updating the rest of the cojnfig from 1Y to 12M

group_vars/authelia/vault.yml

@@ -1,3 +1,58 @@
+authelia_users:
+  - username: ryan
+    displayname: "Ryan Toler"
+    email: ryan.toler@localhost.com
+    password_hash: !vault |
+      $ANSIBLE_VAULT;1.1;AES256
+      35333736646162393564633031316663303034313931346530623137343430643761363939376139
+      6339643131363361363931633836353666666232396665390a323436303536386134626365303730
+      32343662303437313430306438323061313562343633333136633161623434333665373237363562
+      6537363864616537650a616536303237646165306333333436343063356637363863323535646161
+      63373939333865646565623131313931343735666236623232656231613365313931366535346537
+      65303733303166396335376436383230616439656163356266373735666630376664366366623138
+      34323637613133343663613563316231653763363235633837643131393130643937386438333337
+      64653665336534303235363833623333346538333263336438623837643035303832343736643337
+      61633261326332346366353137313330373732616634343732316136303832333935
+    groups:
+      - admin
+      - user
+  - username: yulia
+    displayname: "Yulia Toler"
+    email: yulia.toler@localhost.com
+    password_hash: !vault |
+      $ANSIBLE_VAULT;1.1;AES256
+      37313261393630383935643135386462303538623437613535616536373036333838626431656533
+      6161313235633130333830313466333434383433386330620a333965656563386563666363383036
+      65616534353534393638373635616531323937363531393763343630633463666438396633323664
+      3366626565633839350a326562316635663731633938386566313537653530613061396431316438
+      64663939396561313532656331313735386434376535316438333865613561366563323962663532
+      64306663313237353337623434306463653733626337643139303238656265306132396536353738
+      61356133646365653633643932616264323635383364666534313765346564383963633339373534
+      33303066343632616336353765376631353762313538373635363637663765393133376431316332
+      39643130343932643561653830353733633234656338313465313031353463313732
+    groups:
+      - users
+wikijs_uuid: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  62303565643064643732353839373834353436363532313538303231623765363632663361666364
+  6631326465643739353130656132303462333530656236300a646630383964353235346136393961
+  34343363613138373566613539396130303539353335383934306231373634313831383135613439
+  3636626464323035620a633435623664306461616363346665336134363138646232353132653265
+  30643533396436303536646638633633313539316133653336343931613363313737636366653331
+  3734323836363861306638373262343035313938626132366664
+wikijs_client_secret: !vault |
+  $ANSIBLE_VAULT;1.1;AES256
+  64656630646633666130653734633463366364363035363238323539303731326261363230636431
+  6661353065636435653638623262366331633465616333640a313966366631396366346532306431
+  65333037303665373434613632303062613133383631333963366435313562643439613130353065
+  3430303561656335300a656337613862346439643139626634653563643732643064393939303134
+  62386537626138333361653364323935626437363766326362643931336532373631383266653764
+  33363366343164613234616232613763356433393537313436343736646438363261656236353863
+  31353532643339633635316332643562346435393664303265346534353665313065393564656166
+  36616664613139303734623662663934313435353536343932363834623038343535623738386661
+  38393862326636616165393134313964373936346566356264316639623630396131383233613862
+  37353432346530353161373831393633646464656265363138393961306361316563363433393465
+  323561653539386238623663343066363832
 authelia_jwt_secret: !vault |
   $ANSIBLE_VAULT;1.1;AES256
   34306239616233393235376564646464613833313332353365666264663735656536663133643736

roles/authelia/templates/Caddyfile.j2

@@ -1,35 +1,55 @@
 auth.{{ authelia_domain }} {
-    reverse_proxy authelia:{{ authelia_port }}
+    reverse_proxy 127.0.0.1:{{ authelia_port }}
 }
 
 # Reusable snippet for Authelia Forward Auth
 (authelia_auth) {
-    forward_auth http://authelia:9091 { # Replace with your Authelia IP/Port or container name
+    forward_auth http://127.0.0.1:9091 { # Replace with your Authelia IP/Port or container name
         uri /api/verify?rd=https://auth.frantecrt.duckdns.org # Replace with your public Authelia URL
         copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
     }
 }
 
-test.frantecrt.duckdns.org {
-    # Import the auth configuration block
-    import authelia_auth
-
-    # Route the traffic to your backend application if authenticated
-    reverse_proxy frantecrt.duckdns.org:8080
-}
-
 semaphore.frantecrt.duckdns.org {
     # Import the auth configuration block
     import authelia_auth
 
     # Route the traffic to your backend application if authenticated
-    reverse_proxy semaphore:3000
+    reverse_proxy semaphore.netbird.cloud:3000
 }
 
 git.frantecrt.duckdns.org {
     # Import the auth configuration block
+
+    # Route the traffic to your backend application if authenticated
+    reverse_proxy gitea.netbird.cloud:3000
+}
+
+wikijs.frantecrt.duckdns.org {
+    # Not using authelia_auth as it breaks the app's login page. 
+    reverse_proxy wikijs.netbird.cloud:3000
+    
+}
+
+vault.frantecrt.duckdns.org {
+    # Route the traffic to your backend application if authenticated
+    reverse_proxy wikijs.netbird.cloud:8080
+    reverse_proxy /notifications/hub* wikijs.netbird.cloud:3012
+    reverse_proxy /notifications/anonymous_hub* wikijs.netbird.cloud:3012
+}
+
+slskd.frantecrt.duckdns.org {
+    # Import the auth configuration block
     import authelia_auth
 
