✨feature: Add basic Traefik/Authelia support files

assets/files/authelia/configuration.yml

@@ -0,0 +1,88 @@
+---
+theme: dark
+
+server:
+  address: tcp://0.0.0.0:9091
+  buffers:
+    read: 65536
+    write: 65536
+
+access_control:
+  default_policy: deny
+  networks:
+    - name: internal
+      networks:
+        - 192.168.2.0/24
+  rules:
+    - domain: "*.yourdomain.com"
+      policy: bypass
+      networks:
+        - internal
+    - domain: "*.yourdomain.com"
+      policy: one_factor
+
+log:
+  level: info
+  file_path: /logs/authelia.log
+  format: json
+  keep_stdout: true
+
+#default_redirection_url: https://auth.yourdomain.com
+
+totp:
+  issuer: authelia.com
+
+identity_validation:
+  reset_password:
+    jwt_secret: "{{ env `AUTHELIA_JWT_SECRET` }}"
+
+# docker run authelia/authelia:latest authelia crypto hash generate argon2 -i 1 -p 8 -v argon2id --password 'yourpassword'
+authentication_backend:
+  refresh_interval: 5m
+  file:
+    path: /config/users_database.yml
+    password:
+      algorithm: argon2id
+      iterations: 1
+      salt_length: 16
+      parallelism: 8
+      memory: 64
+
+session:
+  name: authelia_session
+  secret: "{{ env `AUTHELIA_SESSION_SECRET` }}"
+  inactivity: 5d   # 5 days
+  expiration: 30d  # 30 days
+  remember_me: 60d # 60 days
+  cookies:
+    - domain: 'yourdomain.com'
+      authelia_url: 'https://auth.yourdomain.com'
+      default_redirection_url: 'https://yourdomain.com'
+      name: 'authelia_session'
+      inactivity: 5d   # 5 days
+      expiration: 30d  # 30 days
+      remember_me: 60d # 60 days
+
+regulation:
+  max_retries: 5
+  find_time: 120m
+  ban_time: 300m
+
+storage:
+  encryption_key: "{{ env `AUTHELIA_STORAGE_ENCRYPTION_KEY` }}}"
+  local:
+    path: /config/db.sqlite3
+
+notifier:
+  smtp:
+    address: submission://smtp.gmail.com:587
+    username: "{{ env `AUTHELIA_NOTIFIER_USERNAME` }}"
+    password: "{{ env `AUTHELIA_NOTIFIER_PASSWORD` }}"
+    sender: ksolomon+authelia@gmail.com
+
+ntp:
+  address: time.cloudflare.com:123
+  version: 3
+  max_desync: 3s
+  disable_startup_check: false
+  disable_failure: false

assets/files/authelia/users_database.yml

@@ -0,0 +1,9 @@
+users:
+  user:
+    disabled: false
+    displayname: 'Your Name'
+    # to generate, run docker run authelia/authelia:latest authelia crypto hash generate argon2 -i 1 -p 8 -v argon2id --password your-password
+    password: 'your-hashed-password-here'
+    email: 'your-email@yourdomain.com'
+    groups:
+      - 'admins'

assets/files/traefik/.env.example

@@ -0,0 +1,9 @@
+CLOUDFLARE_API_KEY=your_cloudflare_api_key_here
+CLOUDFLARE_EMAIL=your_cloudflare_email_here
+
+# Gebnerate these secrets using openssl rand -hex 64
+AUTHELIA_SESSION_SECRET=your_session_secret_here
+AUTHELIA_STORAGE_ENCRYPTION_KEY=your_storage_encryption_key_here
+AUTHELIA_JWT_SECRET=your_jwt_secret_here
+AUTHELIA_NOTIFIER_USERNAME=your_email_here
+AUTHELIA_NOTIFIER_PASSWORD=your_email_app_password_here

