---
theme: dark

server:
  address: tcp://0.0.0.0:9091
  buffers:
    read: 65536
    write: 65536

log:
  level: info
  format: text
  file_path: /var/log/authelia/authelia.log
  keep_stdout: true

access_control:
  default_policy: deny
  networks:
    - name: internal
      networks:
        - 192.168.2.0/24
  rules:
    # Internal LAN can bypass auth for *.keithsolomon.net
    - domain: "*.keithsolomon.net"
      policy: bypass
      networks:
        - internal

    # Everything else hitting *.keithsolomon.net must at least single-factor auth
    - domain: "*.keithsolomon.net"
      policy: one_factor

totp:
  issuer: "keithsolomon.net"
  period: 30
  skew: 1

authentication_backend:
  refresh_interval: 5m
  password_reset:
    disable: false
  file:
    path: /config/users_database.yml
    password:
      algorithm: argon2id
      iterations: 3
      salt_length: 16
      parallelism: 4
      memory: 65536

session:
  name: authelia_session
  secret: "{{ env `AUTHELIA_SESSION_SECRET` }}"
  inactivity: 5d
  expiration: 30d
  remember_me: 30d
  cookies:
    - domain: "keithsolomon.net"
      authelia_url: "https://auth.keithsolomon.net"
      default_redirection_url: "https://keithsolomon.net"
      name: "authelia_session"
      inactivity: 5d
      expiration: 30d
      remember_me: 60d

regulation:
  max_retries: 5
  find_time: 120m
  ban_time: 300m

storage:
  encryption_key: "{{ env `AUTHELIA_STORAGE_ENCRYPTION_KEY` }}"
  local:
    path: /config/db.sqlite3

notifier:
  smtp:
    address: submission://smtp.gmail.com:587
    username: "ksolomon@gmail.com"
    sender: "ksolomon+authelia@gmail.com"
    password: "jrbjskxtxcftkqsj"
    subject: "[Authelia] %s"

ntp:
  address: time.cloudflare.com:123
  version: 3
  max_desync: 3s
  disable_startup_check: false
  disable_failure: false