme = AddressSchemeSUBMISSIONS
+		case 587:
+			scheme = AddressSchemeSUBMISSION
+		default:
+			scheme = AddressSchemeSMTP
+		}
+	}
+
+	return &AddressSMTP{Address: Address{true, false, port, &url.URL{Scheme: scheme, Host: fmt.Sprintf("%s:%d", host, port)}}}
+}
+
+// NewAddressFromURL returns an *Address and error depending on the ability to parse the *url.URL as an Address.
+func NewAddressFromURL(u *url.URL) (addr *Address, err error) {
+	addr = &Address{
+		url: u,
+	}
+
+	if err = addr.validate(); err != nil {
+		return nil, err
+	}
+
+	return addr, nil
+}
+
+// AddressTCP is just a type with an underlying type of Address.
+type AddressTCP struct {
+	Address
+}
+
+// AddressUDP is just a type with an underlying type of Address.
+type AddressUDP struct {
+	Address
+}
+
+// AddressLDAP is just a type with an underlying type of Address.
+type AddressLDAP struct {
+	Address
+}
+
+// AddressSMTP is just a type with an underlying type of Address.
+type AddressSMTP struct {
+	Address
+}
+
+// Address represents an address.
+type Address struct {
+	valid  bool
+	socket bool
+	port   int
+
+	url *url.URL
+}
+
+// Valid returns true if the Address is valid.
+func (a *Address) Valid() bool {
+	return a.valid
+}
+
+// IsUnixDomainSocket returns true if the address has been determined to be a Unix Domain Socket.
+func (a *Address) IsUnixDomainSocket() bool {
+	return a.socket
+}
+
+// IsTCP returns true if the address is one of the TCP schemes (not including application schemes that use TCP).
+func (a *Address) IsTCP() bool {
+	switch a.Scheme() {
+	case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6:
+		return true
+	default:
+		return false
+	}
+}
+
+// IsUDP returns true if the address is one of the UDP schemes (not including application schemes that use UDP).
+func (a *Address) IsUDP() bool {
+	switch a.Scheme() {
+	case AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6:
+		return true
+	default:
+		return false
+	}
+}
+
+// IsExplicitlySecure returns true if the address is an explicitly secure.
+func (a *Address) IsExplicitlySecure() bool {
+	switch a.Scheme() {
+	case AddressSchemeSUBMISSIONS, AddressSchemeLDAPS:
+		return true
+	default:
+		return false
+	}
+}
+
+// ValidateListener returns true if the Address is valid for a connection listener.
+func (a *Address) ValidateListener() error {
+	switch a.Scheme() {
+	case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6, AddressSchemeUnix:
+		break
+	default:
+		return fmt.Errorf("scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', or 'unix' but is configured as '%s'", a.Scheme())
+	}
+
+	return nil
+}
+
+// ValidateHTTP returns true if the Address is valid for a HTTP connection listener.
+func (a *Address) ValidateHTTP() error {
+	if a.IsTCP() {
+		return nil
+	}
+
+	switch a.Scheme() {
+	case AddressSchemeUnix:
+		return nil
+	default:
+		return fmt.Errorf("scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as '%s'", a.Scheme())
+	}
+}
+
+// ValidateSMTP returns true if the Address is valid for a remote SMTP connection opener.
+func (a *Address) ValidateSMTP() error {
+	switch a.Scheme() {
+	case AddressSchemeSMTP, AddressSchemeSUBMISSION, AddressSchemeSUBMISSIONS:
+		return nil
+	default:
+		return fmt.Errorf("scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as '%s'", a.Scheme())
+	}
+}
+
+// ValidateSQL returns true if the Address is valid for a remote SQL connection opener.
+func (a *Address) ValidateSQL() error {
+	if a.IsTCP() {
+		return nil
+	}
+
+	switch a.Scheme() {
+	case AddressSchemeUnix:
+		return nil
+	default:
+		return fmt.Errorf("scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as '%s'", a.Scheme())
+	}
+}
+
+// ValidateLDAP returns true if the Address has a value Scheme for an LDAP connection opener.
+func (a *Address) ValidateLDAP() error {
+	switch a.Scheme() {
+	case AddressSchemeLDAP, AddressSchemeLDAPS, AddressSchemeLDAPI:
+		return nil
+	default:
+		return fmt.Errorf("scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as '%s'", a.Scheme())
+	}
+}
+
+// String returns a string representation of the Address.
+func (a *Address) String() string {
+	if !a.valid || a.url == nil {
+		return ""
+	}
+
+	return a.url.String()
+}
+
+// Network returns the Scheme() if it's appropriate for the net packages network arguments otherwise it returns tcp.
+func (a *Address) Network() string {
+	switch scheme := a.Scheme(); scheme {
+	case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6, AddressSchemeUnix:
+		return scheme
+	default:
+		return AddressSchemeTCP
+	}
+}
+
+// Scheme returns the *url.URL Scheme field.
+func (a *Address) Scheme() string {
+	if !a.valid || a.url == nil {
+		return ""
+	}
+
+	return a.url.Scheme
+}
+
+// Hostname returns the output of the *url.URL Hostname func.
+func (a *Address) Hostname() string {
+	if !a.valid || a.url == nil {
+		return ""
+	}
+
+	return a.url.Hostname()
+}
+
+// SocketHostname returns the correct hostname for a socket connection.
+func (a *Address) SocketHostname() string {
+	if !a.valid || a.url == nil {
+		return ""
+	}
+
+	if a.socket {
+		return a.url.Path
+	}
+
+	return a.url.Hostname()
+}
+
+// SetHostname sets the hostname preserving the port.
+func (a *Address) SetHostname(hostname string) {
+	if !a.valid || a.url == nil {
+		return
+	}
+
+	if port := a.url.Port(); port == "" {
+		a.url.Host = hostname
+	} else {
+		a.url.Host = fmt.Sprintf("%s:%s", hostname, port)
+	}
+}
+
+// Port returns the port.
+func (a *Address) Port() int {
+	return a.port
+}
+
+// SetPort sets the port preserving the hostname.
+func (a *Address) SetPort(port int) {
+	if !a.valid || a.url == nil {
+		return
+	}
+
+	a.setport(port)
+}
+
+// Host returns the *url.URL Host field.
+func (a *Address) Host() string {
+	if !a.valid || a.url == nil {
+		return ""
+	}
+
+	return a.url.Host
+}
+
+// NetworkAddress returns a string representation of the Address with just the host and port.
+func (a *Address) NetworkAddress() string {
+	if !a.valid || a.url == nil {
+		return ""
+	}
+
+	if a.socket {
+		return a.url.Path
+	}
+
+	return a.url.Host
+}
+
+// Listener creates and returns a net.Listener.
+func (a *Address) Listener() (net.Listener, error) {
+	return a.listener()
+}
+
+// Dial creates and returns a dialed net.Conn.
+func (a *Address) Dial() (net.Conn, error) {
+	if a.url == nil {
+		return nil, fmt.Errorf("address url is nil")
+	}
+
+	return net.Dial(a.Network(), a.NetworkAddress())
+}
+
+// ListenerWithUMask creates and returns a net.Listener with a temporary UMask if the scheme is `unix`.
+func (a *Address) ListenerWithUMask(umask int) (ln net.Listener, err error) {
+	if !a.socket {
+		return a.listener()
+	}
+
+	if a.url == nil {
+		return nil, fmt.Errorf("address url is nil")
+	}
+
+	umask = syscall.Umask(umask)
+
+	ln, err = net.Listen(a.Network(), a.NetworkAddress())
+
+	_ = syscall.Umask(umask)
+
+	return ln, err
+}
+
+func (a *Address) listener() (net.Listener, error) {
+	if a.url == nil {
+		return nil, fmt.Errorf("address url is nil")
+	}
+
+	return net.Listen(a.Network(), a.NetworkAddress())
+}
+
+func (a *Address) setport(port int) {
+	a.port = port
+	a.url.Host = net.JoinHostPort(a.url.Hostname(), strconv.Itoa(port))
+}
+
+func (a *Address) validate() (err error) {
+	if a.url == nil {
+		return fmt.Errorf("error validating the address: address url was nil")
+	}
+
+	switch {
+	case a.url.RawQuery != "":
+		return fmt.Errorf("error validating the address: the url '%s' appears to have a query but this is not valid for addresses", a.url.String())
+	case a.url.RawFragment != "", a.url.Fragment != "":
+		return fmt.Errorf("error validating the address: the url '%s' appears to have a fragment but this is not valid for addresses", a.url.String())
+	case a.url.User != nil:
+		return fmt.Errorf("error validating the address: the url '%s' appears to have user info but this is not valid for addresses", a.url.String())
+	}
+
+	switch a.url.Scheme {
+	case AddressSchemeUnix, AddressSchemeLDAPI:
+		if err = a.validateUnixSocket(); err != nil {
+			return err
+		}
+	case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6:
+		if err = a.validateTCPUDP(); err != nil {
+			return err
+		}
+	case AddressSchemeLDAP, AddressSchemeLDAPS, AddressSchemeSMTP, AddressSchemeSUBMISSION, AddressSchemeSUBMISSIONS:
+		if err = a.validateProtocol(); err != nil {
+			return err
+		}
+	}
+
+	a.valid = true
+
+	return nil
+}
+
+func (a *Address) validateProtocol() (err error) {
+	port := a.url.Port()
+
+	switch port {
+	case "":
+		switch a.url.Scheme {
+		case AddressSchemeLDAP:
+			a.setport(389)
+		case AddressSchemeLDAPS:
+			a.setport(636)
+		case AddressSchemeSMTP:
+			a.setport(25)
+		case AddressSchemeSUBMISSION:
+			a.setport(587)
+		case AddressSchemeSUBMISSIONS:
+			a.setport(465)
+		}
+	default:
+		actualPort, _ := strconv.Atoi(port)
+
+		a.setport(actualPort)
+	}
+
+	return nil
+}
+
+func (a *Address) validateTCPUDP() (err error) {
+	port := a.url.Port()
+
+	switch port {
+	case "":
+		a.setport(0)
+	default:
+		actualPort, _ := strconv.Atoi(port)
+
+		a.setport(actualPort)
+	}
+
+	return nil
+}
+
+func (a *Address) validateUnixSocket() (err error) {
+	switch {
+	case a.url.Path == "" && a.url.Scheme != AddressSchemeLDAPI:
+		return fmt.Errorf("error validating the unix socket address: could not determine path from '%s'", a.url.String())
+	case a.url.Host != "":
+		return fmt.Errorf("error validating the unix socket address: the url '%s' appears to have a host but this is not valid for unix sockets: this may occur if you omit the leading forward slash from the socket path", a.url.String())
+	}
+
+	a.socket = true
+
+	return nil
+}

