---
###############################################################
#                Authelia minimal configuration               #
###############################################################

jwt_secret: unsecure_secret
default_redirection_url: https://home.example.com:8080/

server:
  address: 'tcp://:9091'
  tls:
    certificate: /pki/public.backend.crt
    key: /pki/private.backend.pem

log:
  level: debug

authentication_backend:
  file:
    path: /config/users.yml

session:
  secret: unsecure_session_secret
  cookies:
    - name: 'authelia_sessin'
      domain: 'example.com'
      authelia_url: 'https://login.example.com:8080'
      inactivity: 5
      expiration: 8
      remember_me: 1y

storage:
  encryption_key: a_not_so_secure_encryption_key
  local:
    path: /config/db.sqlite

totp:
  issuer: example.com

access_control:
  default_policy: deny

  rules:
    - domain: singlefactor.example.com
      policy: one_factor

    - domain: "*.example.com"
      subject: "group:admins"
      policy: two_factor

    - domain: dev.example.com
      resources:
        - "^/users/john/.*$"
      subject: "user:john"
      policy: two_factor

    - domain: dev.example.com
      resources:
        - "^/users/harry/.*$"
      subject: "user:harry"
      policy: two_factor

    - domain: "*.mail.example.com"
      subject: "user:bob"
      policy: two_factor

    - domain: dev.example.com
      resources:
        - "^/users/bob/.*$"
      subject: "user:bob"
      policy: two_factor

regulation:
  max_retries: 3
  find_time: 5
  ban_time: 10

notifier:
  smtp:
    address: 'smtp://smtp:1025'
    sender: admin@example.com
    disable_require_tls: true
...