diff --git a/charts/premium/authelia/templates/_configmap.tpl b/charts/premium/authelia/templates/_configmap.tpl deleted file mode 100644 index 7cdce1be9c3..00000000000 --- a/charts/premium/authelia/templates/_configmap.tpl +++ /dev/null @@ -1,387 +0,0 @@ -{{/* Define the configmap */}} -{{- define "authelia.configmap.paths" -}} -enabled: true -data: - AUTHELIA_SERVER_DISABLE_HEALTHCHECK: "true" - AUTHELIA_JWT_SECRET_FILE: "/secrets/JWT_TOKEN" - AUTHELIA_SESSION_SECRET_FILE: "/secrets/SESSION_ENCRYPTION_KEY" - AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: "/secrets/ENCRYPTION_KEY" - AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE: "/secrets/STORAGE_PASSWORD" - {{- if .Values.authentication_backend.ldap.enabled }} - AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE: "/secrets/LDAP_PASSWORD" - {{- end }} - {{- if .Values.notifier.smtp.enabled }} - AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE: "/secrets/SMTP_PASSWORD" - {{- end }} - AUTHELIA_SESSION_REDIS_PASSWORD_FILE: "/secrets/REDIS_PASSWORD" - {{- if .Values.redisProvider.high_availability.enabled }} - AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_PASSWORD_FILE: "/secrets/REDIS_SENTINEL_PASSWORD" - {{- end }} - {{- if .Values.duo_api.enabled }} - AUTHELIA_DUO_API_SECRET_KEY_FILE: "/secrets/DUO_API_KEY" - {{- end }} - {{- if .Values.identity_providers.oidc.enabled }} - AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE: "/secrets/OIDC_HMAC_SECRET" - AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE: "/secrets/OIDC_PRIVATE_KEY" - {{- end }} - -{{- end -}} - -{{- define "authelia.configmap.configfile" -}} -enabled: true -data: - configuration.yaml: | - --- - theme: {{ .Values.theme | default "light" }} - default_redirection_url: {{ default (printf "https://www.%s" .Values.domain) .Values.default_redirection_url }} - ntp: - address: {{ .Values.ntp.address | default "time.cloudflare.com:123" }} - version: {{ .Values.ntp.version | default 4 }} - max_desync: {{ .Values.ntp.max_desync | default "3s" }} - disable_startup_check: {{ .Values.ntp.disable_startup_check | default false }} - disable_failure: {{ .Values.ntp.disable_failure | default true }} - server: - host: 0.0.0.0 - port: {{ .Values.server.port | default 9091 }} - {{- if ne "" (.Values.server.path | default "") }} - path: {{ .Values.server.path }} - {{- end }} - buffers: - write: {{ .Values.server.write_buffer_size | default 4096 }} - read: {{ .Values.server.read_buffer_size | default 4096 }} - enable_pprof: {{ .Values.server.enable_pprof | default false }} - enable_expvars: {{ .Values.server.enable_expvars | default false }} - log: - level: {{ .Values.log.level | default "info" }} - format: {{ .Values.log.format | default "text" }} - {{- if ne "" (.Values.log.file_path | default "") }} - file_path: {{ .Values.log.file_path }} - keep_stdout: true - {{- end }} - totp: - issuer: {{ .Values.totp.issuer | default .Values.domain }} - period: {{ .Values.totp.period | default 30 }} - skew: {{ .Values.totp.skew | default 1 }} - {{- if .Values.password_policy.enabled }} - password_policy: - standard: - enabled: {{ .Values.password_policy.standard.enabled | default false }} - min_length: {{ .Values.password_policy.standard.min_length | default 8 }} - max_length: {{ .Values.password_policy.standard.max_length | default 0 }} - require_uppercase: {{ .Values.password_policy.standard.require_uppercase | default false }} - require_lowercase: {{ .Values.password_policy.standard.require_lowercase | default false }} - require_number: {{ .Values.password_policy.standard.require_number | default false }} - require_special: {{ .Values.password_policy.standard.require_special | default false }} - zxcvbn: - enabled: {{ .Values.password_policy.zxcvbn.enabled | default false }} - min_score: {{ .Values.password_policy.zxcvbn.min_score | default 3 }} - {{- end -}} - {{- if .Values.duo_api.enabled }} - duo_api: - hostname: {{ .Values.duo_api.hostname }} - integration_key: {{ .Values.duo_api.integration_key }} - {{- end -}} - {{- with $auth := .Values.authentication_backend }} - authentication_backend: - password_reset: - disable: {{ $auth.disable_reset_password }} - {{- if $auth.file.enabled }} - file: - path: {{ $auth.file.path }} - password: - {{- $p := $auth.file.password -}} - {{- if $p.algorithm }} - algorithm: {{ $p.algorithm }} - {{- end -}} - {{- if $p.iterations }} - iterations: {{ $p.iterations }} - {{- end -}} - {{- if $p.key_length }} - key_length: {{ $p.key_length }} - {{- end -}} - {{- if $p.salt_length }} - salt_length: {{ $p.salt_length }} - {{- end -}} - {{- if $p.memory }} - memory: {{ $p.memory }} - {{- end -}} - {{- if $p.parallelism }} - parallelism: {{ $p.parallelism }} - {{- end -}} - {{- end -}} - {{- if $auth.ldap.enabled }} - ldap: - implementation: {{ $auth.ldap.implementation | default "custom" }} - url: {{ $auth.ldap.url }} - timeout: {{ $auth.ldap.timeout | default "5s" }} - start_tls: {{ $auth.ldap.start_tls }} - tls: - {{- if hasKey $auth.ldap.tls "server_name" }} - server_name: {{ $auth.ldap.tls.server_name | default $auth.ldap.host }} - {{- end }} - minimum_version: {{ $auth.ldap.tls.minimum_version | default "TLS1.2" }} - skip_verify: {{ $auth.ldap.tls.skip_verify | default false }} - {{- if $auth.ldap.base_dn }} - base_dn: {{ $auth.ldap.base_dn }} - {{- end -}} - {{- if $auth.ldap.username_attribute }} - username_attribute: {{ $auth.ldap.username_attribute }} - {{- end -}} - {{- if $auth.ldap.additional_users_dn }} - additional_users_dn: {{ $auth.ldap.additional_users_dn }} - {{- end -}} - {{- if $auth.ldap.users_filter }} - users_filter: {{ $auth.ldap.users_filter }} - {{- end -}} - {{- if $auth.ldap.additional_groups_dn }} - additional_groups_dn: {{ $auth.ldap.additional_groups_dn }} - {{- end -}} - {{- if $auth.ldap.groups_filter }} - groups_filter: {{ $auth.ldap.groups_filter }} - {{- end -}} - {{- if $auth.ldap.group_name_attribute }} - group_name_attribute: {{ $auth.ldap.group_name_attribute }} - {{- end -}} - {{- if $auth.ldap.mail_attribute }} - mail_attribute: {{ $auth.ldap.mail_attribute }} - {{- end -}} - {{- if $auth.ldap.display_name_attribute }} - display_name_attribute: {{ $auth.ldap.display_name_attribute }} - {{- end }} - user: {{ $auth.ldap.user }} - {{- end -}} - {{- end -}} - {{- with $session := .Values.session }} - session: - name: {{ $session.name | default "authelia_session" }} - domain: {{ required "A valid .Values.domain entry required!" $.Values.domain }} - same_site: {{ $session.same_site | default "lax" }} - expiration: {{ $session.expiration | default "1M" }} - inactivity: {{ $session.inactivity | default "5m" }} - remember_me_duration: {{ $session.remember_me_duration | default "1M" }} - {{- end }} - redis: - host: {{ .Values.redis.creds.plain }} - {{- with $redis := .Values.redisProvider }} - port: {{ $redis.port | default 6379 }} - {{- if not (eq $redis.username "") }} - username: {{ $redis.username }} - {{- end }} - maximum_active_connections: {{ $redis.maximum_active_connections | default 8 }} - minimum_idle_connections: {{ $redis.minimum_idle_connections | default 0 }} - {{- if $redis.tls.enabled }} - tls: - server_name: {{ $redis.tls.server_name }} - minimum_version: {{ $redis.tls.minimum_version | default "TLS1.2" }} - skip_verify: {{ $redis.tls.skip_verify }} - {{- end }} - {{- if $redis.high_availability.enabled }} - high_availability: - sentinel_name: {{ $redis.high_availability.sentinel_name }} - {{- if $redis.high_availability.nodes }} - nodes: - {{- range $node := $redis.high_availability.nodes }} - - host: {{ $node.host }} - port: {{ $node.port | default 26379 }} - {{- end -}} - {{- end }} - route_by_latency: {{ $redis.high_availability.route_by_latency }} - route_randomly: {{ $redis.high_availability.route_randomly }} - {{- end }} - {{- end }} - regulation: - max_retries: {{ .Values.regulation.max_retries | default 3 }} - find_time: {{ .Values.regulation.find_time | default "1m" }} - ban_time: {{ .Values.regulation.ban_time | default "5m" }} - storage: - postgres: - host: {{ $.Values.cnpg.main.creds.host }} - {{- with $storage := .Values.storage }} - port: {{ $storage.postgres.port | default 5432 }} - database: {{ $storage.postgres.database | default "authelia" }} - username: {{ $storage.postgres.username | default "authelia" }} - timeout: {{ $storage.postgres.timeout | default "5s" }} - ssl: - mode: {{ $storage.postgres.sslmode | default "disable" }} - {{- end }} - {{- with $notifier := .Values.notifier }} - notifier: - disable_startup_check: {{ $.Values.notifier.disable_startup_check }} - {{- if $notifier.filesystem.enabled }} - filesystem: - filename: {{ $notifier.filesystem.filename }} - {{- end }} - {{- if $notifier.smtp.enabled }} - smtp: - host: {{ $notifier.smtp.host }} - port: {{ $notifier.smtp.port | default 25 }} - timeout: {{ $notifier.smtp.timeout | default "5s" }} - {{- with $notifier.smtp.username }} - username: {{ . }} - {{- end }} - sender: {{ $notifier.smtp.sender | quote }} - identifier: {{ $notifier.smtp.identifier | quote }} - subject: {{ $notifier.smtp.subject | quote }} - startup_check_address: {{ $notifier.smtp.startup_check_address | quote }} - disable_require_tls: {{ $notifier.smtp.disable_require_tls }} - disable_html_emails: {{ $notifier.smtp.disable_html_emails }} - tls: - server_name: {{ $notifier.smtp.tls.server_name | default $notifier.smtp.host }} - minimum_version: {{ $notifier.smtp.tls.minimum_version | default "TLS1.2" }} - skip_verify: {{ $notifier.smtp.tls.skip_verify | default false }} - {{- end }} - {{- end }} - {{- if .Values.identity_providers.oidc.enabled }} - identity_providers: - oidc: - access_token_lifespan: {{ .Values.identity_providers.oidc.access_token_lifespan | default "1h" }} - authorize_code_lifespan: {{ .Values.identity_providers.oidc.authorize_code_lifespan | default "1m" }} - id_token_lifespan: {{ .Values.identity_providers.oidc.id_token_lifespan | default "1h" }} - refresh_token_lifespan: {{ .Values.identity_providers.oidc.refresh_token_lifespan | default "90m" }} - enable_client_debug_messages: {{ .Values.identity_providers.oidc.enable_client_debug_messages | default false }} - minimum_parameter_entropy: {{ .Values.identity_providers.oidc.minimum_parameter_entropy | default 8 }} - {{- if .Values.identity_providers.oidc.clients }} - clients: - {{- range $client := .Values.identity_providers.oidc.clients }} - - id: {{ $client.id }} - description: {{ $client.description | default $client.id }} - {{- if $client.public }} - public: {{ $client.public }} - secret: "" - {{- else }} - secret: {{ $client.secret | required "Client secret is required" }} - {{- end }} - authorization_policy: {{ $client.authorization_policy | default "two_factor" }} - consent_mode: {{ $client.consent_mode | default "auto" }} - redirect_uris: - {{- range $client.redirect_uris }} - - {{ . }} - {{- end }} - {{- if $client.audience }} - audience: - {{- range $client.audience }} - - {{ . }} - {{- end }} - {{- end }} - scopes: - {{- range ($client.scopes | default (list "openid" "profile" "email" "groups")) }} - - {{ . }} - {{- end }} - grant_types: - {{- range ($client.grant_types | default (list "refresh_token" "authorization_code")) }} - - {{ . }} - {{- end }} - response_types: - {{- range ($client.response_types | default (list "code")) }} - - {{ . }} - {{- end }} - {{- if $client.response_modes }} - response_modes: - {{- range $client.response_modes }} - - {{ . }} - {{- end }} - {{- end }} - {{- with $client.token_endpoint_auth_method }} - token_endpoint_auth_method: {{ . }} - {{- end }} - userinfo_signing_algorithm: {{ $client.userinfo_signing_algorithm | default "none" }} - {{- if $client.require_pkce }} - require_pkce: {{ $client.require_pkce }} - {{- end }} - {{- if $client.pkce_challange_method }} - pkce_challenge_method: {{ $client.pkce_challange_method | default "S256" }} - {{- end }} - {{- end }} - {{- end }} - {{- end }} - access_control: - {{- if not .Values.access_control.rules }} - {{- if (eq .Values.access_control.default_policy "bypass") }} - default_policy: one_factor - {{- else if (eq .Values.access_control.default_policy "deny") }} - default_policy: two_factor - {{- else }} - default_policy: {{ .Values.access_control.default_policy }} - {{- end }} - {{- else }} - default_policy: {{ .Values.access_control.default_policy }} - {{- end }} - - {{- if and .Values.access_control.networks (not .Values.access_control.networks_access_control) -}} - {{- fail "Please change [.Values.access_control.networks] to [.Values.access_control.networks_access_control]" -}} - {{- end -}} - {{- if not .Values.access_control.networks_access_control }} - networks: [] - {{- else }} - networks: - {{- range $net := .Values.access_control.networks_access_control }} - - name: {{ $net.name }} - networks: - {{- range $net.networks }} - - {{ . | squote }} - {{- end }} - {{- end }} - {{- end }} - - {{- if not .Values.access_control.rules }} - rules: [] - {{- else }} - rules: - {{- range $rule := .Values.access_control.rules }} - {{- if $rule.domain }} - - domain: - {{- if kindIs "string" $rule.domain }} - - {{ $rule.domain | squote }} - {{- else -}} - {{- range $rule.domain }} - - {{ . | squote }} - {{- end }} - {{- end }} - {{- end -}} - {{- if $rule.domain_regex }} - domain_regex: - {{- if kindIs "string" $rule.domain_regex }} - - {{ $rule.domain_regex | squote }} - {{- else -}} - {{- range $rule.domain_regex }} - - {{ . | squote }} - {{- end }} - {{- end }} - {{- end }} - {{- with $rule.policy }} - policy: {{ . }} - {{- end -}} - {{- if $rule.networks }} - networks: - {{- if kindIs "string" $rule.networks }} - - {{ $rule.networks | squote }} - {{- else -}} - {{- range $rule.networks }} - - {{ . | squote }} - {{- end }} - {{- end }} - {{- end }} - {{- if $rule.subject }} - subject: - {{- if kindIs "string" $rule.subject }} - - {{ $rule.subject | squote }} - {{- else -}} - {{- range $rule.subject }} - - {{ . | squote }} - {{- end }} - {{- end }} - {{- end }} - {{- if $rule.resources }} - resources: - {{- if kindIs "string" $rule.resources }} - - {{ $rule.resources | squote }} - {{- else -}} - {{- range $rule.resources }} - - {{ . | squote }} - {{- end }} - {{- end }} - {{- end }} - {{- end }} - {{- end }} - ... -{{- end -}} diff --git a/charts/premium/authelia/templates/_secrets.tpl b/charts/premium/authelia/templates/_secrets.tpl deleted file mode 100644 index 4445f29e909..00000000000 --- a/charts/premium/authelia/templates/_secrets.tpl +++ /dev/null @@ -1,53 +0,0 @@ -{{/* Define the secrets */}} -{{- define "authelia.secrets" -}} -{{- $basename := include "tc.v1.common.lib.chart.names.fullname" $ -}} -{{- $fetchname := printf "%s-authelia-secrets" $basename -}} - -{{/* Initialize all keys */}} -{{- $oidckey := genPrivateKey "rsa" }} -{{- $oidcsecret := randAlphaNum 32 }} -{{- $jwtsecret := randAlphaNum 50 }} -{{- $sessionsecret := randAlphaNum 50 }} -{{- $encryptionkey := randAlphaNum 100 }} - -enabled: true -data: - {{ with (lookup "v1" "Secret" .Release.Namespace $fetchname) }} - {{/* Get previous values and decode */}} - {{ $sessionsecret = (index .data "SESSION_ENCRYPTION_KEY") | b64dec }} - {{ $jwtsecret = (index .data "JWT_TOKEN") | b64dec }} - {{ $encryptionkey = (index .data "ENCRYPTION_KEY") | b64dec }} - - {{/* Check if those keys ever existed. as OIDC is optional */}} - {{ if and (hasKey .data "OIDC_PRIVATE_KEY") (hasKey .data "OIDC_HMAC_SECRET") }} - {{ $oidckey = (index .data "OIDC_PRIVATE_KEY") | b64dec }} - {{ $oidcsecret = (index .data "OIDC_HMAC_SECRET") | b64dec }} - {{ end }} - {{ end }} - SESSION_ENCRYPTION_KEY: {{ $sessionsecret }} - JWT_TOKEN: {{ $jwtsecret }} - ENCRYPTION_KEY: {{ $encryptionkey }} - - {{- if .Values.authentication_backend.ldap.enabled }} - LDAP_PASSWORD: {{ .Values.authentication_backend.ldap.plain_password | quote }} - {{- end }} - - {{- if and .Values.notifier.smtp.enabled .Values.notifier.smtp.plain_password }} - SMTP_PASSWORD: {{ .Values.notifier.smtp.plain_password | quote }} - {{- end }} - - {{- if .Values.duo_api.enabled }} - DUO_API_KEY: {{ .Values.duo_api.plain_api_key | quote }} - {{- end }} - - STORAGE_PASSWORD: {{ $.Values.cnpg.main.creds.password | trimAll "\"" }} - - REDIS_PASSWORD: {{ .Values.redis.creds.redisPassword | trimAll "\"" }} - {{- if .Values.redisProvider.high_availability.enabled }} - REDIS_SENTINEL_PASSWORD: {{ .Values.redis.sentinelPassword | trimAll "\"" }} - {{- end }} - - OIDC_PRIVATE_KEY: | - {{- $oidckey | nindent 4 }} - OIDC_HMAC_SECRET: {{ $oidcsecret }} -{{- end -}} diff --git a/charts/premium/authelia/templates/common.yaml b/charts/premium/authelia/templates/common.yaml deleted file mode 100644 index 54e288e852c..00000000000 --- a/charts/premium/authelia/templates/common.yaml +++ /dev/null @@ -1,77 +0,0 @@ -{{/* Make sure all variables are set properly */}} -{{- include "tc.v1.common.loader.init" . }} - -{{/* Render configmap for authelia */}} -{{- $configmapPaths := include "authelia.configmap.paths" . | fromYaml -}} -{{- if $configmapPaths -}} - {{- $_ := set .Values.configmap "authelia-paths" $configmapPaths -}} -{{- end -}} - -{{- $configmapFile := include "authelia.configmap.configfile" . | fromYaml -}} -{{- if $configmapFile -}} - {{- $_ := set .Values.configmap "authelia-configfile" $configmapFile -}} -{{- end -}} - -{{/* Render secrets for authelia */}} -{{- $secret := include "authelia.secrets" . | fromYaml -}} -{{- if $secret -}} - {{- $_ := set .Values.secret "authelia-secrets" $secret -}} -{{- end -}} - -{{/* Append the general configMap volume to the volumes */}} -{{- define "authelia.configmapVolume" -}} -enabled: true -mountPath: /configuration.yaml -subPath: configuration.yaml -readOnly: true -type: "configmap" -objectName: authelia-configfile -{{- end -}} - -{{/* Append the general secret volumes to the volumes */}} -{{- define "authelia.secretVolumes" -}} -enabled: true -mountPath: "/secrets" -readOnly: true -type: "secret" -objectName: authelia-secrets -items: - - key: "JWT_TOKEN" - path: JWT_TOKEN - - key: "SESSION_ENCRYPTION_KEY" - path: SESSION_ENCRYPTION_KEY - - key: "ENCRYPTION_KEY" - path: ENCRYPTION_KEY - - key: "STORAGE_PASSWORD" - path: STORAGE_PASSWORD - {{- if .Values.authentication_backend.ldap.enabled }} - - key: "LDAP_PASSWORD" - path: LDAP_PASSWORD - {{- end }} - {{- if and .Values.notifier.smtp.enabled .Values.notifier.smtp.plain_password }} - - key: "SMTP_PASSWORD" - path: SMTP_PASSWORD - {{- end }} - - key: "REDIS_PASSWORD" - path: REDIS_PASSWORD - {{- if .Values.redisProvider.high_availability.enabled}} - - key: "REDIS_SENTINEL_PASSWORD" - path: REDIS_SENTINEL_PASSWORD - {{- end }} - {{- if .Values.duo_api.enabled }} - - key: "DUO_API_KEY" - path: DUO_API_KEY - {{- end }} - {{- if .Values.identity_providers.oidc.enabled }} - - key: "OIDC_PRIVATE_KEY" - path: OIDC_PRIVATE_KEY - - key: "OIDC_HMAC_SECRET" - path: OIDC_HMAC_SECRET - {{- end }} -{{- end -}} - -{{- $_ := set .Values.persistence "authelia-configfile" (include "authelia.configmapVolume" . | fromYaml) -}} -{{- $_ := set .Values.persistence "authelia-secrets" (include "authelia.secretVolumes" . | fromYaml) -}} - -{{/* Render the templates */}} -{{ include "tc.v1.common.loader.apply" . }} diff --git a/charts/premium/authelia/values.yaml b/charts/premium/authelia/values.yaml deleted file mode 100644 index 78a1b5c6572..00000000000 --- a/charts/premium/authelia/values.yaml +++ /dev/null @@ -1,593 +0,0 @@ -image: - repository: ghcr.io/authelia/authelia - pullPolicy: IfNotPresent - tag: 4.38.19@sha256:46021dc20efdcc5cdc38a29e3050b8835429a155ae6215388ed3b793a02eb0ab - -workload: - main: - replicas: 2 - strategy: RollingUpdate - podSpec: - containers: - main: - command: - - authelia - args: - - --config=/configuration.yaml - envFrom: - - configMapRef: - name: authelia-paths - probes: - liveness: - type: http - path: "/api/health" - readiness: - type: http - path: "/api/health" - startup: - type: http - path: "/api/health" -service: - main: - ports: - main: - port: 9091 - targetPort: 9091 -persistence: - config: - enabled: true - mountPath: "/config" -cnpg: - main: - enabled: true - user: authelia - database: authelia -# Enabled redis -# ... for more options see https://github.com/tccr.io/truecharts/charts/tree/master/tccr.io/truecharts/redis -redis: - enabled: true - includeCommon: true -domain: example.com -## -## Server Configuration -## -server: - ## - ## Port sets the configured port for the daemon, service, and the probes. - ## Default is 9091 and should not need to be changed. - ## - port: 9091 - ## Buffers usually should be configured to be the same value. - ## Explanation at https://www.authelia.com/docs/configuration/server.html - ## Read buffer size adjusts the server's max incoming request size in bytes. - ## Write buffer size does the same for outgoing responses. - read_buffer_size: 4096 - write_buffer_size: 4096 - ## Set the single level path Authelia listens on. - ## Must be alphanumeric chars and should not contain any slashes. - path: "" -log: - ## Level of verbosity for logs: info, debug, trace. - level: trace - ## Format the logs are written as: json, text. - format: text - ## TODO: Statefulness check should check if this is set, and the configMap should enable it. - ## File path where the logs will be written. If not set logs are written to stdout. - # file_path: /config/authelia.log -## Default redirection URL -## -## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end -## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use -## in such a case. -## -## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication. -## Default is https://www. (value at the top of the