internal/configuration/schema/types_address_test.go

@@ -0,0 +1,743 @@
+package schema
+
+import (
+	"net"
+	"net/url"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewAddressFromString(t *testing.T) {
+	testCases := []struct {
+		name                                         string
+		have                                         string
+		expected                                     *Address
+		expectedAddress, expectedString, expectedErr string
+	}{
+		{
+			"ShouldParseBasicAddress",
+			"tcp://0.0.0.0:9091",
+			&Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}},
+			"0.0.0.0:9091",
+			"tcp://0.0.0.0:9091",
+			"",
+		},
+		{
+			"ShouldParseEmptyAddress",
+			"",
+			&Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: ":0"}},
+			":0",
+			"tcp://:0",
+			"",
+		},
+		{
+			"ShouldParseAddressMissingScheme",
+			"0.0.0.0:9091",
+			&Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}},
+			"0.0.0.0:9091",
+			"tcp://0.0.0.0:9091",
+			"",
+		},
+		{
+			"ShouldParseUnixAddressMissingScheme",
+			"/var/run/example.sock",
+			&Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: "/var/run/example.sock"}},
+			"/var/run/example.sock",
+			"unix:///var/run/example.sock",
+			"",
+		},
+		{
+			"ShouldParseAddressMissingPort",
+			"tcp://0.0.0.0",
+			&Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:0"}},
+			"0.0.0.0:0",
+			"tcp://0.0.0.0:0",
+			"",
+		},
+		{
+			"ShouldParseUnixSocket",
+			"unix:///path/to/a/socket.sock",
+			&Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: "/path/to/a/socket.sock"}},
+			"/path/to/a/socket.sock",
+			"unix:///path/to/a/socket.sock",
+			"",
+		},
+		{
+			"ShouldNotParseUnixSocketWithHost",
+			"unix://ahost/path/to/a/socket.sock",
+			nil,
+			"",
+			"",
+			"error validating the unix socket address: the url 'unix://ahost/path/to/a/socket.sock' appears to have a host but this is not valid for unix sockets: this may occur if you omit the leading forward slash from the socket path",
+		},
+		{
+			"ShouldNotParseUnixSocketWithoutPath",
+			"unix://nopath.com",
+			nil,
+			"",
+			"",
+			"error validating the unix socket address: could not determine path from 'unix://nopath.com'",
+		},
+		{
+			"ShouldNotParseUnixSocketWithQuery",
+			"unix:///path/to/a/socket.sock?q=yes",
+			nil,
+			"",
+			"",
+			"error validating the address: the url 'unix:///path/to/a/socket.sock?q=yes' appears to have a query but this is not valid for addresses",
+		},
+		{
+			"ShouldNotParseUnixSocketWithFragment",
+			"unix:///path/to/a/socket.sock#example",
+			nil,
+			"",
+			"",
+			"error validating the address: the url 'unix:///path/to/a/socket.sock#example' appears to have a fragment but this is not valid for addresses",
+		},
+		{
+			"ShouldNotParseUnixSocketWithUserInfo",
+			"unix://user:example@/path/to/a/socket.sock",
+			nil,
+			"",
+			"",
+			"error validating the address: the url 'unix://user:example@/path/to/a/socket.sock' appears to have user info but this is not valid for addresses",
+		},
+		{
+			"ShouldParseUnknownScheme",
+			"a://0.0.0.0",
+			&Address{true, false, 0, &url.URL{Scheme: "a", Host: "0.0.0.0"}},
+			"0.0.0.0",
+			"a://0.0.0.0",
+			"",
+		},
+		{
+			"ShouldNotParseInvalidPort",
+			"tcp://0.0.0.0:abc",
+			nil,
+			"",
+			"",
+			"could not parse string 'tcp://0.0.0.0:abc' as address: expected format is [<scheme>://]<hostname>[:<port>]: parse \"tcp://0.0.0.0:abc\": invalid port \":abc\" after host",
+		},
+		{
+			"ShouldNotParseInvalidAddress",
+			"@$@#%@#$@@",
+			nil,
+			"",
+			"",
+			"could not parse string '@$@#%@#$@@' as address: expected format is [<scheme>://]<hostname>[:<port>]: parse \"tcp://@$@#%@#$@@\": invalid URL escape \"%@#\"",
+		},
+		{
+			"ShouldNotParseInvalidAddressWithScheme",
+			"tcp://@$@#%@#$@@",
+			nil,
+			"",
+			"",
+			"could not parse string 'tcp://@$@#%@#$@@' as address: expected format is [<scheme>://]<hostname>[:<port>]: parse \"tcp://@$@#%@#$@@\": invalid URL escape \"%@#\"",
+		},
+		{
+			"ShouldSetDefaultPortLDAP",
+			"ldap://127.0.0.1",
+			&Address{true, false, 389, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1:389"}},
+			"127.0.0.1:389",
+			"ldap://127.0.0.1:389",
+			"",
+		},
+		{
+			"ShouldSetDefaultPortLDAPS",
+			"ldaps://127.0.0.1",
+			&Address{true, false, 636, &url.URL{Scheme: AddressSchemeLDAPS, Host: "127.0.0.1:636"}},
+			"127.0.0.1:636",
+			"ldaps://127.0.0.1:636",
+			"",
+		},
+		{
+			"ShouldAllowLDAPI",
+			"ldapi:///abc",
+			&Address{true, true, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: "/abc"}},
+			"/abc",
+			"ldapi:///abc",
+			"",
+		},
+		{
+			"ShouldAllowImplicitLDAPI",
+			"ldapi://",
+			&Address{true, true, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: ""}},
+			"",
+			"ldapi:",
+			"",
+		},
+		{
+			"ShouldAllowImplicitLDAPINoSlash",
+			"ldapi:",
+			&Address{true, true, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: ""}},
+			"",
+			"ldapi:",
+			"",
+		},
+		{
+			"ShouldSetDefaultPortSMTP",
+			"smtp://127.0.0.1",
+			&Address{true, false, 25, &url.URL{Scheme: AddressSchemeSMTP, Host: "127.0.0.1:25"}},
+			"127.0.0.1:25",
+			"smtp://127.0.0.1:25",
+			"",
+		},
+		{
+			"ShouldSetDefaultPortSUBMISSION",
+			"submission://127.0.0.1",
+			&Address{true, false, 587, &url.URL{Scheme: AddressSchemeSUBMISSION, Host: "127.0.0.1:587"}},
+			"127.0.0.1:587",
+			"submission://127.0.0.1:587",
+			"",
+		},
+		{
+			"ShouldSetDefaultPortSUBMISSIONS",
+			"submissions://127.0.0.1",
+			&Address{true, false, 465, &url.URL{Scheme: AddressSchemeSUBMISSIONS, Host: "127.0.0.1:465"}},
+			"127.0.0.1:465",
+			"submissions://127.0.0.1:465",
+			"",
+		},
+		{
+			"ShouldNotOverridePort",
+			"ldap://127.0.0.1:123",
+			&Address{true, false, 123, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1:123"}},
+			"127.0.0.1:123",
+			"ldap://127.0.0.1:123",
+			"",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			actual, actualErr := NewAddress(tc.have)
+
+			if len(tc.expectedErr) != 0 {
+				assert.EqualError(t, actualErr, tc.expectedErr)
+			} else {
+				assert.Nil(t, actualErr)
+
+				assert.Equal(t, tc.expectedAddress, actual.NetworkAddress())
+				assert.Equal(t, tc.expectedString, actual.String())
+
+				assert.True(t, actual.Valid())
+			}
+
+			assert.Equal(t, tc.expected, actual)
+		})
+	}
+}
+
+func TestAddress_ValidateErrors(t *testing.T) {
+	testCases := []struct {
+		name                                                                    string
+		have                                                                    *Address
+		expectedLDAP, expectedSMTP, expectedHTTP, expectedSQL, expectedListener string
+	}{
+		{
+			"ShouldValidateLDAPAddress",
+			&Address{true, false, 0, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1"}},
+			"",
+			"scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as 'ldap'",
+			"scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'ldap'",
+			"scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'ldap'",
+			"scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', or 'unix' but is configured as 'ldap'",
+		},
+		{
+			"ShouldValidateSMTPAddress",
+			&Address{true, false, 0, &url.URL{Scheme: AddressSchemeSMTP, Host: "127.0.0.1"}},
+			"scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as 'smtp'",
+			"",
+			"scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'smtp'",
+			"scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'smtp'",
+			"scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', or 'unix' but is configured as 'smtp'",
+		},
+		{
+			"ShouldValidateTCPAddress",
+			&Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "127.0.0.1"}},
+			"scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as 'tcp'",
+			"scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as 'tcp'",
+			"",
+			"",
+			"",
+		},
+		{
+			"ShouldValidateUnixSocket",
+			&Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: "/path/to/socket"}},
+			"scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as 'unix'",
+			"scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as 'unix'",
+			"",
+			"",
+			"",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if tc.expectedLDAP == "" {
+				assert.NoError(t, tc.have.ValidateLDAP())
+			} else {
+				assert.EqualError(t, tc.have.ValidateLDAP(), tc.expectedLDAP)
+			}
+
+			if tc.expectedSMTP == "" {
+				assert.NoError(t, tc.have.ValidateSMTP())
+			} else {
+				assert.EqualError(t, tc.have.ValidateSMTP(), tc.expectedSMTP)
+			}
+
+			if tc.expectedHTTP == "" {
+				assert.NoError(t, tc.have.ValidateHTTP())
+			} else {
+				assert.EqualError(t, tc.have.ValidateHTTP(), tc.expectedHTTP)
+			}
+
+			if tc.expectedSQL == "" {
+				assert.NoError(t, tc.have.ValidateSQL())
+			} else {
+				assert.EqualError(t, tc.have.ValidateSQL(), tc.expectedSQL)
+			}
+
+			if tc.expectedListener == "" {
+				assert.NoError(t, tc.have.ValidateListener())
+			} else {
+				assert.EqualError(t, tc.have.ValidateListener(), tc.expectedListener)
+			}
+		})
+	}
+}
+
+func TestAddress_SetHostname(t *testing.T) {
+	address := &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0"}}
+
+	assert.Equal(t, "tcp://0.0.0.0", address.String())
+
+	address.SetHostname("127.0.0.1")
+
+	assert.Equal(t, "tcp://127.0.0.1", address.String())
+}
+
+func TestAddress_ListenerWithUMask(t *testing.T) {
+	dir := t.TempDir()
+
+	address := &Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: filepath.Join(dir, "example.sock")}}
+
+	ln, err := address.ListenerWithUMask(600)
+
+	assert.NotNil(t, ln)
+	assert.NoError(t, err)
+	assert.NoError(t, ln.Close())
+
+	address = &Address{true, true, 0, nil}
+
+	ln, err = address.ListenerWithUMask(600)