assets/files/traefik/traefik-stack.yml

@@ -0,0 +1,93 @@
+services:
+  traefik:
+    container_name: Traefik
+    image: traefik:latest
+    restart: always
+
+    networks:
+      traefik_macvlan:
+        ipv4_address: 192.168.2.253   # Traefik's LAN IP
+      proxy: {}
+
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./traefik/traefik.yml:/traefik.yml:ro
+      - ./traefik/config:/traefik_config
+      - ./traefik/cert:/traefik_cert
+      - ./traefik/logs:/logs
+
+    environment:
+      - TZ=America/Winnipeg
+      - CLOUDFLARE_API_KEY=${CLOUDFLARE_API_KEY}
+      - CLOUDFLARE_EMAIL=${CLOUDFLARE_EMAIL}
+
+    labels:
+      - "traefik.enable=true"
+
+      # Dashboard (behind Authelia)
+      - "traefik.http.routers.traefik.rule=Host(`tfk.yourdomain.com`)"
+      - "traefik.http.routers.traefik.entrypoints=https"
+      - "traefik.http.routers.traefik.tls.certresolver=cloudflare"
+      - "traefik.http.routers.traefik.service=api@internal"
+      - "traefik.http.routers.traefik.middlewares=authelia@docker"
+
+  authelia:
+    container_name: Authelia
+    restart: always
+    image: authelia/authelia:latest
+
+    networks:
+      - proxy
+
+    volumes:
+      - ./authelia/config:/config
+      - ./authelia/secrets:/secrets:ro
+      - ./authelia/logs:/var/log/authelia
+
+    environment:
+      - TZ=America/Winnipeg
+      - X_AUTHELIA_CONFIG_FILTERS=template
+      - AUTHELIA_SESSION_SECRET=${AUTHELIA_SESSION_SECRET}
+      - AUTHELIA_STORAGE_ENCRYPTION_KEY=${AUTHELIA_STORAGE_ENCRYPTION_KEY}
+      - AUTHELIA_JWT_SECRET=${AUTHELIA_JWT_SECRET}
+
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+      - "traefik.http.routers.authelia.rule=Host(`auth.yourdomain.com`)"
+      - "traefik.http.routers.authelia.entrypoints=https"
+      - "traefik.http.routers.authelia.tls.certresolver=cloudflare"
+
+      - "traefik.http.middlewares.authelia.forwardAuth.address=http://authelia:9091/api/authz/forward-auth"
+      - "traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader=true"
+      - "traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email"
+
+  traefik-gui:
+    container_name: Traefik-GUI
+    restart: always
+    image: ghcr.io/rahn-it/traefik-gui:master
+
+    networks:
+      - proxy
+
+    volumes:
+      - ./traefik-gui/db:/app/db
+      - ./traefik/config:/app/traefik
+
+    environment:
+      - TZ=America/Winnipeg
+
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+      - "traefik.http.routers.traefik-gui.rule=Host(`tfk-admin.yourdomain.com`)"
+      - "traefik.http.routers.traefik-gui.entrypoints=https"
+      - "traefik.http.routers.traefik-gui.tls.certresolver=cloudflare"
+      - "traefik.http.routers.traefik-gui.middlewares=authelia@docker"
+
+networks:
+  traefik_macvlan:
+    external: true
+  proxy:
+    name: proxy
+    driver: bridge

assets/files/traefik/traefik.yml

@@ -0,0 +1,95 @@
+global:
+  # Send anonymous usage data
+  sendAnonymousUsage: true
+  checkNewVersion: true
+
+api:
+  dashboard: true
+  debug: true
+  disableDashboardAd: true
+
+log:
+  filePath: "/logs/logfile.log"
+  level: INFO
+  format: common
+
+accessLog:
+  filePath: "/logs/access.log"
+  # bufferingSize: 20
+  fields:
+    defaultMode: keep
+    names:
+      StartUTC: drop
+
+entryPoints:
+  http:
+    address: ":80"
+    http:
+      redirections:
+        entryPoint:
+          to: https
+          scheme: https
+          permanent: true
+
+  https:
+    address: ":443"
+    http:
+      tls:
+        # Generate a wildcard domain certificate
+        certResolver: cloudflare
+
+        domains:
+          - main: '*.yourdomain.com'
+
+    forwardedHeaders:
+      trustedIPs:
+        - "173.245.48.0/20"
+        - "103.21.244.0/22"
+        - "103.22.200.0/22"
+        - "103.31.4.0/22"
+        - "141.101.64.0/18"
+        - "108.162.192.0/18"
+        - "190.93.240.0/20"
+        - "188.114.96.0/20"
+        - "197.234.240.0/22"
+        - "198.41.128.0/17"
+        - "162.158.0.0/15"
+        - "104.16.0.0/13"
+        - "104.24.0.0/14"
+        - "172.64.0.0/13"
+        - "131.0.72.0/22"
+        - "2400:cb00::/32"
+        - "2606:4700::/32"
+        - "2803:f800::/32"
+        - "2405:b500::/32"
+        - "2405:8100::/32"
+        - "2a06:98c0::/29"
+        - "2c0f:f248::/32"
+
+serversTransport:
+  insecureSkipVerify: true
+
+providers:
+  providersThrottleDuration: 2s
+
+  docker:
+    endpoint: "unix:///var/run/docker.sock"
+    exposedByDefault: false
+    watch: true
+    network: proxy
+
+  file:
+    directory: "/traefik_config"
+    watch: true
+
+certificatesResolvers:
+  cloudflare:
+    acme:
+      email: ksolomon@gmail.com
+      storage: /traefik_cert/acme.json
+
+      dnsChallenge:
+        provider: cloudflare
+        resolvers:
+          - "1.1.1.1:53"
+          - "1.0.0.1:53"