adding Authelia to dal14

roles/authelia/defaults/main.yml

@@ -0,0 +1,12 @@
+authelia_base_dir: /opt/authelia
+authelia_config_dir: "{{ authelia_base_dir }}/config"
+authelia_data_dir: "{{ authelia_base_dir }}/data"
+
+authelia_image: authelia/authelia:4.38
+authelia_container_name: authelia
+authelia_network_name: authelia_net
+
+authelia_domain: example.com
+authelia_port: 9091
+
+authelia_log_level: info

roles/authelia/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: restart authelia
+  community.docker.docker_compose_v2:
+    project_src: "{{ authelia_base_dir }}"
+    state: present
+    recreate: always

roles/authelia/tasks/main.yml

@@ -0,0 +1,55 @@
+---
+- name: Create authelia directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0750"
+  loop:
+    - "{{ authelia_base_dir }}"
+    - "{{ authelia_config_dir }}"
+    - "{{ authelia_data_dir }}"
+
+- name: Deploy configuration.yml
+  ansible.builtin.template:
+    src: configuration.yml.j2
+    dest: "{{ authelia_config_dir }}/configuration.yml"
+    owner: root
+    group: root
+    mode: "0640"
+  notify: restart authelia
+
+- name: Deploy users_database.yml
+  ansible.builtin.template:
+    src: users_database.yml.j2
+    dest: "{{ authelia_config_dir }}/users_database.yml"
+    owner: root
+    group: root
+    mode: "0640"
+  notify: restart authelia
+  when: authelia_users is defined
+
+- name: Deploy docker-compose.yml
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "{{ authelia_base_dir }}/docker-compose.yml"
+    owner: root
+    group: root
+    mode: "0640"
+  register: compose_file
+
+- name: Pull and start authelia via docker compose
+  community.docker.docker_compose_v2:
+    project_src: "{{ authelia_base_dir }}"
+    state: present
+    pull: missing
+    
+- name: Deploy Caddyfile
+  ansible.builtin.template:
+    src: Caddyfile.j2
+    dest: "{{ authelia_base_dir }}/Caddyfile"
+    owner: root
+    group: root
+    mode: "0640"
+  notify: restart authelia

roles/authelia/templates/Caddyfile.j2

@@ -0,0 +1,3 @@
+auth.{{ authelia_domain }} {
+    reverse_proxy authelia:{{ authelia_port }}
+}

roles/authelia/templates/configuration.yml.j2

@@ -0,0 +1,50 @@
+theme: light
+default_2fa_method: totp
+
+server:
+  address: 'tcp://0.0.0.0:{{ authelia_port }}'
+
+log:
+  level: {{ authelia_log_level }}
+
+totp:
+  issuer: {{ authelia_domain }}
+
+authentication_backend:
+  file:
+    path: /config/users_database.yml
+
+access_control:
+  default_policy: deny
+  rules:
+    - domain: "*.{{ authelia_domain }}"
+      policy: two_factor
+
+session:
+  name: authelia_session
+  domain: {{ authelia_domain }}
+  expiration: 1h
+  inactivity: 5m
+
+regulation:
+  max_retries: 3
+  find_time: 2m
+  ban_time: 5m
+
+storage:
+  local:
+    path: /config/db.sqlite3
+
+notifier:
+  filesystem:
+    filename: /config/notification.txt
+
+identity_validation:
+  reset_password:
+    jwt_secret: "{{ authelia_jwt_secret }}"
+
+session:
+  secret: "{{ authelia_session_secret }}"
+
+storage:
+  encryption_key: "{{ authelia_storage_encryption_key }}"

roles/authelia/templates/docker-compose.yml.j2

@@ -0,0 +1,31 @@
+services:
+  authelia:
+    image: {{ authelia_image }}
+    container_name: {{ authelia_container_name }}
+    restart: unless-stopped
+    volumes:
+      - {{ authelia_config_dir }}:/config
+    networks:
+      - authelia_net
+    expose:
+      - "{{ authelia_port }}"
+    environment:
+      - TZ={{ ansible_facts.timezone | default('UTC') }}
+
+  caddy:
+    image: caddy:2
+    container_name: authelia_caddy
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - {{ authelia_base_dir }}/Caddyfile:/etc/caddy/Caddyfile
+      - {{ authelia_data_dir }}/caddy_data:/data
+      - {{ authelia_data_dir }}/caddy_config:/config
+    networks:
+      - authelia_net
+
+networks:
+  authelia_net:
+    driver: bridge

site.yml

@@ -25,3 +25,10 @@
   become: true
   roles:
     - postgres
+
+- name: authelia servers
+  hosts: authelia
+  become: true
+  roles:
+    - docker
+    - authelia