From c1e489cadf2da90ad79ced4f98ad2dfeb68a24a7 Mon Sep 17 00:00:00 2001 From: Keith Solomon Date: Fri, 17 Jul 2026 18:31:50 -0500 Subject: [PATCH] Initial commit --- authelia/config/configuration.yml | 89 +++++++ authelia/config/users_database.yml | 9 + backups/config.yml | 85 ++++++ backups/configuration.yml | 87 +++++++ docker-compose.yml | 127 +++++++++ traefik-gui/db/config.yaml | 1 + traefik-gui/db/db.sqlite | Bin 0 -> 24576 bytes traefik-gui/db/db.sqlite-shm | Bin 0 -> 32768 bytes traefik-gui/db/db.sqlite-wal | Bin 0 -> 4152 bytes .../backups/dynamic.yml.20260713_210522.bak | 232 +++++++++++++++++ .../backups/dynamic.yml.20260713_210838.bak | 236 +++++++++++++++++ .../backups/dynamic.yml.20260713_210944.bak | 239 +++++++++++++++++ .../backups/dynamic.yml.20260713_211817.bak | 244 ++++++++++++++++++ .../backups/dynamic.yml.20260713_211830.bak | 235 +++++++++++++++++ .../backups/dynamic.yml.20260713_211842.bak | 226 ++++++++++++++++ .../backups/dynamic.yml.20260713_211855.bak | 235 +++++++++++++++++ .../backups/dynamic.yml.20260713_221907.bak | 232 +++++++++++++++++ .../backups/dynamic.yml.20260713_222004.bak | 236 +++++++++++++++++ .../backups/dynamic.yml.20260713_222040.bak | 239 +++++++++++++++++ traefik-manager/config/.secret_key | 1 + traefik-manager/config/dashboard.yml | 13 + traefik-manager/config/dynamic.yml | 0 traefik-manager/config/manager.yml | 69 +++++ traefik-manager/config/notifications.yml | 9 + traefik/config/gui.yml | 244 ++++++++++++++++++ traefik/config/otlp.htpasswd | 1 + traefik/traefik.yml | 95 +++++++ 27 files changed, 3184 insertions(+) create mode 100644 authelia/config/configuration.yml create mode 100644 authelia/config/users_database.yml create mode 100644 backups/config.yml create mode 100644 backups/configuration.yml create mode 100644 docker-compose.yml create mode 100644 traefik-gui/db/config.yaml create mode 100644 traefik-gui/db/db.sqlite create mode 100644 traefik-gui/db/db.sqlite-shm create mode 100644 traefik-gui/db/db.sqlite-wal create mode 100644 traefik-manager/backups/dynamic.yml.20260713_210522.bak create mode 100644 traefik-manager/backups/dynamic.yml.20260713_210838.bak create mode 100644 traefik-manager/backups/dynamic.yml.20260713_210944.bak create mode 100644 traefik-manager/backups/dynamic.yml.20260713_211817.bak create mode 100644 traefik-manager/backups/dynamic.yml.20260713_211830.bak create mode 100644 traefik-manager/backups/dynamic.yml.20260713_211842.bak create mode 100644 traefik-manager/backups/dynamic.yml.20260713_211855.bak create mode 100644 traefik-manager/backups/dynamic.yml.20260713_221907.bak create mode 100644 traefik-manager/backups/dynamic.yml.20260713_222004.bak create mode 100644 traefik-manager/backups/dynamic.yml.20260713_222040.bak create mode 100644 traefik-manager/config/.secret_key create mode 100644 traefik-manager/config/dashboard.yml create mode 100644 traefik-manager/config/dynamic.yml create mode 100644 traefik-manager/config/manager.yml create mode 100644 traefik-manager/config/notifications.yml create mode 100644 traefik/config/gui.yml create mode 100644 