+
+	assert.Nil(t, ln)
+	assert.EqualError(t, err, "address url is nil")
+
+	address = &Address{true, false, 0, nil}
+
+	ln, err = address.ListenerWithUMask(600)
+
+	assert.Nil(t, ln)
+	assert.EqualError(t, err, "address url is nil")
+}
+
+func TestAddressOutputValues(t *testing.T) {
+	var (
+		address  *Address
+		listener net.Listener
+		err      error
+	)
+
+	address = &Address{}
+	assert.EqualError(t, address.validate(), "error validating the address: address url was nil")
+
+	address = &Address{false, false, 0, nil}
+
+	assert.Equal(t, "", address.String())
+	assert.Equal(t, "", address.Scheme())
+	assert.Equal(t, "", address.Host())
+	assert.Equal(t, "", address.Hostname())
+	assert.Equal(t, "", address.NetworkAddress())
+	assert.Equal(t, 0, address.Port())
+
+	listener, err = address.Listener()
+
+	assert.Nil(t, listener)
+	assert.EqualError(t, err, "address url is nil")
+
+	address = &Address{true, false, 8080, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:8080"}}
+
+	assert.Equal(t, "tcp://0.0.0.0:8080", address.String())
+	assert.Equal(t, "tcp", address.Scheme())
+	assert.Equal(t, "0.0.0.0:8080", address.Host())
+	assert.Equal(t, "0.0.0.0", address.Hostname())
+	assert.Equal(t, "0.0.0.0:8080", address.NetworkAddress())
+	assert.Equal(t, 8080, address.Port())
+
+	listener, err = address.Listener()
+
+	assert.NotNil(t, listener)
+	assert.NoError(t, err)
+
+	address = &Address{true, false, 0, nil}
+
+	assert.Equal(t, "", address.String())
+	assert.Equal(t, "", address.Scheme())
+	assert.Equal(t, "", address.Host())
+	assert.Equal(t, "", address.Hostname())
+	assert.Equal(t, "", address.NetworkAddress())
+	assert.Equal(t, 0, address.Port())
+
+	listener, err = address.Listener()
+
+	assert.Nil(t, listener)
+	assert.EqualError(t, err, "address url is nil")
+
+	address.SetHostname("abc123.com")
+	address.SetPort(50)
+
+	assert.Equal(t, "", address.String())
+	assert.Equal(t, "", address.Scheme())
+	assert.Equal(t, "", address.Host())
+	assert.Equal(t, "", address.Hostname())
+	assert.Equal(t, "", address.NetworkAddress())
+	assert.Equal(t, 0, address.Port())
+
+	listener, err = address.Listener()
+
+	assert.Nil(t, listener)
+	assert.EqualError(t, err, "address url is nil")
+
+	address = &Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}}
+
+	assert.Equal(t, "tcp://0.0.0.0:9091", address.String())
+	assert.Equal(t, "tcp", address.Scheme())
+	assert.Equal(t, "0.0.0.0:9091", address.Host())
+	assert.Equal(t, "0.0.0.0", address.Hostname())
+	assert.Equal(t, "0.0.0.0:9091", address.NetworkAddress())
+	assert.Equal(t, 9091, address.Port())
+
+	listener, err = address.Listener()
+
+	assert.NotNil(t, listener)
+	assert.NoError(t, err)
+
+	assert.NoError(t, listener.Close())
+
+	address.SetPort(9092)
+
+	assert.Equal(t, "tcp://0.0.0.0:9092", address.String())
+	assert.Equal(t, "tcp", address.Scheme())
+	assert.Equal(t, "0.0.0.0:9092", address.Host())
+	assert.Equal(t, "0.0.0.0", address.Hostname())
+	assert.Equal(t, "0.0.0.0:9092", address.NetworkAddress())
+	assert.Equal(t, 9092, address.Port())
+
+	listener, err = address.Listener()
+
+	assert.NotNil(t, listener)
+	assert.NoError(t, err)
+
+	assert.NoError(t, listener.Close())
+
+	address.SetHostname("example.com")
+
+	assert.Equal(t, "tcp://example.com:9092", address.String())
+	assert.Equal(t, "tcp", address.Scheme())
+	assert.Equal(t, "example.com:9092", address.Host())
+	assert.Equal(t, "example.com", address.Hostname())
+	assert.Equal(t, "example.com:9092", address.NetworkAddress())
+	assert.Equal(t, 9092, address.Port())
+}
+
+func TestNewAddressUnix(t *testing.T) {
+	have := NewAddressUnix("/abc/123")
+
+	require.NotNil(t, have)
+	assert.Equal(t, "unix:///abc/123", have.String())
+}
+
+func TestNewAddressFromNetworkValues(t *testing.T) {
+	have := NewAddressFromNetworkValues(AddressSchemeUDP, "av", 1)
+
+	require.NotNil(t, have)
+	assert.Equal(t, "udp://av:1", have.String())
+}
+
+func TestNewSMTPAddress(t *testing.T) {
+	testCases := []struct {
+		name                            string
+		haveScheme                      string
+		haveHost                        string
+		havePort                        int
+		expected                        string
+		expectedNetwork, expectedScheme string
+		expectedHostname                string
+		expectedPort                    int
+		expectedExplicitTLS             bool
+	}{
+		{
+			"ShouldParseUnknownSchemePort25",
+			"",
+			"hosta",
+			25,
+			"smtp://hosta:25",
+			"tcp",
+			"smtp",
+			"hosta",
+			25,
+			false,
+		},
+		{
+			"ShouldParseUnknownSchemePort465",
+			"",
+			"hostb",
+			465,
+			"submissions://hostb:465",
+			"tcp",
+			"submissions",
+			"hostb",
+			465,
+			true,
+		},
+		{
+			"ShouldParseUnknownSchemePort587",
+			"",
+			"hostc",
+			587,
+			"submission://hostc:587",
+			"tcp",
+			"submission",
+			"hostc",
+			587,
+			false,
+		},
+		{
+			"ShouldParseUnknownPortSchemeSMTP",
+			"smtp",
+			"hostd",
+			0,
+			"smtp://hostd:25",
+			"tcp",
+			"smtp",
+			"hostd",
+			25,
+			false,
+		},
+		{
+			"ShouldParseUnknownPortSchemeSUBMISSION",
+			"submission",
+			"hoste",
+			0,
+			"submission://hoste:587",
+			"tcp",
+			"submission",
+			"hoste",
+			587,
+			false,
+		},
+		{
+			"ShouldParseUnknownPortSchemeSUBMISSIONS",
+			"submissions",
+			"hostf",
+			0,
+			"submissions://hostf:465",
+			"tcp",
+			"submissions",
+			"hostf",
+			465,
+			true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			have := NewSMTPAddress(tc.haveScheme, tc.haveHost, tc.havePort)
+
+			assert.Equal(t, tc.expected, have.String())
+			assert.Equal(t, tc.expectedScheme, have.Scheme())
+			assert.Equal(t, tc.expectedNetwork, have.Network())
+			assert.Equal(t, tc.expectedHostname, have.Hostname())
+			assert.Equal(t, tc.expectedHostname, have.SocketHostname())
+			assert.Equal(t, tc.expectedPort, have.Port())
+			assert.Equal(t, tc.expectedExplicitTLS, have.IsExplicitlySecure())
+		})
+	}
+}
+
+func TestAddress_SocketHostname(t *testing.T) {
+	testCases := []struct {
+		name     string
+		have     Address
+		expected string
+	}{
+		{
+			"ShouldReturnHostname",
+			Address{true, false, 80, &url.URL{Scheme: AddressSchemeTCP, Host: "examplea:80"}},
+			"examplea",
+		},
+		{
+			"ShouldReturnPath",
+			Address{true, true, 80, &url.URL{Scheme: AddressSchemeUnix, Path: "/abc/123"}},
+			"/abc/123",
+		},
+		{
+			"ShouldReturnNothing",
+			Address{false, true, 80, &url.URL{Scheme: AddressSchemeUnix, Path: "/abc/123"}},
+			"",
+		},
+		{
+			"ShouldReturnNothingNil",
+			Address{true, true, 80, nil},
+			"",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.expected, tc.have.SocketHostname())
+		})
+	}
+}
+
+func TestAddress_IsTCP_IsUDP(t *testing.T) {
+	testCases := []struct {
+		name  string
+		have  Address
+		isTCP bool
+		isUDP bool
+	}{
+		{
+			"ShouldReturnTrueTCP",
+			Address{true, false, 80, &url.URL{Scheme: AddressSchemeTCP, Host: "tcphosta"}},
+			true,
+			false,
+		},
+		{
+			"ShouldReturnTrueTCP4",
+			Address{true, false, 80, &url.URL{Scheme: AddressSchemeTCP4, Host: "tcphostb"}},
+			true,
+			false,
+		},
+		{
+			"ShouldReturnTrueTCP6",
+			Address{true, false, 80, &url.URL{Scheme: AddressSchemeTCP6, Host: "tcphostc"}},
+			true,
+			false,
+		},
+		{
+			"ShouldReturnFalseUDP",
+			Address{true, false, 80, &url.URL{Scheme: AddressSchemeUDP, Host: "tcphostd"}},
+			false,
+			true,
+		},
+		{
+			"ShouldReturnFalseUDP4",
+			Address{true, false, 80, &url.URL{Scheme: AddressSchemeUDP4, Host: "tcphoste"}},
+			false,
+			true,
+		},
+		{
+			"ShouldReturnFalseUDP6",
+			Address{true, false, 80, &url.URL{Scheme: AddressSchemeUDP6, Host: "tcphostf"}},
+			false,
+			true,
+		},
+		{
+			"ShouldReturnFalseSMTP",
+			Address{true, false, 80, &url.URL{Scheme: AddressSchemeSMTP, Host: "tcphostg"}},
+			false,
+			false,
+		},
+		{
+			"ShouldReturnFalseUnix",
+			Address{true, true, 80, &url.URL{Scheme: AddressSchemeUnix, Host: "tcphosth"}},
+			false,
+			false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.isTCP, tc.have.IsTCP())
+			assert.Equal(t, tc.isUDP, tc.have.IsUDP())
+		})
+	}
+}
+
+func TestNewAddressFromNetworkValuesDefault(t *testing.T) {
+	testCases := []struct {
+		name                  string
+		haveHost              string
+		havePort              int
+		haveSchemeDefault     string
+		haveSchemeDefaultPath string
+		expected              string
+		expectedErr           string
+	}{
+		{
+			"ShouldParseTCPWithTCPUnix",
+			"cba",
+			80,
+			AddressSchemeTCP,
+			AddressSchemeUnix,
+			"tcp://cba:80",
+			"",
+		},
+		{
+			"ShouldParseTCPWithTCPUnixNoPort",
+			"cba",
+			0,
+			AddressSchemeTCP,
+			AddressSchemeUnix,
+			"tcp://cba:0",
+			"",
+		},
+		{
+			"ShouldParseUnixWithTCPUnix",
+			"/abc/123",
+			80,
+			AddressSchemeTCP,
+			AddressSchemeUnix,
+			"unix:///abc/123",
+			"",
+		},
+		{
+			"ShouldParseUnixWithScheme",
+			"unix:///abc/123",
+			0,
+			AddressSchemeTCP,
+			AddressSchemeUnix,
+			"unix:///abc/123",
+			"",
+		},
+		{
+			"ShouldErrBadURL",
+			"tcp://127.0.0.1:abc",
+			0,
+			AddressSchemeTCP,
+			AddressSchemeUnix,
+			"",
+			"could not parse string 'tcp://127.0.0.1:abc' as address: expected format is [<scheme>://]<hostname>[:<port>]: parse \"tcp://127.0.0.1:abc\": invalid port \":abc\" after host",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			actual, theError := NewAddressFromNetworkValuesDefault(tc.haveHost, tc.havePort, tc.haveSchemeDefault, tc.haveSchemeDefaultPath)
+
+			if tc.expectedErr == "" {
+				require.NoError(t, theError)
+				assert.Equal(t, tc.expected, actual.String())
+			} else {
+				assert.EqualError(t, theError, tc.expectedErr)
+				assert.Nil(t, actual)
+			}
+		})
+	}
+}