     # Route the traffic to your backend application if authenticated
-    reverse_proxy gitea:3000
+    reverse_proxy navidrome.netbird.cloud:5030
+}
+
+navidrome.frantecrt.duckdns.org {
+    # Import the auth configuration block
+    import authelia_auth
+
+    # Route the traffic to your backend application if authenticated
+    reverse_proxy navidrome.netbird.cloud:4533
 }

roles/authelia/templates/configuration.yml.j2

@@ -64,6 +64,14 @@ identity_providers:
           - alt_emails
           - preferred_username
           - name
+      wikijs_claims_policy:
+        id_token:
+          - groups
+          - email
+          - email_verified
+          - alt_emails
+          - preferred_username
+          - name
     clients:
       - client_id: semaphore
         client_name: Semaphore
@@ -71,6 +79,8 @@ identity_providers:
         claims_policy: semaphore_claims_policy
         public: false
         authorization_policy: two_factor
+        consent_mode: 'pre-configured'
+        pre_configured_consent_duration: '12M' # Reask consent for data share 1 year after first login
         redirect_uris:
           - https://semaphore.{{ authelia_domain }}/api/auth/oidc/authelia/redirect
         scopes:
@@ -78,3 +88,27 @@ identity_providers:
           - profile
           - email
         userinfo_signed_response_alg: none
+      - client_id: wikijs
+        client_name: Wiki
+        client_secret: {{ wikijs_client_secret }}
+        claims_policy: wikijs_claims_policy
+        public: false
+        authorization_policy: two_factor
+        consent_mode: 'pre-configured'
+        pre_configured_consent_duration: '12M' # Reask consent for data share 1 year after first login
+        require_pkce: false
+        pkce_challenge_method: ''
+        redirect_uris:
+          - 'https://wikijs.{{ authelia_domain }}/login/{{ wikijs_uuid }}/callback'  # Note this must be copied during step 7 of the Application configuration.
+        scopes:
+          - openid
+          - profile
+          - email
+          - groups
+        response_types:
+          - 'code'
+        grant_types:
+          - 'authorization_code'
+        access_token_signed_response_alg: 'none'
+        userinfo_signed_response_alg: 'none'
+        token_endpoint_auth_method: 'client_secret_post'

roles/authelia/templates/docker-compose.yml.j2

@@ -5,10 +5,8 @@ services:
     restart: unless-stopped
     volumes:
       - {{ authelia_config_dir }}:/config
-    networks:
-      - authelia_net
-    expose:
-      - "{{ authelia_port }}"
+    ports:
+      - "127.0.0.1:{{ authelia_port }}:{{ authelia_port }}"
     environment:
       - TZ={{ ansible_facts.timezone | default('UTC') }}
 
@@ -16,16 +14,9 @@ services:
     image: caddy:2
     container_name: authelia_caddy
     restart: unless-stopped
-    ports:
-      - "80:80"
-      - "443:443"
+    network_mode: host
     volumes:
+      - /etc/resolv.conf:/etc/resolv.conf:ro
       - {{ authelia_base_dir }}/Caddyfile:/etc/caddy/Caddyfile
       - {{ authelia_data_dir }}/caddy_data:/data
       - {{ authelia_data_dir }}/caddy_config:/config
-    networks:
-      - authelia_net
-
-networks:
-  authelia_net:
-    driver: bridge

roles/authelia/templates/users_database.yml.j2

@@ -0,0 +1,11 @@
+users:
+{% for user in authelia_users %}
+  {{ user.username }}:
+    displayname: "{{ user.displayname }}"
+    password: "{{ user.password_hash }}"
+    email: {{ user.email }}
+    groups:
+{% for group in user.groups %}
+      - {{ group }}
+{% endfor %}
+{% endfor %}

roles/security/defaults/main.yml

@@ -9,9 +9,9 @@ ssh_port: 25456
 # Netbird Setup key
 netbird_setup_key: !vault |
   $ANSIBLE_VAULT;1.1;AES256
-  63343331333665613537643565306536636437306562613731316434363936653838306237303336
-  6261396463623966613339646465366130313733373835380a636539386233306236633536336135
-  31656532376236343734656635306232333937626632366163313736356132383339623062616434
-  3034633436363830610a623239383631666230316534636332646533393139633664653961393364
-  61376664646338346437666530346433643135383635333138623662366263646136653061613334
-  3232626561633038653963356531353832393362356530393435
+  31643131346238616338346361313638623035643365366238663836393434373334623233653630
+  3161653330363836303238323739383464383261316630300a626463316164353535303331643962
+  31393937376565646234643263643836336137376635306636666631356262363538386266363964
+  6436306166313239360a373531626666343135623363333539626536303338303562633065373064
+  30636432356633653735333836313339346265656263363365323031656339646230313233386263
+  3433323337643565333564656365343063343163333035663233