traefik/config/otlp.htpasswd create mode 100644 traefik/traefik.yml diff --git a/authelia/config/configuration.yml b/authelia/config/configuration.yml new file mode 100644 index 0000000..2a8fb45 --- /dev/null +++ b/authelia/config/configuration.yml @@ -0,0 +1,89 @@ +--- +theme: dark + +server: + address: tcp://0.0.0.0:9091 + buffers: + read: 65536 + write: 65536 + +log: + level: info + format: text + file_path: /var/log/authelia/authelia.log + keep_stdout: true + +access_control: + default_policy: deny + networks: + - name: internal + networks: + - 192.168.2.0/24 + rules: + # Internal LAN can bypass auth for *.keithsolomon.net + - domain: "*.keithsolomon.net" + policy: bypass + networks: + - internal + + # Everything else hitting *.keithsolomon.net must at least single-factor auth + - domain: "*.keithsolomon.net" + policy: one_factor + +totp: + issuer: "keithsolomon.net" + period: 30 + skew: 1 + +authentication_backend: + refresh_interval: 5m + password_reset: + disable: false + file: + path: /config/users_database.yml + password: + algorithm: argon2id + iterations: 3 + salt_length: 16 + parallelism: 4 + memory: 65536 + +session: + name: authelia_session + secret: "{{ env `AUTHELIA_SESSION_SECRET` }}" + inactivity: 5d + expiration: 30d + remember_me: 30d + cookies: + - domain: "keithsolomon.net" + authelia_url: "https://auth.keithsolomon.net" + default_redirection_url: "https://keithsolomon.net" + name: "authelia_session" + inactivity: 5d + expiration: 30d + remember_me: 60d + +regulation: + max_retries: 5 + find_time: 120m + ban_time: 300m + +storage: + encryption_key: "{{ env `AUTHELIA_STORAGE_ENCRYPTION_KEY` }}" + local: + path: /config/db.sqlite3 + +notifier: + smtp: + address: submission://smtp.gmail.com:587 + username: "ksolomon@gmail.com" + sender: "ksolomon+authelia@gmail.com" + password: "jrbjskxtxcftkqsj" + subject: "[Authelia] %s" + +ntp: + address: time.cloudflare.com:123 + version: 3 + max_desync: 3s + disable_startup_check: false + disable_failure: false diff --git a/authelia/config/users_database.yml b/authelia/config/users_database.yml new file mode 100644 index 0000000..ff88adb --- /dev/null +++ b/authelia/config/users_database.yml @@ -0,0 +1,9 @@ +users: + keith: + disabled: false + displayname: 'Keith' + # to generate, run docker run authelia/authelia:latest authelia crypto hash generate argon2 -i 1 -p 8 -v argon2id --password your-password + password: '$argon2id$v=19$m=65536,t=1,p=8$RhfsQk15MuBOXOXVxKHAVw$s4aeGIpNi7V8ps96ATXSx8eBU2wJnmJS/kB0+hYhHqs' + email: 'keith@keithsolomon.net' + groups: + - 'admins' diff --git a/backups/config.yml b/backups/config.yml new file mode 100644 index 0000000..c8b1901 --- /dev/null +++ b/backups/config.yml @@ -0,0 +1,85 @@ +--- +theme: dark + +server: + address: tcp://0.0.0.0:9091 + buffers: + read: 65536 + write: 65536 + +access_control: + default_policy: deny + networks: + - name: internal + networks: + - 192.168.2.0/24 + rules: + - domain: "*.keithsolomon.net" + policy: bypass + networks: + - internal + - domain: "*.keithsolomon.net" + policy: one_factor + +log: + level: info + file_path: /logs/authelia.log + format: json + keep_stdout: true + +identity_validation: + reset_password: + jwt_secret: "{{ env `AUTHELIA_JWT_SECRET` }}" + +#default_redirection_url: https://auth.keithsolomon.net + +totp: + issuer: authelia.com + +# docker run authelia/authelia:latest authelia hash-password 'yourpassword' +authentication_backend: + refresh_interval: 5m + file: + path: /config/users_database.yml + password: + algorithm: argon2id + iterations: 1 + salt_length: 16 + parallelism: 8 + memory: 64 + +session: + name: authelia_session + inactivity: 5d # 5 day + expiration: 30d # 1 h + remember_me: 30d + cookies: + - domain: 'keithsolomon.net' + authelia_url: 'https://auth.keithsolomon.net' + default_redirection_url: 'https://keithsolomon.net' + name: 'authelia_session' + inactivity: 5d # 5 days + expiration: 30d # 30 days + remember_me: 60d # 60 days + +regulation: + max_retries: 5 + find_time: 120m + ban_time: 300m + +storage: + local: + path: /config/db.sqlite3 + +notifier: + smtp: + address: submission://smtp.gmail.com:587 + username: ksolomon@gmail.com + sender: ksolomon+authelia@gmail.com + +ntp: + address: time.cloudflare.com:123 + version: 3 + max_desync: 3s + disable_startup_check: false + disable_failure: false diff --git a/backups/configuration.yml b/backups/configuration.yml new file mode 100644 index 0000000..30bd8b2 --- /dev/null +++ b/backups/configuration.yml @@ -0,0 +1,87 @@ +--- +theme: dark + +server: + address: tcp://0.0.0.0:9091 + buffers: + read: 65536 + write: 65536 + +access_control: + default_policy: deny + networks: + - name: internal + networks: + - 192.168.2.0/24 + rules: + - domain: "*.keithsolomon.net" + policy: bypass + networks: + - internal + - domain: "*.keithsolomon.net" + policy: one_factor + +log: + level: info + file_path: /logs/authelia.log + format: json + keep_stdout: true + +#default_redirection_url: https://auth.keithsolomon.net + +totp: + issuer: authelia.com + +identity_validation: + reset_password: + jwt_secret: "{{ env `AUTHELIA_JWT_SECRET` }}" + +# docker run authelia/authelia:latest authelia hash-password 'yourpassword' +authentication_backend: + refresh_interval: 5m + file: + path: /config/users_database.yml + password: + algorithm: argon2id + iterations: 1 + salt_length: 16 + parallelism: 8 + memory: 64 + +session: + name: authelia_session + secret: "{{ env `AUTHELIA_SESSION_SECRET` }}" + inactivity: 5d # 5 days + expiration: 30d # 30 days + remember_me: 60d # 60 days + cookies: + - domain: 'keithsolomon.net' + authelia_url: 'https://auth.keithsolomon.net' + default_redirection_url: 'https://keithsolomon.net' + name: 'authelia_session' + inactivity: 5d # 5 days + expiration: 30d # 30 days + remember_me: 60d # 60 days + +regulation: + max_retries: 5 + find_time: 120m + ban_time: 300m + +storage: + encryption_key: "{{ env `AUTHELIA_STORAGE_ENCRYPTION_KEY` }}" + local: + path: /config/db.sqlite3 + +notifier: + smtp: + address: submission://smtp.gmail.com:587 + username: ksolomon@gmail.com + sender: ksolomon+authelia@gmail.com + +ntp: + address: time.cloudflare.com:123 + version: 3 + max_desync: 