internal/configuration/schema/types_test.go

@@ -7,9 +7,6 @@ import (
 	"crypto/x509"
 	"encoding/pem"
 	"fmt"
-	"net"
-	"net/url"
-	"path/filepath"
 	"regexp"
 	"testing"
 
@@ -17,433 +14,6 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestNewAddressFromString(t *testing.T) {
-	testCases := []struct {
-		name                                         string
-		have                                         string
-		expected                                     *Address
-		expectedAddress, expectedString, expectedErr string
-	}{
-		{
-			"ShouldParseBasicAddress",
-			"tcp://0.0.0.0:9091",
-			&Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}},
-			"0.0.0.0:9091",
-			"tcp://0.0.0.0:9091",
-			"",
-		},
-		{
-			"ShouldParseEmptyAddress",
-			"",
-			&Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: ":0"}},
-			":0",
-			"tcp://:0",
-			"",
-		},
-		{
-			"ShouldParseAddressMissingScheme",
-			"0.0.0.0:9091",
-			&Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}},
-			"0.0.0.0:9091",
-			"tcp://0.0.0.0:9091",
-			"",
-		},
-		{
-			"ShouldParseUnixAddressMissingScheme",
-			"/var/run/example.sock",
-			&Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: "/var/run/example.sock"}},
-			"/var/run/example.sock",
-			"unix:///var/run/example.sock",
-			"",
-		},
-		{
-			"ShouldParseAddressMissingPort",
-			"tcp://0.0.0.0",
-			&Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:0"}},
-			"0.0.0.0:0",
-			"tcp://0.0.0.0:0",
-			"",
-		},
-		{
-			"ShouldParseUnixSocket",
-			"unix:///path/to/a/socket.sock",
-			&Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: "/path/to/a/socket.sock"}},
-			"/path/to/a/socket.sock",
-			"unix:///path/to/a/socket.sock",
-			"",
-		},
-		{
-			"ShouldNotParseUnixSocketWithHost",
-			"unix://ahost/path/to/a/socket.sock",
-			nil,
-			"",
-			"",
-			"error validating the unix socket address: the url 'unix://ahost/path/to/a/socket.sock' appears to have a host but this is not valid for unix sockets: this may occur if you omit the leading forward slash from the socket path",
-		},
-		{
-			"ShouldNotParseUnixSocketWithoutPath",
-			"unix://nopath.com",
-			nil,
-			"",
-			"",
-			"error validating the unix socket address: could not determine path from 'unix://nopath.com'",
-		},
-		{
-			"ShouldNotParseUnixSocketWithQuery",
-			"unix:///path/to/a/socket.sock?q=yes",
-			nil,
-			"",
-			"",
-			"error validating the address: the url 'unix:///path/to/a/socket.sock?q=yes' appears to have a query but this is not valid for addresses",
-		},
-		{
-			"ShouldNotParseUnixSocketWithFragment",
-			"unix:///path/to/a/socket.sock#example",
-			nil,
-			"",
-			"",
-			"error validating the address: the url 'unix:///path/to/a/socket.sock#example' appears to have a fragment but this is not valid for addresses",
-		},
-		{
-			"ShouldNotParseUnixSocketWithUserInfo",
-			"unix://user:example@/path/to/a/socket.sock",
-			nil,
-			"",
-			"",
-			"error validating the address: the url 'unix://user:example@/path/to/a/socket.sock' appears to have user info but this is not valid for addresses",
-		},
-		{
-			"ShouldParseUnknownScheme",
-			"a://0.0.0.0",
-			&Address{true, false, 0, &url.URL{Scheme: "a", Host: "0.0.0.0"}},
-			"0.0.0.0",
-			"a://0.0.0.0",
-			"",
-		},
-		{
-			"ShouldNotParseInvalidPort",
-			"tcp://0.0.0.0:abc",
-			nil,
-			"",
-			"",
-			"could not parse string 'tcp://0.0.0.0:abc' as address: expected format is [<scheme>://]<ip>[:<port>]: parse \"tcp://0.0.0.0:abc\": invalid port \":abc\" after host",
-		},
-		{
-			"ShouldNotParseInvalidAddress",
-			"@$@#%@#$@@",
-			nil,
-			"",
-			"",
-			"could not parse string '@$@#%@#$@@' as address: expected format is [<scheme>://]<ip>[:<port>]: parse \"tcp://@$@#%@#$@@\": invalid URL escape \"%@#\"",
-		},
-		{
-			"ShouldNotParseInvalidAddressWithScheme",
-			"tcp://@$@#%@#$@@",
-			nil,
-			"",
-			"",
-			"could not parse string 'tcp://@$@#%@#$@@' as address: expected format is [<scheme>://]<ip>[:<port>]: parse \"tcp://@$@#%@#$@@\": invalid URL escape \"%@#\"",
-		},
-		{
-			"ShouldSetDefaultPortLDAP",
-			"ldap://127.0.0.1",
-			&Address{true, false, 389, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1:389"}},
-			"127.0.0.1:389",
-			"ldap://127.0.0.1:389",
-			"",
-		},
-		{
-			"ShouldSetDefaultPortLDAPS",
-			"ldaps://127.0.0.1",
-			&Address{true, false, 636, &url.URL{Scheme: AddressSchemeLDAPS, Host: "127.0.0.1:636"}},
-			"127.0.0.1:636",
-			"ldaps://127.0.0.1:636",
-			"",
-		},
-		{
-			"ShouldAllowLDAPI",
-			"ldapi:///abc",
-			&Address{true, true, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: "/abc"}},
-			"/abc",
-			"ldapi:///abc",
-			"",
-		},
-		{
-			"ShouldAllowImplicitLDAPI",
-			"ldapi://",
-			&Address{true, true, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: ""}},
-			"",
-			"ldapi:",
-			"",
-		},
-		{
-			"ShouldAllowImplicitLDAPINoSlash",
-			"ldapi:",
-			&Address{true, true, 0, &url.URL{Scheme: AddressSchemeLDAPI, Path: ""}},
-			"",
-			"ldapi:",
-			"",
-		},
-		{
-			"ShouldSetDefaultPortSMTP",
-			"smtp://127.0.0.1",
-			&Address{true, false, 25, &url.URL{Scheme: AddressSchemeSMTP, Host: "127.0.0.1:25"}},
-			"127.0.0.1:25",
-			"smtp://127.0.0.1:25",
-			"",
-		},
-		{
-			"ShouldSetDefaultPortSUBMISSION",
-			"submission://127.0.0.1",
-			&Address{true, false, 587, &url.URL{Scheme: AddressSchemeSUBMISSION, Host: "127.0.0.1:587"}},
-			"127.0.0.1:587",
-			"submission://127.0.0.1:587",
-			"",
-		},
-		{
-			"ShouldSetDefaultPortSUBMISSIONS",
-			"submissions://127.0.0.1",
-			&Address{true, false, 465, &url.URL{Scheme: AddressSchemeSUBMISSIONS, Host: "127.0.0.1:465"}},
-			"127.0.0.1:465",
-			"submissions://127.0.0.1:465",
-			"",
-		},
-		{
-			"ShouldNotOverridePort",
-			"ldap://127.0.0.1:123",
-			&Address{true, false, 123, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1:123"}},
-			"127.0.0.1:123",
-			"ldap://127.0.0.1:123",
-			"",
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			actual, actualErr := NewAddress(tc.have)
-
-			if len(tc.expectedErr) != 0 {
-				assert.EqualError(t, actualErr, tc.expectedErr)
-			} else {
-				assert.Nil(t, actualErr)
-
-				assert.Equal(t, tc.expectedAddress, actual.NetworkAddress())
-				assert.Equal(t, tc.expectedString, actual.String())
-
-				assert.True(t, actual.Valid())
-			}
-
-			assert.Equal(t, tc.expected, actual)
-		})
-	}
-}
-
-func TestAddress_ValidateErrors(t *testing.T) {
-	testCases := []struct {
-		name                                                       string
-		have                                                       *Address
-		expectedLDAP, expectedSMTP, expectedHTTP, expectedListener string
-	}{
-		{
-			"ShouldValidateLDAPAddress",
-			&Address{true, false, 0, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1"}},
-			"",
-			"scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as 'ldap'",
-			"scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'ldap'",
-			"scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', or 'unix' but is configured as 'ldap'",
-		},
-		{
-			"ShouldValidateSMTPAddress",
-			&Address{true, false, 0, &url.URL{Scheme: AddressSchemeSMTP, Host: "127.0.0.1"}},
-			"scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as 'smtp'",
-			"",
-			"scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'smtp'",
-			"scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', or 'unix' but is configured as 'smtp'",
-		},
-		{
-			"ShouldValidateTCPAddress",
-			&Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "127.0.0.1"}},
-			"scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as 'tcp'",
-			"scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as 'tcp'",
-			"",
-			"",
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			if tc.expectedLDAP == "" {
-				assert.NoError(t, tc.have.ValidateLDAP())
-			} else {
-				assert.EqualError(t, tc.have.ValidateLDAP(), tc.expectedLDAP)
-			}
-
-			if tc.expectedSMTP == "" {
-				assert.NoError(t, tc.have.ValidateSMTP())
-			} else {
-				assert.EqualError(t, tc.have.ValidateSMTP(), tc.expectedSMTP)
-			}
-
-			if tc.expectedListener == "" {
-				assert.NoError(t, tc.have.ValidateListener())
-			} else {
-				assert.EqualError(t, tc.have.ValidateListener(), tc.expectedListener)
-			}
-
-			if tc.expectedHTTP == "" {
-				assert.NoError(t, tc.have.ValidateHTTP())
-			} else {
-				assert.EqualError(t, tc.have.ValidateHTTP(), tc.expectedHTTP)
-			}
-		})
-	}
-}
-
-func TestAddress_SetHostname(t *testing.T) {
-	address := &Address{true, false, 0, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0"}}
-
-	assert.Equal(t, "tcp://0.0.0.0", address.String())
-
-	address.SetHostname("127.0.0.1")
-
-	assert.Equal(t, "tcp://127.0.0.1", address.String())
-}
-
-func TestAddress_ListenerWithUMask(t *testing.T) {
-	dir := t.TempDir()
-
-	address := &Address{true, true, 0, &url.URL{Scheme: AddressSchemeUnix, Path: filepath.Join(dir, "example.sock")}}
-
-	ln, err := address.ListenerWithUMask(600)
-
-	assert.NotNil(t, ln)
-	assert.NoError(t, err)
-	assert.NoError(t, ln.Close())
-
-	address = &Address{true, true, 0, nil}
-
-	ln, err = address.ListenerWithUMask(600)
-
-	assert.Nil(t, ln)
-	assert.EqualError(t, err, "address url is nil")
-
-	address = &Address{true, false, 0, nil}
-
-	ln, err = address.ListenerWithUMask(600)
-
-	assert.Nil(t, ln)
-	assert.EqualError(t, err, "address url is nil")
-}
-
-func TestAddressOutputValues(t *testing.T) {
-	var (
-		address  *Address
-		listener net.Listener
-		err      error
-	)
-
-	address = &Address{}
-	assert.EqualError(t, address.validate(), "error validating the address: address url was nil")
-
-	address = &Address{false, false, 0, nil}
-
-	assert.Equal(t, "", address.String())
-	assert.Equal(t, "", address.Scheme())
-	assert.Equal(t, "", address.Host())
-	assert.Equal(t, "", address.Hostname())
-	assert.Equal(t, "", address.NetworkAddress())
-	assert.Equal(t, 0, address.Port())
-
-	listener, err = address.Listener()
-
-	assert.Nil(t, listener)
-	assert.EqualError(t, err, "address url is nil")
-
-	address = &Address{true, false, 8080, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:8080"}}
-
-	assert.Equal(t, "tcp://0.0.0.0:8080", address.String())
-	assert.Equal(t, "tcp", address.Scheme())
-	assert.Equal(t, "0.0.0.0:8080", address.Host())
-	assert.Equal(t, "0.0.0.0", address.Hostname())
-	assert.Equal(t, "0.0.0.0:8080", address.NetworkAddress())
-	assert.Equal(t, 8080, address.Port())
-
-	listener, err = address.Listener()
-
-	assert.NotNil(t, listener)
-	assert.NoError(t, err)
-
-	address = &Address{true, false, 0, nil}
-
-	assert.Equal(t, "", address.String())
-	assert.Equal(t, "", address.Scheme())
-	assert.Equal(t, "", address.Host())
-	assert.Equal(t, "", address.Hostname())
-	assert.Equal(t, "", address.NetworkAddress())
-	assert.Equal(t, 0, address.Port())
-
-	listener, err = address.Listener()
-
-	assert.Nil(t, listener)
-	assert.EqualError(t, err, "address url is nil")
-
-	address.SetHostname("abc123.com")
-	address.SetPort(50)
-
-	assert.Equal(t, "", address.String())
-	assert.Equal(t, "", address.Scheme())
-	assert.Equal(t, "", address.Host())
-	assert.Equal(t, "", address.Hostname())
-	assert.Equal(t, "", address.NetworkAddress())
-	assert.Equal(t, 0, address.Port())
-
-	listener, err = address.Listener()
-
-	assert.Nil(t, listener)
-	assert.EqualError(t, err, "address url is nil")
-
-	address = &Address{true, false, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}}
-
-	assert.Equal(t, "tcp://0.0.0.0:9091", address.String())
-	assert.Equal(t, "tcp", address.Scheme())
-	assert.Equal(t, "0.0.0.0:9091", address.Host())
-	assert.Equal(t, "0.0.0.0", address.Hostname())
-	assert.Equal(t, "0.0.0.0:9091", address.NetworkAddress())
-	assert.Equal(t, 9091, address.Port())
-
-	listener, err = address.Listener()
-
-	assert.NotNil(t, listener)
-	assert.NoError(t, err)
-
-	assert.NoError(t, listener.Close())
-
-	address.SetPort(9092)
-
-	assert.Equal(t, "tcp://0.0.0.0:9092", address.String())
-	assert.Equal(t, "tcp", address.Scheme())
-	assert.Equal(t, "0.0.0.0:9092", address.Host())
-	assert.Equal(t, "0.0.0.0", address.Hostname())
-	assert.Equal(t, "0.0.0.0:9092", address.NetworkAddress())
-	assert.Equal(t, 9092, address.Port())
-
-	listener, err = address.Listener()
-
-	assert.NotNil(t, listener)
-	assert.NoError(t, err)
-
-	assert.NoError(t, listener.Close())
-
-	address.SetHostname("example.com")
-
-	assert.Equal(t, "tcp://example.com:9092", address.String())
-	assert.Equal(t, "tcp", address.Scheme())
-	assert.Equal(t, "example.com:9092", address.Host())
-	assert.Equal(t, "example.com", address.Hostname())
-	assert.Equal(t, "example.com:9092", address.NetworkAddress())
-	assert.Equal(t, 9092, address.Port())
-}
-
 func TestNewTLSVersion(t *testing.T) {
 	testCases := []struct {
 		name     string

