---
###############################################################
#                Authelia minimal configuration               #
###############################################################

port: 9091
tls_cert: /config/ssl/cert.pem
tls_key: /config/ssl/key.pem

theme: auto

log:
  level: debug

authentication_backend:
  file:
    path: /config/users.yml

session:
  domain: example.com
  expiration: 3600  # 1 hour
  inactivity: 300  # 5 minutes
  remember_me_duration: 1y

storage:
  local:
    path: /tmp/db.sqlite3

totp:
  issuer: example.com

access_control:
  default_policy: deny

  rules:
    - domain: singlefactor.example.com
      policy: one_factor

    - domain: public.example.com
      policy: bypass

    - domain: secure.example.com
      policy: bypass
      methods:
        - OPTIONS

    - domain: secure.example.com
      policy: two_factor

    - domain: "*.example.com"
      subject: "group:admins"
      policy: two_factor

    - domain: dev.example.com
      resources:
        - "^/users/john/.*$"
      subject: "user:john"
      policy: two_factor

    - domain: dev.example.com
      resources:
        - "^/users/harry/.*$"
      subject: "user:harry"
      policy: two_factor

    - domain: "*.mail.example.com"
      subject: "user:bob"
      policy: two_factor

    - domain: dev.example.com
      resources:
        - "^/users/bob/.*$"
      subject: "user:bob"
      policy: two_factor

regulation:
  # Set it to 0 to disable max_retries.
  max_retries: 3
  # The user is banned if the authentication failed `max_retries` times in a `find_time` seconds window.
  find_time: 300
  # The length of time before a banned user can login again.
  ban_time: 900

notifier:
  smtp:
    host: smtp
    port: 1025
    sender: admin@example.com
    disable_require_tls: true
...