Add homelab installer and services (allprox, authelia, lldap)

services/authelia/configuration.yml

@@ -0,0 +1,71 @@
+# Authelia configuration — https://www.authelia.com/configuration/prologue/introduction/
+#
+# Secrets (JWT_SECRET, RESET_JWT_SECRET, SESSION_SECRET, LDAP_ADMIN_PASSWORD) are
+# resolved from the service's .env by the installer and substituted into this file
+# on install/update, so they are not committed here.
+
+theme: dark
+
+jwt_secret: '${JWT_SECRET}'
+
+server:
+  address: 'tcp://0.0.0.0:9091/'
+  endpoints:
+    authz:
+      forward-auth:
+        implementation: 'ForwardAuth'
+
+log:
+  level: info
+
+totp:
+  issuer: 'homelab'
+
+identity_validation:
+  reset_password:
+    jwt_secret: '${RESET_JWT_SECRET}'
+
+authentication_backend:
+  password_reset:
+    disable: true
+  refresh_interval: '5m'
+  ldap:
+    implementation: 'lldap'
+    address: 'ldap://lldap:3890'
+    base_dn: 'dc=homelab,dc=local'
+    user: 'uid=admin,ou=people,dc=homelab,dc=local'
+    password: '${LDAP_ADMIN_PASSWORD}'
+
+access_control:
+  default_policy: deny
+  rules:
+    - domain: 'auth.example.com'
+      policy: bypass
+    - domain: 'portal.example.com'
+      policy: one_factor
+    - domain: '*.example.com'
+      policy: one_factor
+
+session:
+  name: 'authelia_session'
+  secret: '${SESSION_SECRET}'
+  expiration: '1h'
+  inactivity: '5m'
+  remember_me: '1M'
+  cookies:
+    - domain: 'example.com'
+      authelia_url: 'https://auth.example.com'
+      default_redirection_url: 'https://portal.example.com'
+
+regulation:
+  max_retries: 3
+  find_time: '2m'
+  ban_time: '5m'
+
+storage:
+  local:
+    path: '/config/db.sqlite3'
+
+notifier:
+  filesystem:
+    filename: '/config/notification.txt'

services/authelia/metadata.json

@@ -0,0 +1,57 @@
+{
+  "id": "authelia",
+  "name": "Authelia",
+  "description": "Open-source authentication and authorization server providing SSO and 2FA for the homelab.",
+  "version": "1.0.0",
+  "category": "identity",
+  "tags": ["sso", "authentication", "2fa", "oidc", "forward-auth"],
+  "author": "Authelia",
+  "license": "Apache-2.0",
+  "homepage": "https://www.authelia.com",
+  "documentation": "https://www.authelia.com/configuration/prologue/introduction/",
+  "compose": {
+    "image": "authelia/authelia:latest",
+    "container_name": "authelia",
+    "restart": "unless-stopped",
+    "ports": ["9091:9091"],
+    "volumes": [
+      "authelia_config:/config",
+      "./configuration.yml:/config/configuration.yml:ro",
+      "./users_database.yml:/config/users_database.yml:ro"
+    ],
+    "networks": ["homelab"]
+  },
+  "volumes": {
+    "authelia_config": {}
+  },
+  "networks": {
+    "homelab": { "external": true }
+  },
+  "env": [
+    {
+      "name": "JWT_SECRET",
+      "label": "JWT secret (auto-generated)",
+      "generate": true
+    },
+    {
+      "name": "RESET_JWT_SECRET",
+      "label": "Reset-password JWT secret (auto-generated)",
+      "generate": true
+    },
+    {
+      "name": "SESSION_SECRET",
+      "label": "Session secret (auto-generated)",
+      "generate": true
+    },
+    {
+      "name": "LDAP_ADMIN_PASSWORD",
+      "label": "LDAP admin password",
+      "description": "Must match lldap's LLDAP_LDAP_USER_PASS",
+      "default": "changeme-admin",
+      "required": false,
+      "secret": true
+    }
+  ],
+  "dependsOn": ["lldap"],
+  "notes": "Authelia's portal is normally reached through allprox at auth.example.com (see the allprox Caddyfile). The forward-auth endpoint is http://authelia:9091/api/authz/forward-auth. Default access-control rules protect portal.example.com and *.example.com — edit configuration.yml to match your domains."
+}

services/authelia/users_database.yml

@@ -0,0 +1,3 @@
+# Local users (file backend). We authenticate against LLDAP, so this stays empty.
+# Authelia still requires the file to exist.
+users: {}