internal/configuration/test_resources/config.deprecated.alt.yml

@@ -0,0 +1,173 @@
+---
+default_redirection_url: https://home.example.com:8080/
+
+server:
+  address: "tcp://127.0.0.1:9091"
+  endpoints:
+    authz:
+      forward-auth:
+        implementation: ForwardAuth
+        authn_strategies:
+          - name: HeaderProxyAuthorization
+          - name: CookieSession
+      ext-authz:
+        implementation: ExtAuthz
+        authn_strategies:
+          - name: HeaderProxyAuthorization
+          - name: CookieSession
+      auth-request:
+        implementation: AuthRequest
+        authn_strategies:
+          - name: HeaderAuthRequestProxyAuthorization
+          - name: CookieSession
+      legacy:
+        implementation: Legacy
+
+log:
+  level: debug
+
+totp:
+  issuer: authelia.com
+
+duo_api:
+  hostname: api-123456789.example.com
+  integration_key: ABCDEF
+
+authentication_backend:
+  ldap:
+    url: 'ldap://127.0.0.1'
+    tls:
+      private_key: |
+        -----BEGIN RSA PRIVATE KEY-----
+        MIIEpAIBAAKCAQEA6z1LOg1ZCqb0lytXWZ+MRBpMHEXOoTOLYgfZXt1IYyE3Z758
+        cyalk0NYQhY5cZDsXPYWPvAHiPMUxutWkoxFwby56S+AbIMa3/Is+ILrHRJs8Exn
+        ZkpyrYFxPX12app2kErdmAkHSx0Z5/kuXiz96PHs8S8/ZbyZolLHzdfLtSzjvRm5
+        Zue5iFzsf19NJz5CIBfv8g5lRwtE8wNJoRSpn1xq7fqfuA0weDNFPzjlNWRLy6aa
+        rK7qJexRkmkCs4sLgyl+9NODYJpvmN8E1yhyC27E0joI6rBFVW7Ihv+cSPCdDzGp
+        EWe81x3AeqAa3mjVqkiq4u4Z2i8JDgBaPboqJwIDAQABAoIBAAFdLZ58jVOefDSU
+        L8F5R1rtvBs93GDa56f926jNJ6pLewLC+/2+757W+SAI+PRLntM7Kg3bXm/Q2QH+
+        Q1Y+MflZmspbWCdI61L5GIGoYKyeers59i+FpvySj5GHtLQRiTZ0+Kv1AXHSDWBm
+        9XneUOqU3IbZe0ifu1RRno72/VtjkGXbW8Mkkw+ohyGbIeTx/0/JQ6sSNZTT3Vk7
+        8i4IXptq3HSF0/vqZuah8rShoeNq72pD1YLM9YPdL5by1QkDLnqATDiCpLBTCaNV
+        I8sqYEun+HYbQzBj8ZACG2JVZpEEidONWQHw5BPWO95DSZYrVnEkuCqeH+u5vYt7
+        CHuJ3AECgYEA+W3v5z+j91w1VPHS0VB3SCDMouycAMIUnJPAbt+0LPP0scUFsBGE
+        hPAKddC54pmMZRQ2KIwBKiyWfCrJ8Xz8Yogn7fJgmwTHidJBr2WQpIEkNGlK3Dzi
+        jXL2sh0yC7sHvn0DqiQ79l/e7yRbSnv2wrTJEczOOH2haD7/tBRyCYECgYEA8W+q
+        E9YyGvEltnPFaOxofNZ8LHVcZSsQI5b6fc0iE7fjxFqeXPXEwGSOTwqQLQRiHn9b
+        CfPmIG4Vhyq0otVmlPvUnfBZ2OK+tl5X2/mQFO3ROMdvpi0KYa994uqfJdSTaqLn
+        jjoKFB906UFHnDQDLZUNiV1WwnkTglgLc+xrd6cCgYEAqqthyv6NyBTM3Tm2gcio
+        Ra9Dtntl51LlXZnvwy3IkDXBCd6BHM9vuLKyxZiziGx+Vy90O1xI872cnot8sINQ
+        Am+dur/tAEVN72zxyv0Y8qb2yfH96iKy9gxi5s75TnOEQgAygLnYWaWR2lorKRUX
+        bHTdXBOiS58S0UzCFEslGIECgYBqkO4SKWYeTDhoKvuEj2yjRYyzlu28XeCWxOo1
+        otiauX0YSyNBRt2cSgYiTzhKFng0m+QUJYp63/wymB/5C5Zmxi0XtWIDADpLhqLj
+        HmmBQ2Mo26alQ5YkffBju0mZyhVzaQop1eZi8WuKFV1FThPlB7hc3E0SM5zv2Grd
+        tQnOWwKBgQC40yZY0PcjuILhy+sIc0Wvh7LUA7taSdTye149kRvbvsCDN7Jh75lM
+        USjhLXY0Nld2zBm9r8wMb81mXH29uvD+tDqqsICvyuKlA/tyzXR+QTr7dCVKVwu0
+        1YjCJ36UpTsLre2f8nOSLtNmRfDPtbOE2mkOoO9dD9UU0XZwnvn9xw==
+        -----END RSA PRIVATE KEY-----
+    base_dn: dc=example,dc=com
+    username_attribute: uid
+    additional_users_dn: ou=users
+    users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
+    additional_groups_dn: ou=groups
+    groups_filter: (&(member={dn})(objectClass=groupOfNames))
+    group_name_attribute: cn
+    mail_attribute: mail
+    user: cn=admin,dc=example,dc=com
+
+access_control:
+  default_policy: deny
+
+  rules:
+    # Rules applied to everyone
+    - domain: public.example.com
+      policy: bypass
+
+    - domain: secure.example.com
+      policy: one_factor
+      # Network based rule, if not provided any network matches.
+      networks:
+        - 192.168.1.0/24
+    - domain: secure.example.com
+      policy: two_factor
+
+    - domain: [singlefactor.example.com, onefactor.example.com]
+      policy: one_factor
+
+    # Rules applied to 'admins' group
+    - domain: "mx2.mail.example.com"
+      subject: "group:admins"
+      policy: deny
+    - domain: "*.example.com"
+      subject: "group:admins"
+      policy: two_factor
+
+    # Rules applied to 'dev' group
+    - domain: dev.example.com
+      resources:
+        - "^/groups/dev/.*$"
+      subject: "group:dev"
+      policy: two_factor
+
+    # Rules applied to user 'john'
+    - domain: dev.example.com
+      resources:
+        - "^/users/john/.*$"
+      subject: "user:john"
+      policy: two_factor
+
+    # Rules applied to 'dev' group and user 'john'
+    - domain: dev.example.com
+      resources:
+        - "^/deny-all.*$"
+      subject: ["group:dev", "user:john"]
+      policy: deny
+
+    # Rules applied to user 'harry'
+    - domain: dev.example.com
+      resources:
+        - "^/users/harry/.*$"
+      subject: "user:harry"
+      policy: two_factor
+
+    # Rules applied to user 'bob'
+    - domain: "*.mail.example.com"
+      subject: "user:bob"
+      policy: two_factor
+    - domain: "dev.example.com"
+      resources:
+        - "^/users/bob/.*$"
+      subject: "user:bob"
+      policy: two_factor
+
+session:
+  name: authelia_session
+  expiration: 3600000  # 1 hour
+  inactivity: 300000  # 5 minutes
+  domain: example.com
+  redis:
+    host: 127.0.0.1
+    port: 6379
+    high_availability:
+      sentinel_name: test
+
+regulation:
+  max_retries: 3
+  find_time: 120
+  ban_time: 300
+
+storage:
+  postgres:
+    host: 127.0.0.1
+    port: 5432
+    database: authelia
+    username: authelia
+
+notifier:
+  smtp:
+    username: test
+    host: 127.0.0.1
+    port: 1025
+    sender: admin@example.com
+    disable_require_tls: true
+...