values.yaml). -default_redirection_url: "" -# default_redirection_url: https://example.com - -theme: light -## -## TOTP Configuration -## -## Parameters used for TOTP generation -totp: - ## The issuer name displayed in the Authenticator application of your choice - ## See: https://github.com/google/google-authenticator/wiki/Key-Uri-Format for more info on issuer names - ## Defaults to . - issuer: "" - ## The period in seconds a one-time password is current for. Changing this will require all users to register - ## their TOTP applications again. Warning: before changing period read the docs link below. - period: 30 - ## The skew controls number of one-time passwords either side of the current one that are valid. - ## Warning: before changing skew read the docs link below. - ## See: https://www.authelia.com/docs/configuration/one-time-password.html#period-and-skew to read the documentation. - skew: 1 -## -## Password Policy Config -## -## Parameters used for Password Policies -password_policy: - enabled: false - ## See: https://www.authelia.com/configuration/security/password-policy/ - standard: - enabled: false - min_length: 8 - max_length: 0 - require_uppercase: false - require_lowercase: false - require_number: false - require_special: false - zxcvbn: - ## See https://www.authelia.com/configuration/security/password-policy/#zxcvbn for more info - enabled: false - min_score: 3 -## -## Duo Push API Configuration -## -## Parameters used to contact the Duo API. Those are generated when you protect an application of type -## "Partner Auth API" in the management panel. -duo_api: - enabled: false - hostname: api-123456789.example.com - integration_key: ABCDEF - plain_api_key: "" -## NTP settings -ntp: - address: "time.cloudflare.com:123" - version: 4 - max_desync: 3s - disable_startup_check: false - disable_failure: true -## -## Authentication Backend Provider Configuration -## -## Used for verifying user passwords and retrieve information such as email address and groups users belong to. -## -## The available providers are: `file`, `ldap`. You must use one and only one of these providers. -authentication_backend: - ## Disable both the HTML element and the API for reset password functionality - disable_reset_password: false - ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation. - ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will - ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP. - ## To force update on every request you can set this to '0' or 'always', this will increase processor demand. - ## See the below documentation for more information. - ## Duration Notation docs: https://www.authelia.com/docs/configuration/index.html#duration-notation-format - ## Refresh Interval docs: https://www.authelia.com/docs/configuration/authentication/ldap.html#refresh-interval - refresh_interval: 5m - ## LDAP backend configuration. - ## - ## This backend allows Authelia to be scaled to more - ## than one instance and therefore is recommended for - ## production. - ldap: - ## Enable LDAP Backend. - enabled: false - ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password. - ## Acceptable options are as follows: - ## - 'activedirectory' - For Microsoft Active Directory. - ## - 'custom' - For custom specifications of attributes and filters. - ## This currently defaults to 'custom' to maintain existing behaviour. - ## - ## Depending on the option here certain other values in this section have a default value, notably all of the - ## attribute mappings have a default value that this config overrides, you can read more about these default values - ## at https://www.authelia.com/docs/configuration/authentication/ldap.html#defaults - implementation: activedirectory - ## The url to the ldap server. Format: ://
[:]. - ## Scheme can be ldap or ldaps in the format (port optional). - url: ldap://openldap.default.svc.cluster.local - ## Connection Timeout. - timeout: 5s - ## Use StartTLS with the LDAP connection. - start_tls: false - tls: - ## Server Name for certificate validation (in case it's not set correctly in the URL). - server_name: "" - ## Skip verifying the server certificate (to allow a self-signed certificate). - ## In preference to setting this we strongly recommend you add the public portion of the certificate to the - ## certificates directory which is defined by the `certificates_directory` option at the top of the config. - skip_verify: false - ## Minimum TLS version for either Secure LDAP or LDAP StartTLS. - minimum_version: TLS1.2 - ## The base dn for every LDAP query. - base_dn: DC=example,DC=com - ## The attribute holding the username of the user. This attribute is used to populate the username in the session - ## information. It was introduced due to #561 to handle case insensitive search queries. For you information, - ## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this - ## attribute holds the unique identifiers for the users binding the user and the configuration stored in database. - ## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user - ## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also - ## be used but we don't recommend using them, we instead advise to use the attributes mentioned above - ## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt. - username_attribute: "uid" - ## An additional dn to define the scope to all users. - additional_users_dn: OU=Users - ## The users filter used in search queries to find the user profile based on input filled in login form. - ## Various placeholders are available in the user filter: - ## - {input} is a placeholder replaced by what the user inputs in the login form. - ## - {username_attribute} is a mandatory placeholder replaced by what is configured in `username_attribute`. - ## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`. - ## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later - ## versions, so please don't use it. - ## - ## Recommended settings are as follows: - ## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) - ## - OpenLDAP: - ## - (&({username_attribute}={input})(objectClass=person)) - ## - (&({username_attribute}={input})(objectClass=inetOrgPerson)) - ## - ## To allow sign in both with username and email, one can use a filter like - ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person)) - users_filter: "" - ## An additional dn to define the scope of groups. - additional_groups_dn: OU=Groups - ## The groups filter used in search queries to find the groups of the user. - ## - {input} is a placeholder replaced by what the user inputs in the login form. - ## - {username} is a placeholder replace by the username stored in LDAP (based on `username_attribute`). - ## - {dn} is a matcher replaced by the user distinguished name, aka, user DN. - ## - {username_attribute} is a placeholder replaced by what is configured in `username_attribute`. - ## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`. - ## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later - ## versions, so please don't use it. - ## - DON'T USE - {1} is an alias for {username} supported for backward compatibility but it will be deprecated in - ## later version, so please don't use it. - ## - ## If your