3s + disable_startup_check: false + disable_failure: false diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..7fd1033 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,127 @@ +services: + traefik: + container_name: Traefik + image: traefik:latest + restart: always + + networks: + traefik_macvlan: + ipv4_address: 192.168.2.253 # Traefik's LAN IP + proxy: {} + + volumes: + - /var/run/docker.sock:/var/run/docker.sock:ro + - ./traefik/traefik.yml:/traefik.yml:ro + - ./traefik/config:/traefik_config + - ./traefik/config/otlp.htpasswd:/etc/traefik/otlp.htpasswd:ro + - ./traefik/cert:/traefik_cert + - ./traefik/logs:/logs + + environment: + - TZ=America/Winnipeg + - CLOUDFLARE_API_KEY=${CLOUDFLARE_API_KEY} + - CLOUDFLARE_EMAIL=${CLOUDFLARE_EMAIL} + + labels: + - "traefik.enable=true" + + # Dashboard (behind Authelia) + - "traefik.http.routers.traefik.rule=Host(`tfk.keithsolomon.net`)" + - "traefik.http.routers.traefik.entrypoints=https" + - "traefik.http.routers.traefik.tls.certresolver=cloudflare" + - "traefik.http.routers.traefik.service=api@internal" + - "traefik.http.routers.traefik.middlewares=authelia@docker" + + authelia: + container_name: Authelia + restart: always + image: authelia/authelia:latest + + command: --config /config/configuration.yml + + networks: + - proxy + + volumes: + - ./authelia/config:/config + - ./authelia/secrets:/secrets:ro + - ./authelia/logs:/var/log/authelia + + environment: + - TZ=America/Winnipeg + - X_AUTHELIA_CONFIG_FILTERS=template + - AUTHELIA_SESSION_SECRET=${AUTHELIA_SESSION_SECRET} + - AUTHELIA_STORAGE_ENCRYPTION_KEY=${AUTHELIA_STORAGE_ENCRYPTION_KEY} + - AUTHELIA_LOG_LEVEL=debug + - AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET=${AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET} + + labels: + - "traefik.enable=true" + - "traefik.docker.network=proxy" + - "traefik.http.routers.authelia.rule=Host(`auth.keithsolomon.net`)" + - "traefik.http.routers.authelia.entrypoints=https" + - "traefik.http.routers.authelia.tls.certresolver=cloudflare" + + - "traefik.http.middlewares.authelia.forwardAuth.address=http://authelia:9091/api/authz/forward-auth" + - "traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader=true" + - "traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email" + + traefik-gui: + container_name: Traefik-GUI + restart: always + image: ghcr.io/rahn-it/traefik-gui:master + + networks: + - proxy + + volumes: + - ./traefik-gui/db:/app/db + - ./traefik/config:/app/traefik + + environment: + - TZ=America/Winnipeg + + labels: + - "traefik.enable=true" + - "traefik.docker.network=proxy" + - "traefik.http.routers.traefik-gui.rule=Host(`tfk-admin.keithsolomon.net`)" + - "traefik.http.routers.traefik-gui.entrypoints=https" + - "traefik.http.routers.traefik-gui.tls.certresolver=cloudflare" + - "traefik.http.routers.traefik-gui.middlewares=authelia@docker" + + traefik-manager: + container_name: traefik-manager + restart: unless-stopped + image: ghcr.io/chr0nzz/traefik-manager:latest + + environment: + - COOKIE_SECURE=false + - TZ=America/Winnipeg + + labels: + - "traefik.enable=true" + - "traefik.docker.network=proxy" + - "traefik.http.routers.traefik-manager.rule=Host(`tfkman.keithsolomon.net`)" + - "traefik.http.routers.traefik-manager.entrypoints=https" + - "traefik.http.routers.traefik-manager.tls.certresolver=cloudflare" + - "traefik.http.services.traefik-manager.loadbalancer.server.port=5000" + # - "traefik.http.routers.traefik-manager.middlewares=authelia@docker" + + networks: + - traefik_macvlan + - proxy + + ports: + - "5000:5000" + + volumes: + - ./traefik/config/gui.yml:/app/config/dynamic.yml + - ./traefik-manager/config:/app/config + - ./traefik-manager/backups:/app/backups + +networks: + traefik_macvlan: + external: true + proxy: + name: proxy + driver: bridge diff --git a/traefik-gui/db/config.yaml b/traefik-gui/db/config.yaml new file mode 100644 index 0000000..1a4bca3 --- /dev/null +++ b/traefik-gui/db/config.yaml @@ -0,0 +1 @@ +acme_provider_name: cloudflare diff --git a/traefik-gui/db/db.sqlite b/traefik-gui/db/db.sqlite new file mode 100644 index 0000000000000000000000000000000000000000..ec56dbff42e4d0fc45a73c421451c775ed0e4c2b GIT binary patch literal 24576 zcmeI4&r=&^7{@n(LVl1$>(odqb{Wdp%owt}A+UkcvLOL8q<~?mt(UM#UdRrc?7F)V zaK?kRC%t*mlNXQP91o5Mz1DxB9y~kFc=qV?ZW5Zz8#+A}d0u9dCC~GI_jx|=^DdLT z6s$+bv65txI?@frsGy@a!5{wT!9*g z^s#Jmpo2fXG!^frL+ZLsYS4j+R5J|oxI*13T8#!h;1NnZPL7Vpr>A{SW<83o(PQ}h z?8+d)=Y|W&k22`cur$YU8&EHYje+5MA<npnM>F6LakA9~z zFCeo1l7svo`o`mm;(NU8a}C;?x?Xsa2Z#p{=>P*>cXe_y_2m@5kQ`@tyVw zu^rIlA1LLu_m%SPjF9M`t9^5@+re(PD&Vgc?-zDe<^Il@2cIvjD|;oCU)w8}3tMXC z%q5iA^^e656(6U!>g2@v*ns!z6|L=>-tU$3?M8ZFElR@8T>?HPUOp4Z` zQ;|O--$eEz(TU$DzM3e7?QkmeUFf6G_29GU-=V*PUkA4*0^#3+FSGmKWrd1)BLO6U z1dsp{KmxBefzr(|7o6o*0xR)AV8hl9w3e3KR!cj~a*8O!w<<*$Hj<(~%t}hibPY>+ z8`N%s+9DSS?3#vNSM{d12i(BQ417mZ&d7obHb!Ut21rbE_W~;*v2M0ob^G*zsxsk# zMp}S&&~agO?!E;&H$W#1Iz`)TSz3LVh$KsL%4)Lxr;V1Nq1b>wr+?<79<40@a&96@fv7MaT|eqprOL1S8c=4nIs?#S(L?8 z!)y|_>%>T{UI(d3NQZ`#BhIJ9V1!`7OvnnUs%K>sTv#qs-tYqIK*{Nbq1xIJqeF)m zR^F;$cNm$wSG$4G5>biW)K3_JPDYXoR;GXS2QCs!a%+JC^xt>~#NO>@mA6gHBK0jo z>YaTD2Wn1ST#^@Lx#d|I)!Y;a-2fq4b=_&egatEzmfU$WU?m0`*P!BPW;+HMnpawy z7X%B8ObBDl9)Yf6#hDpeREY+yP0XQ%^cY>gEtsBWBHD6*RDAR0KK6UE`(>ovN=J7Jq z@7$TUKHithj%E?tAda^e=0JUVgDVPF&w+_1_A|HY4GtY)N;UZ*sqPhrWt5iFvU%Lr z2Q&(k5XTI+?3K78il@9v;I1@m-5jc1w2qS+I1Nb974!UPHyt`t@@>n|Yp}E6uqb3n z5UN`3sBN(&a@P+kbiQTi0BeR`wb?TBkjUxUF_=$L_p7Wb;cJ_`e&~C+4<4`8=Xh7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!Cu%2*fQ$AwYlt0RjXF5FkK+ t009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+0D*A{ya0KrC0_sl literal 0 HcmV?d00001 diff --git a/traefik-gui/db/db.sqlite-wal b/traefik-gui/db/db.sqlite-wal new file mode 100644 index 0000000000000000000000000000000000000000..a6babfe8f02ffa1186568d48a1b27fb9910b89ea GIT binary patch literal 4152 zcmeH|&ubG=5XaXa)ZP3PORa5zIfR_pd&D1BfDKY{7q%>)0cX4i8(*XvAlSWxf+hnG(R?KIG)C0V}gId;pkU4~G)Q6fd624F*++87|lrHk?` zAZlK()ADz&SXLavP~q9wbwQlD6Tle*jscuy-|KMNii7AxCk5`}_+f}2hEhyX3S+*H zqKjIos1}P|VMOtjHeDi9gmgkHqE>PM8Uv7+x@ZkhTCf3Pj#M|oGe=!!TBaq0rG!xEvS<`kb z2DcKv)=V+w8sExO@c9cN?)mEBs2s5=)gE{3CJo{*C0$h;wAt=)JR)-kfg<*;C>l&1 qyW!(83+J5}%`H5s@TDD4M&=IzWpB_{s83fI