internal/configuration/test_resources/config.deprecated.yml

@@ -0,0 +1,173 @@
+---
+default_redirection_url: https://home.example.com:8080/
+
+server:
+  address: "tcp://127.0.0.1:9091"
+  endpoints:
+    authz:
+      forward-auth:
+        implementation: ForwardAuth
+        authn_strategies:
+          - name: HeaderProxyAuthorization
+          - name: CookieSession
+      ext-authz:
+        implementation: ExtAuthz
+        authn_strategies:
+          - name: HeaderProxyAuthorization
+          - name: CookieSession
+      auth-request:
+        implementation: AuthRequest
+        authn_strategies:
+          - name: HeaderAuthRequestProxyAuthorization
+          - name: CookieSession
+      legacy:
+        implementation: Legacy
+
+log:
+  level: debug
+
+totp:
+  issuer: authelia.com
+
+duo_api:
+  hostname: api-123456789.example.com
+  integration_key: ABCDEF
+
+authentication_backend:
+  ldap:
+    url: 'ldap://127.0.0.1'
+    tls:
+      private_key: |
+        -----BEGIN RSA PRIVATE KEY-----
+        MIIEpAIBAAKCAQEA6z1LOg1ZCqb0lytXWZ+MRBpMHEXOoTOLYgfZXt1IYyE3Z758
+        cyalk0NYQhY5cZDsXPYWPvAHiPMUxutWkoxFwby56S+AbIMa3/Is+ILrHRJs8Exn
+        ZkpyrYFxPX12app2kErdmAkHSx0Z5/kuXiz96PHs8S8/ZbyZolLHzdfLtSzjvRm5
+        Zue5iFzsf19NJz5CIBfv8g5lRwtE8wNJoRSpn1xq7fqfuA0weDNFPzjlNWRLy6aa
+        rK7qJexRkmkCs4sLgyl+9NODYJpvmN8E1yhyC27E0joI6rBFVW7Ihv+cSPCdDzGp
+        EWe81x3AeqAa3mjVqkiq4u4Z2i8JDgBaPboqJwIDAQABAoIBAAFdLZ58jVOefDSU
+        L8F5R1rtvBs93GDa56f926jNJ6pLewLC+/2+757W+SAI+PRLntM7Kg3bXm/Q2QH+
+        Q1Y+MflZmspbWCdI61L5GIGoYKyeers59i+FpvySj5GHtLQRiTZ0+Kv1AXHSDWBm
+        9XneUOqU3IbZe0ifu1RRno72/VtjkGXbW8Mkkw+ohyGbIeTx/0/JQ6sSNZTT3Vk7
+        8i4IXptq3HSF0/vqZuah8rShoeNq72pD1YLM9YPdL5by1QkDLnqATDiCpLBTCaNV
+        I8sqYEun+HYbQzBj8ZACG2JVZpEEidONWQHw5BPWO95DSZYrVnEkuCqeH+u5vYt7
+        CHuJ3AECgYEA+W3v5z+j91w1VPHS0VB3SCDMouycAMIUnJPAbt+0LPP0scUFsBGE
+        hPAKddC54pmMZRQ2KIwBKiyWfCrJ8Xz8Yogn7fJgmwTHidJBr2WQpIEkNGlK3Dzi
+        jXL2sh0yC7sHvn0DqiQ79l/e7yRbSnv2wrTJEczOOH2haD7/tBRyCYECgYEA8W+q
+        E9YyGvEltnPFaOxofNZ8LHVcZSsQI5b6fc0iE7fjxFqeXPXEwGSOTwqQLQRiHn9b
+        CfPmIG4Vhyq0otVmlPvUnfBZ2OK+tl5X2/mQFO3ROMdvpi0KYa994uqfJdSTaqLn
+        jjoKFB906UFHnDQDLZUNiV1WwnkTglgLc+xrd6cCgYEAqqthyv6NyBTM3Tm2gcio
+        Ra9Dtntl51LlXZnvwy3IkDXBCd6BHM9vuLKyxZiziGx+Vy90O1xI872cnot8sINQ
+        Am+dur/tAEVN72zxyv0Y8qb2yfH96iKy9gxi5s75TnOEQgAygLnYWaWR2lorKRUX
+        bHTdXBOiS58S0UzCFEslGIECgYBqkO4SKWYeTDhoKvuEj2yjRYyzlu28XeCWxOo1
+        otiauX0YSyNBRt2cSgYiTzhKFng0m+QUJYp63/wymB/5C5Zmxi0XtWIDADpLhqLj
+        HmmBQ2Mo26alQ5YkffBju0mZyhVzaQop1eZi8WuKFV1FThPlB7hc3E0SM5zv2Grd
+        tQnOWwKBgQC40yZY0PcjuILhy+sIc0Wvh7LUA7taSdTye149kRvbvsCDN7Jh75lM
+        USjhLXY0Nld2zBm9r8wMb81mXH29uvD+tDqqsICvyuKlA/tyzXR+QTr7dCVKVwu0
+        1YjCJ36UpTsLre2f8nOSLtNmRfDPtbOE2mkOoO9dD9UU0XZwnvn9xw==
+        -----END RSA PRIVATE KEY-----
+    base_dn: dc=example,dc=com
+    username_attribute: uid
+    additional_users_dn: ou=users
+    users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
+    additional_groups_dn: ou=groups
+    groups_filter: (&(member={dn})(objectClass=groupOfNames))
+    group_name_attribute: cn
+    mail_attribute: mail
+    user: cn=admin,dc=example,dc=com
+
+access_control:
+  default_policy: deny
+
+  rules:
+    # Rules applied to everyone
+    - domain: public.example.com
+      policy: bypass
+
+    - domain: secure.example.com
+      policy: one_factor
+      # Network based rule, if not provided any network matches.
+      networks:
+        - 192.168.1.0/24
+    - domain: secure.example.com
+      policy: two_factor
+
+    - domain: [singlefactor.example.com, onefactor.example.com]
+      policy: one_factor
+
+    # Rules applied to 'admins' group
+    - domain: "mx2.mail.example.com"
+      subject: "group:admins"
+      policy: deny
+    - domain: "*.example.com"
+      subject: "group:admins"
+      policy: two_factor
+
+    # Rules applied to 'dev' group
+    - domain: dev.example.com
+      resources:
+        - "^/groups/dev/.*$"
+      subject: "group:dev"
+      policy: two_factor
+
+    # Rules applied to user 'john'
+    - domain: dev.example.com
+      resources:
+        - "^/users/john/.*$"
+      subject: "user:john"
+      policy: two_factor
+
+    # Rules applied to 'dev' group and user 'john'
+    - domain: dev.example.com
+      resources:
+        - "^/deny-all.*$"
+      subject: ["group:dev", "user:john"]
+      policy: deny
+
+    # Rules applied to user 'harry'
+    - domain: dev.example.com
+      resources:
+        - "^/users/harry/.*$"
+      subject: "user:harry"
+      policy: two_factor
+
+    # Rules applied to user 'bob'
+    - domain: "*.mail.example.com"
+      subject: "user:bob"
+      policy: two_factor
+    - domain: "dev.example.com"
+      resources:
+        - "^/users/bob/.*$"
+      subject: "user:bob"
+      policy: two_factor
+
+session:
+  name: authelia_session
+  expiration: 3600000  # 1 hour
+  inactivity: 300000  # 5 minutes
+  domain: example.com
+  redis:
+    host: 127.0.0.1
+    port: 6379
+    high_availability:
+      sentinel_name: test
+
+regulation:
+  max_retries: 3
+  find_time: 120
+  ban_time: 300
+
+storage:
+  mysql:
+    host: 127.0.0.1
+    port: 3306
+    database: authelia
+    username: authelia
+
+notifier:
+  smtp:
+    username: test
+    host: 127.0.0.1
+    port: 1025
+    sender: admin@example.com
+    disable_require_tls: true
+...

internal/configuration/test_resources/config.filtered.yml

@@ -16,7 +16,7 @@ duo_api:
 
 authentication_backend:
   ldap:
-    url: 'ldap://{{ env "SERVICES_SERVER" }}'
+    address: 'ldap://{{ env "SERVICES_SERVER" }}'
     tls:
       private_key: |
         -----BEGIN RSA PRIVATE KEY-----
@@ -161,16 +161,14 @@ regulation:
 
 storage:
   mysql:
-    host: '{{ env "SERVICES_SERVER" }}'
+    address: 'tcp://{{ env "SERVICES_SERVER" }}:3306'
-    port: 3306
     database: authelia
     username: authelia
 
 notifier:
   smtp:
     username: test
-    host: '{{ env "SERVICES_SERVER" }}'
+    address: 'smtp://{{ env "SERVICES_SERVER" }}:1025'
-    port: 1025
     sender: 'admin@{{ env "ROOT_DOMAIN" }}'
     disable_require_tls: true
 

internal/configuration/test_resources/config.yml

@@ -1,41 +1,41 @@
 ---
-default_redirection_url: https://home.example.com:8080/
+default_redirection_url: 'https://home.example.com:8080/'
 
 server:
-  address: "tcp://127.0.0.1:9091"
+  address: 'tcp://127.0.0.1:9091'
   endpoints:
     authz:
       forward-auth:
-        implementation: ForwardAuth
+        implementation: 'ForwardAuth'
         authn_strategies:
-          - name: HeaderProxyAuthorization
+          - name: 'HeaderProxyAuthorization'
-          - name: CookieSession
+          - name: 'CookieSession'
       ext-authz:
-        implementation: ExtAuthz
+        implementation: 'ExtAuthz'
         authn_strategies:
-          - name: HeaderProxyAuthorization
+          - name: 'HeaderProxyAuthorization'
-          - name: CookieSession
+          - name: 'CookieSession'
       auth-request:
-        implementation: AuthRequest
+        implementation: 'AuthRequest'
         authn_strategies:
-          - name: HeaderAuthRequestProxyAuthorization
+          - name: 'HeaderAuthRequestProxyAuthorization'
-          - name: CookieSession
+          - name: 'CookieSession'
       legacy:
-        implementation: Legacy
+        implementation: 'Legacy'
 
 log:
-  level: debug
+  level: 'debug'
 
 totp:
-  issuer: authelia.com
+  issuer: 'authelia.com'
 
 duo_api:
-  hostname: api-123456789.example.com
+  hostname: 'api-123456789.example.com'
-  integration_key: ABCDEF
+  integration_key: 'ABCDEF'
 
 authentication_backend:
   ldap:
-    url: ldap://127.0.0.1
+    address: 'ldap://127.0.0.1'
     tls:
       private_key: |
         -----BEGIN RSA PRIVATE KEY-----
@@ -65,109 +65,107 @@ authentication_backend:
         USjhLXY0Nld2zBm9r8wMb81mXH29uvD+tDqqsICvyuKlA/tyzXR+QTr7dCVKVwu0
         1YjCJ36UpTsLre2f8nOSLtNmRfDPtbOE2mkOoO9dD9UU0XZwnvn9xw==
         -----END RSA PRIVATE KEY-----
-    base_dn: dc=example,dc=com
+    base_dn: 'dc=example,dc=com'
-    username_attribute: uid
+    username_attribute: 'uid'
-    additional_users_dn: ou=users
+    additional_users_dn: 'ou=users'
-    users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
+    users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))'
-    additional_groups_dn: ou=groups
+    additional_groups_dn: 'ou=groups'
-    groups_filter: (&(member={dn})(objectClass=groupOfNames))
+    groups_filter: '(&(member={dn})(objectClass=groupOfNames))'
-    group_name_attribute: cn
+    group_name_attribute: 'cn'
-    mail_attribute: mail
+    mail_attribute: 'mail'
-    user: cn=admin,dc=example,dc=com
+    user: 'cn=admin,dc=example,dc=com'
 
 access_control:
-  default_policy: deny
+  default_policy: 'deny'
 
   rules:
     # Rules applied to everyone
-    - domain: public.example.com
+    - domain: 'public.example.com'
-      policy: bypass
+      policy: 'bypass'
 
-    - domain: secure.example.com
+    - domain: 'secure.example.com'
-      policy: one_factor
+      policy: 'one_factor'
       # Network based rule, if not provided any network matches.
       networks:
-        - 192.168.1.0/24
+        - '192.168.1.0/24'
-    - domain: secure.example.com
+    - domain: 'secure.example.com'
-      policy: two_factor
+      policy: 'two_factor'
 
-    - domain: [singlefactor.example.com, onefactor.example.com]
+    - domain: ['singlefactor.example.com', 'onefactor.example.com']
-      policy: one_factor
+      policy: 'one_factor'
 
     # Rules applied to 'admins' group
-    - domain: "mx2.mail.example.com"
+    - domain: 'mx2.mail.example.com'
-      subject: "group:admins"
+      subject: 'group:admins'
-      policy: deny
+      policy: 'deny'
-    - domain: "*.example.com"
+    - domain: '*.example.com'
-      subject: "group:admins"
+      subject: 'group:admins'
-      policy: two_factor
+      policy: 'two_factor'
 