groups use the `groupOfUniqueNames` structure use this instead: - ## (&(uniquemember={dn})(objectclass=groupOfUniqueNames)) - groups_filter: "" - ## The attribute holding the name of the group - group_name_attribute: "cn" - ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the - ## first one returned by the LDAP server is used. - mail_attribute: "mail" - ## The attribute holding the display name of the user. This will be used to greet an authenticated user. - display_name_attribute: "displayname" - ## The username of the admin user. - user: CN=admin,DC=example,DC=com - plain_password: "" - ## - ## File (Authentication Provider) - ## - ## With this backend, the users database is stored in a file which is updated when users reset their passwords. - ## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia - ## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security - ## implications it is highly recommended you leave the default values. Before considering changing these settings - ## please read the docs page below: - ## https://www.authelia.com/docs/configuration/authentication/file.html#password-hash-algorithm-tuning - ## - ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html - ## - file: - enabled: true - path: /config/users_database.yml - password: - algorithm: argon2id - iterations: 1 - key_length: 32 - salt_length: 16 - memory: 1024 - parallelism: 8 -## -## Access Control Configuration -## -## Access control is a list of rules defining the authorizations applied for one resource to users or group of users. -## -## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed -## to anyone. Otherwise restrictions follow the rules defined. -## -## Note: One can use the wildcard * to match any subdomain. -## It must stand at the beginning of the pattern. (example: *.mydomain.com) -## -## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct. -## -## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'. -## -## - 'domain' defines which domain or set of domains the rule applies to. -## -## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not -## provided. If provided, the parameter represents either a user or a group. It should be of the form -## 'user:' or 'group:'. -## -## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'. -## -## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter -## is optional and matches any resource if not provided. -## -## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies. -access_control: - ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any - ## resource if there is no policy to be applied to the user. - default_policy: deny - networks_access_control: [] - # networks_access_control: - # - name: private - # networks: - # - 10.0.0.0/8 - # - 172.16.0.0/12 - # - 192.168.0.0/16 - # - name: vpn - # networks: - # - 10.9.0.0/16 - - rules: [] - # rules: - # - domain: public.example.com - # policy: bypass - # - domain: "*.example.com" - # policy: bypass - # methods: - # - OPTIONS - # - domain: secure.example.com - # policy: one_factor - # networks: - # - private - # - vpn - # - 192.168.1.0/24 - # - 10.0.0.1 - # - domain: - # - secure.example.com - # - private.example.com - # policy: two_factor - # - domain: singlefactor.example.com - # policy: one_factor - # - domain: "mx2.mail.example.com" - # subject: "group:admins" - # policy: deny - # - domain: "*.example.com" - # subject: - # - "group:admins" - # - "group:moderators" - # policy: two_factor - # - domain: dev.example.com - # resources: - # - "^/groups/dev/.*$" - # subject: "group:dev" - # policy: two_factor - # - domain: dev.example.com - # resources: - # - "^/users/john/.*$" - # subject: - # - ["group:dev", "user:john"] - # - "group:admins" - # policy: two_factor - # - domain: "{user}.example.com" - # policy: bypass -## -## Session Provider Configuration -## -## The session cookies identify the user once logged in. -## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined. -session: - ## The name of the session cookie. (default: authelia_session). - name: authelia_session - ## Sets the Cookie SameSite value. Possible options are none, lax, or strict. - ## Please read https://www.authelia.com/docs/configuration/session.html#same_site - same_site: lax - ## The time in seconds before the cookie expires and session is reset. - expiration: 1h - ## The inactivity time in seconds before the session is reset. - inactivity: 5m - ## The remember me duration. - ## Value is in seconds, or duration notation. Value of 0 disables remember me. - ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format - ## Longer periods are considered less secure because a stolen cookie will last longer giving attackers more time to - ## spy or attack. Currently the default is 1M or 1 month. - remember_me_duration: 1M -## -## Redis Provider -## -## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html -## -## The redis connection details -redisProvider: - port: 6379 - ## Optional username to be used with authentication. - # username: authelia - username: "" - ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc). - database_index: 0 - ## The maximum number of concurrent active connections to Redis. - maximum_active_connections: 8 - ## The target number of idle connections to have open ready for work. Useful when opening connections is slow. - minimum_idle_connections: 0 - ## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s). - tls: - enabled: false - ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option). - server_name: "" - ## Skip verifying the server certificate (to allow a self-signed certificate). - ## In preference to setting this we strongly recommend you add the public portion of the certificate to the - ## certificates directory which is defined by the `certificates_directory` option at the top of the config. - skip_verify: false - ## Minimum TLS version for the connection. - minimum_version: TLS1.2 - ## The Redis HA configuration options. - ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name). - high_availability: - enabled: false - enabledSecret: false - ## Sentinel Name / Master Name - sentinel_name: mysentinel - ## The additional nodes to pre-seed the redis provider with (for sentinel). - ## If the host in the above section is defined, it will be combined with this list to connect to sentinel. - ## For high availability to be used you must have either defined; the host above or at least one node below. - nodes: [] - # nodes: - # - host: sentinel-0.databases.svc.cluster.local - # port: 26379 - # - host: sentinel-1.databases.svc.cluster.local - # port: 26379 - - ## Choose the host with the lowest latency. - route_by_latency: false - ## Choose the host randomly. - route_randomly: false -## -## Regulation Configuration -## -## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are done -## in a short period of time. -regulation: - ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation. - max_retries: 3 - ## The time range during which the user can attempt login before being banned. The user is banned if the - ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation. - ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format - find_time: 2m - ## The length