79 lines
2.9 KiB
JSON
79 lines
2.9 KiB
JSON
{
|
|
"id": "authelia",
|
|
"name": "Authelia",
|
|
"description": "Open-source authentication and authorization server providing SSO, 2FA, forward-auth, and an OIDC provider for the homelab.",
|
|
"version": "3.0.0",
|
|
"category": "identity",
|
|
"tags": ["sso", "authentication", "2fa", "oidc", "forward-auth", "idp"],
|
|
"author": "Authelia",
|
|
"license": "Apache-2.0",
|
|
"homepage": "https://www.authelia.com",
|
|
"documentation": "https://www.authelia.com/configuration/prologue/introduction/",
|
|
"compose": {
|
|
"image": "authelia/authelia:4.39.14",
|
|
"container_name": "authelia",
|
|
"restart": "unless-stopped",
|
|
"ports": ["9091:9091"],
|
|
"volumes": [
|
|
"authelia_config:/config",
|
|
"./configuration.yml:/config/configuration.yml:ro",
|
|
"./users_database.yml:/config/users_database.yml:ro",
|
|
"./oidc-jwks.pem:/config/oidc-jwks.pem:ro"
|
|
],
|
|
"environment": [
|
|
"X_AUTHELIA_CONFIG_FILTERS=template"
|
|
],
|
|
"networks": ["homelab"]
|
|
},
|
|
"volumes": {
|
|
"authelia_config": {}
|
|
},
|
|
"networks": {
|
|
"homelab": { "external": true }
|
|
},
|
|
"env": [
|
|
{
|
|
"name": "STORAGE_ENCRYPTION_KEY",
|
|
"label": "Storage encryption key (auto-generated)",
|
|
"generate": true
|
|
},
|
|
{
|
|
"name": "RESET_JWT_SECRET",
|
|
"label": "Reset-password JWT secret (auto-generated)",
|
|
"generate": true
|
|
},
|
|
{
|
|
"name": "SESSION_SECRET",
|
|
"label": "Session secret (auto-generated)",
|
|
"generate": true
|
|
},
|
|
{
|
|
"name": "LDAP_ADMIN_PASSWORD",
|
|
"label": "LDAP admin password",
|
|
"description": "Must match lldap's LLDAP_LDAP_USER_PASS",
|
|
"default": "changeme-admin",
|
|
"required": false,
|
|
"secret": true
|
|
},
|
|
{
|
|
"name": "OIDC_HMAC_SECRET",
|
|
"label": "OIDC HMAC secret (auto-generated)",
|
|
"generate": true
|
|
},
|
|
{
|
|
"name": "OIDC_PORTAINER_SECRET",
|
|
"label": "Portainer OIDC client secret (auto-generated)",
|
|
"description": "Copy this value into Portainer's OAuth client-secret field",
|
|
"generate": true
|
|
}
|
|
],
|
|
"rsaKeys": [
|
|
{
|
|
"name": "OIDC_JWKS_KEY",
|
|
"path": "oidc-jwks.pem",
|
|
"bits": 2048
|
|
}
|
|
],
|
|
"dependsOn": ["lldap"],
|
|
"notes": "SSO / IdP: exposes a login portal (https://auth.example.com via nginx-proxy-manager) and a forward-auth endpoint (http://authelia:9091/api/authz/forward-auth). OIDC issuer: https://auth.example.com — discovery at /.well-known/openid-configuration. Two clients are pre-registered: 'portainer' (confidential, secret in OIDC_PORTAINER_SECRET) and 'multistreaming' (public + PKCE, no secret; redirect_uri https://streaming.example.com/api/auth/oidc/callback). For apps without OIDC (lldap web UI), protect them with a forward-auth auth_request block in nginx-proxy-manager's Advanced tab. The OIDC signing key (oidc-jwks.pem) is generated once by the installer and never rotated. Default access-control protects *.example.com with one factor; edit configuration.yml to change domains or require 2FA."
|
|
}
|