     # Rules applied to 'dev' group
-    - domain: dev.example.com
+    - domain: 'dev.example.com'
       resources:
-        - "^/groups/dev/.*$"
+        - '^/groups/dev/.*$'
-      subject: "group:dev"
+      subject: 'group:dev'
-      policy: two_factor
+      policy: 'two_factor'
 
     # Rules applied to user 'john'
-    - domain: dev.example.com
+    - domain: 'dev.example.com'
       resources:
-        - "^/users/john/.*$"
+        - '^/users/john/.*$'
-      subject: "user:john"
+      subject: 'user:john'
-      policy: two_factor
+      policy: 'two_factor'
 
     # Rules applied to 'dev' group and user 'john'
-    - domain: dev.example.com
+    - domain: 'dev.example.com'
       resources:
-        - "^/deny-all.*$"
+        - '^/deny-all.*$'
-      subject: ["group:dev", "user:john"]
+      subject: ['group:dev', 'user:john']
-      policy: deny
+      policy: 'deny'
 
     # Rules applied to user 'harry'
-    - domain: dev.example.com
+    - domain: 'dev.example.com'
       resources:
-        - "^/users/harry/.*$"
+        - '^/users/harry/.*$'
-      subject: "user:harry"
+      subject: 'user:harry'
-      policy: two_factor
+      policy: 'two_factor'
 
     # Rules applied to user 'bob'
-    - domain: "*.mail.example.com"
+    - domain: '*.mail.example.com'
-      subject: "user:bob"
+      subject: 'user:bob'
-      policy: two_factor
+      policy: 'two_factor'
-    - domain: "dev.example.com"
+    - domain: 'dev.example.com'
       resources:
-        - "^/users/bob/.*$"
+        - '^/users/bob/.*$'
-      subject: "user:bob"
+      subject: 'user:bob'
-      policy: two_factor
+      policy: 'two_factor'
 
 session:
-  name: authelia_session
+  name: 'authelia_session'
-  expiration: 3600000  # 1 hour
+  expiration: '1h'  # 1 hour
-  inactivity: 300000  # 5 minutes
+  inactivity: '5m'  # 5 minutes
-  domain: example.com
+  domain: 'example.com'
   redis:
-    host: 127.0.0.1
+    host: '127.0.0.1'
     port: 6379
     high_availability:
-      sentinel_name: test
+      sentinel_name: 'test'
 
 regulation:
   max_retries: 3
-  find_time: 120
+  find_time: '2m'
-  ban_time: 300
+  ban_time: '5m'
 
 storage:
   mysql:
-    host: 127.0.0.1
+    address: 'tcp://127.0.0.1:3306'
-    port: 3306
+    database: 'authelia'
-    database: authelia
+    username: 'authelia'
-    username: authelia
 
 notifier:
   smtp:
-    username: test
+    address: 'smtp://127.0.0.1:1025'
-    host: 127.0.0.1
+    username: 'test'
-    port: 1025
+    sender: 'admin@example.com'
-    sender: admin@example.com
     disable_require_tls: true
 ...

internal/configuration/test_resources/config_alt.yml

@@ -1,124 +1,122 @@
 ---
-default_redirection_url: https://home.example.com:8080/
+default_redirection_url: 'https://home.example.com:8080/'
 
 server:
-  address: "tcp://127.0.0.1:9091"
+  address: 'tcp://127.0.0.1:9091'
 
 log:
-  level: debug
+  level: 'debug'
 
 totp:
-  issuer: authelia.com
+  issuer: 'authelia.com'
 
 duo_api:
-  hostname: api-123456789.example.com
+  hostname: 'api-123456789.example.com'
-  integration_key: ABCDEF
+  integration_key: 'ABCDEF'
 
 authentication_backend:
   ldap:
-    url: ldap://127.0.0.1
+    address: 'ldap://127.0.0.1'
-    base_dn: dc=example,dc=com
+    base_dn: 'dc=example,dc=com'
-    username_attribute: uid
+    username_attribute: 'uid'
-    additional_users_dn: ou=users
+    additional_users_dn: 'ou=users'
-    users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
+    users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))'
-    additional_groups_dn: ou=groups
+    additional_groups_dn: 'ou=groups'
-    groups_filter: (&(member={dn})(objectClass=groupOfNames))
+    groups_filter: '(&(member={dn})(objectClass=groupOfNames))'
-    group_name_attribute: cn
+    group_name_attribute: 'cn'
-    mail_attribute: mail
+    mail_attribute: 'mail'
-    user: cn=admin,dc=example,dc=com
+    user: 'cn=admin,dc=example,dc=com'
 
 access_control:
-  default_policy: deny
+  default_policy: 'deny'
 
   rules:
     # Rules applied to everyone
-    - domain: public.example.com
+    - domain: 'public.example.com'
-      policy: bypass
+      policy: 'bypass'
 
-    - domain: secure.example.com
+    - domain: 'secure.example.com'
-      policy: one_factor
+      policy: 'one_factor'
       # Network based rule, if not provided any network matches.
       networks:
-        - 192.168.1.0/24
+        - '192.168.1.0/24'
-    - domain: secure.example.com
+    - domain: 'secure.example.com'
-      policy: two_factor
+      policy: 'two_factor'
 
-    - domain: [singlefactor.example.com, onefactor.example.com]
+    - domain: ['singlefactor.example.com', 'onefactor.example.com']
-      policy: one_factor
+      policy: 'one_factor'
 
     # Rules applied to 'admins' group
-    - domain: "mx2.mail.example.com"
+    - domain: 'mx2.mail.example.com'
-      subject: "group:admins"
+      subject: 'group:admins'
-      policy: deny
+      policy: 'deny'
-    - domain: "*.example.com"
+    - domain: '*.example.com'
-      subject: "group:admins"
+      subject: 'group:admins'
-      policy: two_factor
+      policy: 'two_factor'
 
     # Rules applied to 'dev' group
-    - domain: dev.example.com
+    - domain: 'dev.example.com'
       resources:
-        - "^/groups/dev/.*$"
+        - '^/groups/dev/.*$'
-      subject: "group:dev"
+      subject: 'group:dev'
-      policy: two_factor
+      policy: 'two_factor'
 
     # Rules applied to user 'john'
-    - domain: dev.example.com
+    - domain: 'dev.example.com'
       resources:
-        - "^/users/john/.*$"
+        - '^/users/john/.*$'
-      subject: "user:john"
+      subject: 'user:john'
-      policy: two_factor
+      policy: 'two_factor'
 
     # Rules applied to 'dev' group and user 'john'
-    - domain: dev.example.com
+    - domain: 'dev.example.com'
       resources:
-        - "^/deny-all.*$"
+        - '^/deny-all.*$'
-      subject: ["group:dev", "user:john"]
+      subject: ['group:dev', 'user:john']
-      policy: deny
+      policy: 'deny'
 
     # Rules applied to user 'harry'
-    - domain: dev.example.com
+    - domain: 'dev.example.com'
       resources:
-        - "^/users/harry/.*$"
+        - '^/users/harry/.*$'
-      subject: "user:harry"
+      subject: 'user:harry'
-      policy: two_factor
+      policy: 'two_factor'
 
     # Rules applied to user 'bob'
-    - domain: "*.mail.example.com"
+    - domain: '*.mail.example.com'
-      subject: "user:bob"
+      subject: 'user:bob'
-      policy: two_factor
+      policy: 'two_factor'
-    - domain: "dev.example.com"
+    - domain: 'dev.example.com'
       resources:
-        - "^/users/bob/.*$"
+        - '^/users/bob/.*$'
-      subject: "user:bob"
+      subject: 'user:bob'
-      policy: two_factor
+      policy: 'two_factor'
 
 session:
-  name: authelia_session
+  name: 'authelia_session'
-  expiration: 3600000  # 1 hour
+  expiration: '1h'  # 1 hour
-  inactivity: 300000  # 5 minutes
+  inactivity: '5m'  # 5 minutes
   remember_me: -1
-  domain: example.com
+  domain: 'example.com'
   redis:
-    host: 127.0.0.1
+    host: '127.0.0.1'
     port: 6379
 
 regulation:
   max_retries: 3
-  find_time: 120
+  find_time: '2m'
-  ban_time: 300
+  ban_time: '5m'
 
 storage:
   postgres:
-    host: 127.0.0.1
+    address: 'tcp://127.0.0.1:5432'
-    port: 3306
+    database: 'authelia'
-    database: authelia
+    username: 'authelia'
-    username: authelia
 
 notifier:
   smtp:
-    username: test
+    address: 'smtp://127.0.0.1:1025'
-    host: 127.0.0.1
+    username: 'test'
-    port: 1025
+    sender: 'Admin <admin@example.com>'
-    sender: Admin <admin@example.com>
     disable_require_tls: true
 ...

internal/configuration/test_resources/config_bad_keys.yml

@@ -1,124 +1,122 @@
 ---
-loggy_file: /config/svc.log
+loggy_file: '/config/svc.log'
 
-logs_level: debug
+logs_level: 'debug'
 
-default_redirection_url: https://home.example.com:8080/
+default_redirection_url: 'https://home.example.com:8080/'
 
 server:
-  address: "tcp://127.0.0.1:9091"
+  address: 'tcp://127.0.0.1:9091'
 
 totp:
-  issuer: authelia.com
+  issuer: 'authelia.com'
 
 duo_api:
-  hostname: api-123456789.example.com
+  hostname: 'api-123456789.example.com'
-  integration_key: ABCDEF
+  integration_key: 'ABCDEF'
 
 authentication_backend:
   ldap:
-    url: ldap://127.0.0.1
+    address: 'ldap://127.0.0.1'
-    base_dn: dc=example,dc=com
+    base_dn: 'dc=example,dc=com'
-    username_attribute: uid
+    username_attribute: 'uid'
-    additional_users_dn: ou=users
+    additional_users_dn: 'ou=users'
-    users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
+    users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))'
-    additional_groups_dn: ou=groups
+    additional_groups_dn: 'ou=groups'
-    groups_filter: (&(member={dn})(objectClass=groupOfNames))
+    groups_filter: '(&(member={dn})(objectClass=groupOfNames))'
-    group_name_attribute: cn
+    group_name_attribute: 'cn'
-    mail_attribute: mail
+    mail_attribute: 'mail'
-    user: cn=admin,dc=example,dc=com
+    user: 'cn=admin,dc=example,dc=com'
 
 access_control:
-  default_policy: deny
+  default_policy: 'deny'
 
   rules:
     # Rules applied to everyone
-    - domain: public.example.com
+    - domain: 'public.example.com'
-      policy: bypass
+      policy: 'bypass'
 
-    - domain: secure.example.com
+    - domain: 'secure.example.com'
-      policy: one_factor
+      policy: 'one_factor'
       # Network based rule, if not provided any network matches.
       networks:
-        - 192.168.1.0/24
+        - '192.168.1.0/24'
-    - domain: secure.example.com
+    - domain: 'secure.example.com'
-      policy: two_factor
+      policy: 'two_factor'
 
-    - domain: [singlefactor.example.com, onefactor.example.com]
+    - domain: ['singlefactor.example.com', 'onefactor.example.com']
-      policy: one_factor
+      policy: 'one_factor'
 
