{
  "id": "authelia",
  "name": "Authelia",
  "description": "Open-source authentication and authorization server providing SSO and 2FA for the homelab.",
  "version": "1.0.0",
  "category": "identity",
  "tags": ["sso", "authentication", "2fa", "oidc", "forward-auth"],
  "author": "Authelia",
  "license": "Apache-2.0",
  "homepage": "https://www.authelia.com",
  "documentation": "https://www.authelia.com/configuration/prologue/introduction/",
  "compose": {
    "image": "authelia/authelia:latest",
    "container_name": "authelia",
    "restart": "unless-stopped",
    "ports": ["9091:9091"],
    "volumes": [
      "authelia_config:/config",
      "./configuration.yml:/config/configuration.yml:ro",
      "./users_database.yml:/config/users_database.yml:ro"
    ],
    "networks": ["homelab"]
  },
  "volumes": {
    "authelia_config": {}
  },
  "networks": {
    "homelab": { "external": true }
  },
  "env": [
    {
      "name": "JWT_SECRET",
      "label": "JWT secret (auto-generated)",
      "generate": true
    },
    {
      "name": "RESET_JWT_SECRET",
      "label": "Reset-password JWT secret (auto-generated)",
      "generate": true
    },
    {
      "name": "SESSION_SECRET",
      "label": "Session secret (auto-generated)",
      "generate": true
    },
    {
      "name": "LDAP_ADMIN_PASSWORD",
      "label": "LDAP admin password",
      "description": "Must match lldap's LLDAP_LDAP_USER_PASS",
      "default": "changeme-admin",
      "required": false,
      "secret": true
    }
  ],
  "dependsOn": ["lldap"],
  "notes": "Authelia's portal is normally reached through allprox at auth.example.com (see the allprox Caddyfile). The forward-auth endpoint is http://authelia:9091/api/authz/forward-auth. Default access-control rules protect portal.example.com and *.example.com — edit configuration.yml to match your domains."
}