of time before a banned user can login again. Ban Time accepts duration notation. - ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format - ban_time: 5m -## -## Storage Provider Configuration -## -## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers. -storage: - ## - ## PostgreSQL (Storage Provider) - ## - postgres: - port: 5432 - database: authelia - username: authelia - sslmode: disable - timeout: 5s -## -## Notification Provider -## -## -## Notifications are sent to users when they require a password reset, a u2f registration or a TOTP registration. -## The available providers are: filesystem, smtp. You must use one and only one of these providers. -notifier: - ## You can disable the notifier startup check by setting this to true. - disable_startup_check: false - ## - ## File System (Notification Provider) - ## - ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html - ## - filesystem: - enabled: true - filename: /config/notification.txt - ## - ## SMTP (Notification Provider) - ## - ## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate. - ## [Security] By default Authelia will: - ## - force all SMTP connections over TLS including unauthenticated connections - ## - use the disable_require_tls boolean value to disable this requirement - ## (only works for unauthenticated connections) - ## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates - ## (configure in tls section) - smtp: - enabled: false - enabledSecret: false - host: smtp.mail.svc.cluster.local - port: 25 - timeout: 5s - username: test - plain_password: test - sender: admin@example.com - ## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost. - identifier: localhost - ## Subject configuration of the emails sent. - ## {title} is replaced by the text from the notifier - subject: "[Authelia] {title}" - ## This address is used during the startup check to verify the email configuration is correct. - ## It's not important what it is except if your email server only allows local delivery. - startup_check_address: test@authelia.com - disable_require_tls: false - disable_html_emails: false - tls: - ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option). - server_name: "" - ## Skip verifying the server certificate (to allow a self-signed certificate). - ## In preference to setting this we strongly recommend you add the public portion of the certificate to the - ## certificates directory which is defined by the `certificates_directory` option at the top of the config. - skip_verify: false - ## Minimum TLS version for either StartTLS or SMTPS. - minimum_version: TLS1.2 -identity_providers: - oidc: - ## Enables this in the config map. Currently in beta stage. - ## See https://www.authelia.com/docs/configuration/identity-providers/oidc.html#roadmap - enabled: false - access_token_lifespan: 1h - authorize_code_lifespan: 1m - id_token_lifespan: 1h - refresh_token_lifespan: 90m - enable_client_debug_messages: false - ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for - ## security reasons. - minimum_parameter_entropy: 8 - clients: [] - # clients: - # - - ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration. - # id: myapp -## The description to show to users when they end up on the consent screen. Defaults to the ID above. -# description: My Application - -## The client secret is a shared secret between Authelia and the consumer of this client. -# secret: apple123 - -## Sets the client to public. This should typically not be set, please see the documentation for usage. -# public: false - -## The policy to require for this client; one_factor or two_factor. -# authorization_policy: two_factor - -## Configures the consent mode; auto, explicit or implicit -# consent_mode: auto - -## Audience this client is allowed to request. -# audience: [] - -## Scopes this client is allowed to request. -# scopes: -# - openid -# - profile -# - email -# - groups - -## Redirect URI's specifies a list of valid case-sensitive callbacks for this client. -# redirect_uris: -# - https://oidc.example.com/oauth2/callback - -## Grant Types configures which grants this client can obtain. -## It's not recommended to configure this unless you know what you're doing. -# grant_types: -# - refresh_token -# - authorization_code - -## Response Types configures which responses this client can be sent. -## It's not recommended to configure this unless you know what you're doing. -# response_types: -# - code - -## Response Modes configures which response modes this client supports. -## It's not recommended to configure this unless you know what you're doing. -# response_modes: -# - form_post -# - query -# - fragment - -## Client Authentication Method configures which client authentication methods this client supports. -## It's not recommended to configure this unless you know what you're doing. -# token_endpoint_auth_method: client_secret_basic - -## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256. -# userinfo_signing_algorithm: none - -## This configuration option enforces the use of PKCE for this registered client. -# require_pkce: false - -## This setting enforces the use of the specified PKCE challenge method for this individual client. -# pkce_challange_method: S256 - -portal: - open: - enabled: true - -ingress: - main: - required: true diff --git a/charts/premium/authelia/.helmignore b/charts/stable/authelia/.helmignore similarity index 100% rename from charts/premium/authelia/.helmignore rename to charts/stable/authelia/.helmignore diff --git a/charts/premium/authelia/CHANGELOG.md b/charts/stable/authelia/CHANGELOG.md similarity index 100% rename from charts/premium/authelia/CHANGELOG.md rename to charts/stable/authelia/CHANGELOG.md diff --git a/charts/premium/authelia/Chart.yaml b/charts/stable/authelia/Chart.yaml similarity index 86% rename from charts/premium/authelia/Chart.yaml rename to charts/stable/authelia/Chart.yaml index 92db611e8c5..0a79b8218cc 100644 --- a/charts/premium/authelia/Chart.yaml +++ b/charts/stable/authelia/Chart.yaml @@ -4,7 +4,7 @@ annotations: truecharts.org/category: security truecharts.org/max_helm_version: "3.15" truecharts.org/min_helm_version: "3.11" - truecharts.org/train: premium + truecharts.org/train: stable apiVersion: v2 appVersion: 4.38.19 dependencies: @@ -24,7 +24,7 @@ dependencies: import-values: [] deprecated: false description: Authelia is a Single Sign-On Multi-Factor portal for web apps -home: https://truecharts.org/charts/premium/authelia +home: https://truecharts.org/charts/stable/authelia icon: https://truecharts.org/img/hotlink-ok/chart-icons/authelia.webp keywords: - authelia @@ -48,6 +48,6 @@ sources: - https://ghcr.io/authelia/authelia - https://github.com/authelia/authelia - https://github.com/authelia/chartrepo - - https://github.com/truecharts/charts/tree/master/charts/premium/authelia + - https://github.com/truecharts/charts/tree/master/charts/stable/authelia type: application -version: 26.4.8 +version: 27.0.0 diff --git a/charts/premium/authelia/LICENSE b/charts/stable/authelia/LICENSE similarity index 100% rename from charts/premium/authelia/LICENSE rename to charts/stable/authelia/LICENSE diff --git a/charts/premium/authelia/README.md