     # Rules applied to 'admins' group
-    - domain: "mx2.mail.example.com"
+    - domain: 'mx2.mail.example.com'
-      subject: "group:admins"
+      subject: 'group:admins'
-      policy: deny
+      policy: 'deny'
-    - domain: "*.example.com"
+    - domain: '*.example.com'
-      subject: "group:admins"
+      subject: 'group:admins'
-      policy: two_factor
+      policy: 'two_factor'
 
     # Rules applied to 'dev' group
-    - domain: dev.example.com
+    - domain: 'dev.example.com'
       resources:
-        - "^/groups/dev/.*$"
+        - '^/groups/dev/.*$'
-      subject: "group:dev"
+      subject: 'group:dev'
-      policy: two_factor
+      policy: 'two_factor'
 
     # Rules applied to user 'john'
-    - domain: dev.example.com
+    - domain: 'dev.example.com'
       resources:
-        - "^/users/john/.*$"
+        - '^/users/john/.*$'
-      subject: "user:john"
+      subject: 'user:john'
-      policy: two_factor
+      policy: 'two_factor'
 
     # Rules applied to 'dev' group and user 'john'
-    - domain: dev.example.com
+    - domain: 'dev.example.com'
       resources:
-        - "^/deny-all.*$"
+        - '^/deny-all.*$'
-      subject: ["group:dev", "user:john"]
+      subject: ['group:dev', 'user:john']
-      policy: deny
+      policy: 'deny'
 
     # Rules applied to user 'harry'
-    - domain: dev.example.com
+    - domain: 'dev.example.com'
       resources:
-        - "^/users/harry/.*$"
+        - '^/users/harry/.*$'
-      subject: "user:harry"
+      subject: 'user:harry'
-      policy: two_factor
+      policy: 'two_factor'
 
     # Rules applied to user 'bob'
-    - domain: "*.mail.example.com"
+    - domain: '*.mail.example.com'
-      subject: "user:bob"
+      subject: 'user:bob'
-      policy: two_factor
+      policy: 'two_factor'
-    - domain: "dev.example.com"
+    - domain: 'dev.example.com'
       resources:
-        - "^/users/bob/.*$"
+        - '^/users/bob/.*$'
-      subject: "user:bob"
+      subject: 'user:bob'
-      policy: two_factor
+      policy: 'two_factor'
 
 session:
-  name: authelia_session
+  name: 'authelia_session'
-  expiration: 3600000  # 1 hour
+  expiration: '1h'  # 1 hour
-  inactivity: 300000  # 5 minutes
+  inactivity: '5m'  # 5 minutes
-  domain: example.com
+  domain: 'example.com'
   redis:
-    host: 127.0.0.1
+    host: '127.0.0.1'
     port: 6379
 
 regulation:
   max_retries: 3
-  find_time: 120
+  find_time: '2m'
-  ban_time: 300
+  ban_time: '5m'
 
 storage:
   mysql:
-    host: 127.0.0.1
+    address: 'tcp://127.0.0.1:3306'
-    port: 3306
+    database: 'authelia'
-    database: authelia
+    username: 'authelia'
-    username: authelia
 
 notifier:
   smtp:
-    username: test
+    address: 'smtp://127.0.0.1:1025'
-    host: 127.0.0.1
+    username: 'test'
-    port: 1025
+    sender: 'admin@example.com'
-    sender: admin@example.com
     disable_require_tls: true
 ...

internal/configuration/test_resources/config_bad_quoting.yml

@@ -1,56 +1,54 @@
 ---
-jwt_secret: RUtG9TnbXrOl1XLLmDgySw1DGgx9QcrtepIf1uDDBlBVKFZxkVBruYKBi32PvaU
+jwt_secret: 'RUtG9TnbXrOl1XLLmDgySw1DGgx9QcrtepIf1uDDBlBVKFZxkVBruYKBi32PvaU'
 
-default_redirection_url: example.com
+default_redirection_url: 'example.com'
 
 server:
-  address: "tcp://0.0.0.0:9091"
+  address: 'tcp://:9091'
 
 log:
-  level: debug
+  level: 'debug'
 
 totp:
-  issuer: example.com
+  issuer: 'example.com'
   period: 30
   skew: 1
 
 authentication_backend:
   file:
-    path: /config/users_database.yml
+    path: '/config/users_database.yml'
 
 access_control:
-  default_policy: deny
+  default_policy: 'deny'
   rules:
-    - domain: example.com
+    - domain: 'example.com'
-      policy: bypass
+      policy: 'bypass'
-    - domain: *.example.com
+    - domain: '*.example.com'
-      policy: one_factor
+      policy: 'one_factor'
 
 session:
-  name: authelia_session
+  name: 'authelia_session'
-  secret: TVPMIcDFbBwhnW3kLJzKhdjeHhtqisr7m28FgRY8oLh2A4lwuV2jV2ZGdGbh4aa
+  secret: 'TVPMIcDFbBwhnW3kLJzKhdjeHhtqisr7m28FgRY8oLh2A4lwuV2jV2ZGdGbh4aa'
-  expiration: 3600
+  expiration: '1h'
-  inactivity: 300
+  inactivity: '5m'
-  domain: example.com
+  domain: 'example.com'
 
 regulation:
   max_retries: 3
-  find_time: 120
+  find_time: '2m'
-  ban_time: 300
+  ban_time: '5m'
 
 storage:
   mysql:
-    host: example.com
+    address: 'tcp://example.com:3306'
-    port: 3306
+    database: 'authelia'
-    database: authelia
+    username: 'authelia'
-    username: authelia
+    password: 'example.com'
-    password: example.com
 
 notifier:
   smtp:
-    username: example.com
+    address: 'submissions://smtp.gmail.com:465'
-    password: example.com
+    username: 'example.com'
-    host: smtp.gmail.com
+    password: 'example.com'
-    port: 465
+    sender: 'example.com'
-    sender: example.com
 ...

internal/configuration/test_resources/config_domain_bad_regex.yml

@@ -1,125 +1,123 @@
 ---
-default_redirection_url: https://home.example.com:8080/
+default_redirection_url: 'https://home.example.com:8080/'
 
 server:
-  address: "tcp://127.0.0.1:9091"
+  address: 'tcp://127.0.0.1:9091'
 
 log:
-  level: debug
+  level: 'debug'
 
 totp:
-  issuer: authelia.com
+  issuer: 'authelia.com'
 
 duo_api:
-  hostname: api-123456789.example.com
+  hostname: 'api-123456789.example.com'
-  integration_key: ABCDEF
+  integration_key: 'ABCDEF'
 
 authentication_backend:
   ldap:
-    url: ldap://127.0.0.1
+    address: 'ldap://127.0.0.1'
-    base_dn: dc=example,dc=com
+    base_dn: 'dc=example,dc=com'
-    username_attribute: uid
+    username_attribute: 'uid'
-    additional_users_dn: ou=users
+    additional_users_dn: 'ou=users'
-    users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
+    users_filter: '(&({username_attribute}={input})(objectCategory=person)(objectClass=user))'
-    additional_groups_dn: ou=groups
+    additional_groups_dn: 'ou=groups'
-    groups_filter: (&(member={dn})(objectClass=groupOfNames))
+    groups_filter: '(&(member={dn})(objectClass=groupOfNames))'
-    group_name_attribute: cn
+    group_name_attribute: 'cn'
-    mail_attribute: mail
+    mail_attribute: 'mail'
-    user: cn=admin,dc=example,dc=com
+    user: 'cn=admin,dc=example,dc=com'
 
 access_control:
-  default_policy: deny
+  default_policy: 'deny'
 
   rules:
     # Rules applied to everyone
-    - domain_regex: ^\K(public|public2).example.com$
+    - domain_regex: '^\K(public|public2).example.com$'
-      policy: bypass
+      policy: 'bypass'
 
-    - domain: secure.example.com
+    - domain: 'secure.example.com'
-      policy: one_factor
+      policy: 'one_factor'
       # Network based rule, if not provided any network matches.
       networks:
-        - 192.168.1.0/24
+        - '192.168.1.0/24'
-    - domain: secure.example.com
+    - domain: 'secure.example.com'
-      policy: two_factor
+      policy: 'two_factor'
 
-    - domain: [singlefactor.example.com, onefactor.example.com]
+    - domain: ['singlefactor.example.com', 'onefactor.example.com']
-      policy: one_factor
+      policy: 'one_factor'
 
     # Rules applied to 'admins' group
-    - domain: "mx2.mail.example.com"
+    - domain: 'mx2.mail.example.com'
-      subject: "group:admins"
+      subject: 'group:admins'
-      policy: deny
+      policy: 'deny'
-    - domain: "*.example.com"
+    - domain: '*.example.com'
-      subject: "group:admins"
+      subject: 'group:admins'
-      policy: two_factor
+      policy: 'two_factor'
 
     # Rules applied to 'dev' group
-    - domain: dev.example.com
+    - domain: 'dev.example.com'
       resources:
-        - "^/groups/dev/.*$"
+        - '^/groups/dev/.*$'
-      subject: "group:dev"
+      subject: 'group:dev'
-      policy: two_factor
+      policy: 'two_factor'
 
     # Rules applied to user 'john'
-    - domain: dev.example.com
+    - domain: 'dev.example.com'
       resources:
-        - "^/users/john/.*$"
+        - '^/users/john/.*$'
-      subject: "user:john"
+      subject: 'user:john'
-      policy: two_factor
+      policy: 'two_factor'
 
     # Rules applied to 'dev' group and user 'john'
-    - domain: dev.example.com
+    - domain: 'dev.example.com'
       resources:
-        - "^/deny-all.*$"
+        - '^/deny-all.*$'
-      subject: ["group:dev", "user:john"]
+      subject: ['group:dev', 'user:john']
-      policy: deny
+      policy: 'deny'
 
     # Rules applied to user 'harry'
-    - domain: dev.example.com
+    - domain: 'dev.example.com'
       resources:
-        - "^/users/harry/.*$"
+        - '^/users/harry/.*$'
-      subject: "user:harry"
+      subject: 'user:harry'
-      policy: two_factor
+      policy: 'two_factor'
 
     # Rules applied to user 'bob'
-    - domain: "*.mail.example.com"
+    - domain: '*.mail.example.com'
-      subject: "user:bob"
+      subject: 'user:bob'
-      policy: two_factor
+      policy: 'two_factor'
-    - domain: "dev.example.com"
+    - domain: 'dev.example.com'
       resources:
-        - "^/users/bob/.*$"
+        - '^/users/bob/.*$'
-      subject: "user:bob"
+      subject: 'user:bob'
-      policy: two_factor
+      policy: 'two_factor'
 
 session:
-  name: authelia_session
+  name: 'authelia_session'
-  expiration: 3600000  # 1 hour
+  expiration: '1h'  # 1 hour
-  inactivity: 300000  # 5 minutes
+  inactivity: '5m'  # 5 minutes
-  domain: example.com
+  domain: 'example.com'
   redis:
-    host: 127.0.0.1
+    host: '127.0.0.1'
     port: 6379
     high_availability:
-      sentinel_name: test
+      sentinel_name: 'test'
 
 regulation:
   max_retries: 3
-  find_time: 120
+  find_time: '2m'
-  ban_time: 300
+  ban_time: '5m'
 
 storage:
   mysql:
-    host: 127.0.0.1
+    address: 'tcp://127.0.0.1:3306'
-    port: 3306
+    database: 'authelia'
-    database: authelia
+    username: 'authelia'
-    username: authelia
 
 notifier:
   smtp:
-    username: test
+    address: 'smtp://127.0.0.1:1025'
-    host: 127.0.0.1
+    username: 'test'
-    port: 1025
+    sender: 'admin@example.com'
-    sender: admin@example.com
     disable_require_tls: true
 ...