theme: light
default_2fa_method: totp

server:
  address: 'tcp://0.0.0.0:{{ authelia_port }}'

log:
  level: {{ authelia_log_level }}

totp:
  issuer: {{ authelia_domain }}

authentication_backend:
  file:
    path: /config/users_database.yml

access_control:
  default_policy: deny
  rules:
    - domain: "*.{{ authelia_domain }}"
      policy: two_factor

session:
  secret: {{ authelia_session_secret }}
  cookies:
    - name: authelia_session
      domain: {{ authelia_domain }}
      authelia_url: "https://auth.{{ authelia_domain }}"
      expiration: 12h
      inactivity: 1h

regulation:
  max_retries: 3
  find_time: 2m
  ban_time: 5m

storage:
  encryption_key: {{ authelia_storage_encryption_key }}
  local:
    path: /config/db.sqlite3

notifier:
  filesystem:
    filename: /config/notification.txt

identity_validation:
  reset_password:
    jwt_secret: {{ authelia_jwt_secret }}

identity_providers:
  oidc:
    jwks:
      - key_id: 'main-signing-key'
        algorithm: 'RS256'
        use: 'sig'
        key: |
          {{ authelia_jwks_privatekey | b64decode | indent(10) }}
    claims_policies:
      semaphore_claims_policy:
        id_token:
          - groups
          - email
          - email_verified
          - alt_emails
          - preferred_username
          - name
      wikijs_claims_policy:
        id_token:
          - groups
          - email
          - email_verified
          - alt_emails
          - preferred_username
          - name
    clients:
      - client_id: semaphore
        client_name: Semaphore
        client_secret: {{ authelia_semaphore_oidcsecret }}
        claims_policy: semaphore_claims_policy
        public: false
        authorization_policy: two_factor
        consent_mode: 'pre-configured'
        pre_configured_consent_duration: '1Y' # Reask consent for data share 1 year after first login
        redirect_uris:
          - https://semaphore.{{ authelia_domain }}/api/auth/oidc/authelia/redirect
        scopes:
          - openid
          - profile
          - email
        userinfo_signed_response_alg: none
      - client_id: wikijs
        client_name: Wiki
        client_secret: {{ wikijs_client_secret }}
        claims_policy: wikijs_claims_policy
        public: false
        authorization_policy: two_factor
        consent_mode: 'pre-configured'
        pre_configured_consent_duration: '1Y' # Reask consent for data share 1 year after first login
        require_pkce: false
        pkce_challenge_method: ''
        redirect_uris:
          - 'https://wikijs.{{ authelia_domain }}/login/{{ wikijs_uuid }}/callback'  # Note this must be copied during step 7 of the Application configuration.
        scopes:
          - openid
          - profile
          - email
          - groups
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_post'