b/charts/stable/authelia/README.md similarity index 100% rename from charts/premium/authelia/README.md rename to charts/stable/authelia/README.md diff --git a/charts/premium/authelia/ci/basic-values.yaml b/charts/stable/authelia/ci/basic-values.yaml similarity index 100% rename from charts/premium/authelia/ci/basic-values.yaml rename to charts/stable/authelia/ci/basic-values.yaml diff --git a/charts/premium/authelia/docs/Setup-Guide.md b/charts/stable/authelia/docs/Setup-Guide.md similarity index 60% rename from charts/premium/authelia/docs/Setup-Guide.md rename to charts/stable/authelia/docs/Setup-Guide.md index 1eb00bb02af..c34fe18f5d7 100644 --- a/charts/premium/authelia/docs/Setup-Guide.md +++ b/charts/stable/authelia/docs/Setup-Guide.md @@ -24,55 +24,57 @@ LLDAP is a `stable` train chart and therefore isn't supported at the same level ```yaml // values.yaml -# your domain -domain: example.com -# autehlia ingress url -default_redirection_url: https://auth.example.com -authentication_backend: - # lldap setup - ldap: - enabled: true - implementation: custom - # if name is not lldap update as needed - url: ldap://lldap-ldap.lldap.svc.cluster.local:3890 - # replace with your domain - base_dn: DC=example,DC=com - username_attribute: uid - additional_users_dn: ou=people - users_filter: (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person)) - additional_groups_dn: ou=groups - groups_filter: (member={dn}) - group_name_attribute: cn - mail_attribute: mail - display_name_attribute: displayName - # user with lldap_password_manager group - user: uid=manager,ou=people,dc=example,dc=com - # above user password in plain text - plain_password: somepassword - file: - enabled: false -notifier: - # smtp setup (example is gmail) - smtp: - enabled: true - host: smtp.gmail.com - port: 587 - # gmail email address (username) - username: email@gmail.com - # use a google app password if using gmail - plain_password: somepassword - # email address to show as sender - sender: no-reply@example.com - filesystem: - enabled: false -access_control: - rules: - # basic rule for one factor (username/password) login for users in the admin group - - domain: - - "*.example.com" - - example.com - policy: one_factor - subject: "group:admin" +# All configuration options should be put under this. Supports all upstream options +authelia: + # your domain + domain: example.com + # autehlia ingress url + default_redirection_url: https://auth.example.com + authentication_backend: + # lldap setup + ldap: + enabled: true + implementation: custom + # if name is not lldap update as needed + url: ldap://lldap-ldap.lldap.svc.cluster.local:3890 + # replace with your domain + base_dn: DC=example,DC=com + username_attribute: uid + additional_users_dn: ou=people + users_filter: (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person)) + additional_groups_dn: ou=groups + groups_filter: (member={dn}) + group_name_attribute: cn + mail_attribute: mail + display_name_attribute: displayName + # user with lldap_password_manager group + user: uid=manager,ou=people,dc=example,dc=com + # above user password in plain text + plain_password: somepassword + file: + enabled: false + notifier: + # smtp setup (example is gmail) + smtp: + enabled: true + host: smtp.gmail.com + port: 587 + # gmail email address (username) + username: email@gmail.com + # use a google app password if using gmail + plain_password: somepassword + # email address to show as sender + sender: no-reply@example.com + filesystem: + enabled: false + access_control: + rules: + # basic rule for one factor (username/password) login for users in the admin group + - domain: + - "*.example.com" + - example.com + policy: one_factor + subject: "group:admin" ``` Please see [Authelia Rules](./authelia-rules) for more advanced rules. @@ -87,8 +89,6 @@ ingress: main: enabled: true integrations: - traefik: - enabled: true certManager: enabled: true certificateIssuer: domain-0-le-prod @@ -100,8 +100,6 @@ ingress: - This part is straight forward as long as you have a working `Traefik` install. -- The following is added to `Traefik` `values.yaml`, - ```yaml // values.yaml middlewares: @@ -140,6 +138,19 @@ ingress: - host: radarr.example.com ``` +## Nginx-Ingress Annotations + +- These annotations need to be added to each chart you want to use auth with: + +```yaml +// values.yaml +annotations: + nginx.ingress.kubernetes.io/auth-method: 'GET' + nginx.ingress.kubernetes.io/auth-url: 'http://authelia.authelia.svc.cluster.local:9091/api/verify' + nginx.ingress.kubernetes.io/auth-signin: 'https://auth.${DOMAIN_0}?rm=$request_method' + nginx.ingress.kubernetes.io/auth-response-headers: 'Remote-User,Remote-Name,Remote-Groups,Remote-Email' +``` + ### References The origin material for this guide is available on the [LLDAP Github](https://github.com/lldap/lldap). While further information on Authelia can be found on their [Github](https://github.com/authelia/authelia) and [website](https://www.authelia.com/). diff --git a/charts/premium/authelia/docs/authelia-rules.md b/charts/stable/authelia/docs/authelia-rules.md similarity index 100% rename from charts/premium/authelia/docs/authelia-rules.md rename to charts/stable/authelia/docs/authelia-rules.md diff --git a/charts/premium/authelia/docs/img/AutheliaAccessControl.png b/charts/stable/authelia/docs/img/AutheliaAccessControl.png similarity index 100% rename from charts/premium/authelia/docs/img/AutheliaAccessControl.png rename to charts/stable/authelia/docs/img/AutheliaAccessControl.png diff --git a/charts/premium/authelia/docs/img/AutheliaIngress.png b/charts/stable/authelia/docs/img/AutheliaIngress.png similarity index 100% rename from charts/premium/authelia/docs/img/AutheliaIngress.png rename to charts/stable/authelia/docs/img/AutheliaIngress.png diff --git a/charts/premium/authelia/docs/img/LLDAPCatalogConfig.png b/charts/stable/authelia/docs/img/LLDAPCatalogConfig.png similarity index 100% rename from charts/premium/authelia/docs/img/LLDAPCatalogConfig.png rename to charts/stable/authelia/docs/img/LLDAPCatalogConfig.png diff --git a/charts/premium/authelia/docs/img/TraefikForwardAuth.png b/charts/stable/authelia/docs/img/TraefikForwardAuth.png similarity index 100% rename from charts/premium/authelia/docs/img/TraefikForwardAuth.png rename to charts/stable/authelia/docs/img/TraefikForwardAuth.png diff --git a/charts/premium/authelia/docs/img/TraefikForwardAuthMiddleware.png b/charts/stable/authelia/docs/img/TraefikForwardAuthMiddleware.png similarity index 100% rename from charts/premium/authelia/docs/img/TraefikForwardAuthMiddleware.png rename to charts/stable/authelia/docs/img/TraefikForwardAuthMiddleware.png diff --git a/charts/premium/authelia/docs/img/authelia-api.png b/charts/stable/authelia/docs/img/authelia-api.png similarity index 100% rename from charts/premium/authelia/docs/img/authelia-api.png rename to charts/stable/authelia/docs/img/authelia-api.png diff --git a/charts/premium/authelia/docs/img/authelia-catch.png b/charts/stable/authelia/docs/img/authelia-catch.png similarity index 100% rename from charts/premium/authelia/docs/img/authelia-catch.png rename to charts/stable/authelia/docs/img/authelia-catch.png diff --git a/charts/premium/authelia/docs/img/authelia-user.png b/charts/stable/authelia/docs/img/authelia-user.png similarity index 100% rename from charts/premium/authelia/docs/img/authelia-user.png rename to charts/stable/authelia/docs/img/authelia-user.png diff --git a/charts/premium/authelia/docs/img/authelia-vw1.png b/charts/stable/authelia/docs/img/authelia-vw1.png similarity index 100% rename from charts/premium/authelia/docs/img/authelia-vw1.png rename to charts/stable/authelia/docs/img/authelia-vw1.png diff --git a/charts/premium/authelia/docs/img/authelia-vw2.png b/charts/stable/authelia/docs/img/authelia-vw2.png similarity index 100% rename from charts/premium/authelia/docs/img/authelia-vw2.png rename to charts/stable/authelia/docs/img/authelia-vw2.png diff --git a/charts/premium/authelia/docs/img/authelia-vw3.png b/charts/stable/authelia/docs/img/authelia-vw3.png similarity index 100% rename from charts/premium/authelia/docs/img/authelia-vw3.png rename to charts/stable/authelia/docs/img/authelia-vw3.png diff --git a/charts/premium/authelia/docs/validation.md b/charts/stable/authelia/docs/validation.md similarity index 100% rename from charts/premium/authelia/docs/validation.md rename to charts/stable/authelia/docs/validation.md diff --git a/charts/premium/authelia/icon-small.webp b/charts/stable/authelia/icon-small.webp similarity index 100% rename from charts/premium/authelia/icon-small.webp rename to charts/stable/authelia/icon-small.webp diff --git a/charts/premium/authelia/icon.webp b/charts/stable/authelia/icon.webp similarity index 100% rename from charts/premium/authelia/icon.webp rename to charts/stable/authelia/icon.webp diff --git a/charts/premium/authelia/templates/NOTES.txt b/charts/stable/authelia/templates/NOTES.txt similarity index 100% rename from charts/premium/authelia/templates/NOTES.txt rename to charts/stable/authelia/templates/NOTES.txt diff --git a/charts/stable/authelia/templates/common.yaml b/charts/stable/authelia/templates/common.yaml new file mode 100644 index 00000000000..72bdd2d48fe --- /dev/null +++ b/charts/stable/authelia/templates/common.yaml @@ -0,0 +1,2 @@ +{{/* Make sure all variables are set properly */}} +{{- include "tc.v1.common.loader.all" . }} diff --git a/charts/stable/authelia/values.yaml b/charts/stable/authelia/values.yaml new file mode 100644 index 00000000000..6b1c39a5772 --- /dev/null +++ b/charts/stable/authelia/values.yaml @@ -0,0 +1,94 @@ +image: + repository: ghcr.io/authelia/authelia + pullPolicy: IfNotPresent + tag: 4.38.19@sha256:46021dc20efdcc5cdc38a29e3050b8835429a155ae6215388ed3b793a02eb0ab + +# Raw Authelia configuration +# Replace it with your configuration +authelia: + authentication_backend: + file: + path: /config/users.yaml + notifier: + filesystem: + filename: /config/notification.txt + access_control: + default_policy: one_factor + session: + cookies: + - domain: example.com + authelia_url: https://example.com + +workload: + main: + replicas: 2 + strategy: RollingUpdate + podSpec: + containers: + main: + env: + # Update the following secrets with your own values + AUTHELIA_SESSION_SECRET: some-secret-replace-me + AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET: some-secret-replace-me + AUTHELIA_STORAGE_ENCRYPTION_KEY: some-secret-replace-me + # Don't change the following envs + X_AUTHELIA_CONFIG: "{{ .Values.persistence.configfile.mountPath }}" + AUTHELIA_SERVER_DISABLE_HEALTHCHECK: "true" + AUTHELIA_SERVER_ADDRESS: "tcp://:{{ .Values.service.main.ports.main.port }}/" + AUTHELIA_STORAGE_POSTGRES_ADDRESS: "tcp://{{ .Values.cnpg.main.creds.host }}:{{ .Values.cnpg.main.creds.port }}" + AUTHELIA_STORAGE_POSTGRES_DATABASE: "{{ .Values.cnpg.main.database }}" + AUTHELIA_STORAGE_POSTGRES_USERNAME: "{{ .Values.cnpg.main.user }}" + AUTHELIA_STORAGE_POSTGRES_PASSWORD: '{{ .Values.cnpg.main.creds.password | trimAll "\"" }}' + AUTHELIA_SESSION_REDIS_HOST: '{{ .Values.redis.creds.plain | trimAll "\"" }}' + AUTHELIA_SESSION_REDIS_PORT: "{{ .Values.redis.service.main.ports.main.port }}" + AUTHELIA_SESSION_REDIS_DATABASE_INDEX: "0" + AUTHELIA_SESSION_REDIS_PASSWORD: '{{ .Values.redis.creds.redisPassword | trimAll "\"" }}' + + probes: + liveness: + type: http + path: "/api/health" + readiness: + type: http + path: "/api/health" + startup: + type: http + path: "/api/health" +service: + main: + ports: + main: + port: 9091 + +secret: + authelia-configfile: + enabled: true + data: + configuration.yaml: | + {{- $.Values.authelia | toYaml | nindent 2 }} + +persistence: + config: + enabled: true + mountPath: /config + configfile: + enabled: true + mountPath: /configuration.yaml + subPath: configuration.yaml + readOnly: true + type: secret + objectName: authelia-configfile + +cnpg: + main: + enabled: true + user: authelia + database: authelia + +redis: + enabled: true + includeCommon: true + +portal: + open: + enabled: true diff --git a/charts/stable/lldap/docs/authelia-lldap-forwardauth.md b/charts/stable/lldap/docs/authelia-lldap-forwardauth.md index 304185f1eea..60a113603bb 100644 --- a/charts/stable/lldap/docs/authelia-lldap-forwardauth.md +++ b/charts/stable/lldap/docs/authelia-lldap-forwardauth.md @@ -2,4 +2,4 @@ title: Authelia + LLDAP + Traefik ForwardAuth Setup guide --- -Please refer to the full [Authelia + LLDAP + Traefik ForwardAuth Setup guide](/charts/premium/authelia/setup-guide) for a quick guide should take you through the steps necessary to setup `Authelia` as your `forwardAuth` for `Traefik`. +Please refer to the full [Authelia + LLDAP + Traefik ForwardAuth Setup guide](/charts/stable/authelia/setup-guide) for a quick guide should take you through the steps necessary to setup `Authelia` as your `forwardAuth` for `Traefik`. diff --git a/charts/stable/paperless-ngx/docs/how-to.md b/charts/stable/paperless-ngx/docs/how-to.md index 83c044f9a90..1e91ad9addb 100644 --- a/charts/stable/paperless-ngx/docs/how-to.md +++ b/charts/stable/paperless-ngx/docs/how-to.md @@ -63,14 +63,14 @@ persistence: ### Configure ForwardAuth authentication -Users that have set up [Traefik with ForwardAuth, for example with Authelia](/charts/premium/authelia/setup-guide/) +Users that have set up [Traefik with ForwardAuth, for example with Authelia](/charts/stable/authelia/setup-guide/) can take advantage of authentication through Authelia for their Paperless-ngx installation. Paperless-ngx will honour logins passed from Authelia but not the e-mail address nor the groups of the logged-in user, those will be internal to Paperless-ngx and separate from those in Authelia. ForwardAuth can be added to an existing Paperless-ngx installation as long as the logins of Authelia users match the logins of Paperless-ngx users. This guide will only describe the Paperless-ngx specific options required to set up ForwardAuth. Please refer to the -[Traefik + Authelia ForwardAuth setup guide](/charts/premium/authelia/setup-guide/) on how to prepare ForwardAuth. +[Traefik + Authelia ForwardAuth setup guide](/charts/stable/authelia/setup-guide/) on how to prepare ForwardAuth. Once you have set up ForwardAuth in your Traefik installation, configure ForwardAuth in Paperless-ngx as follows: diff --git a/charts/stable/traefik-forward-auth/docs/how-to.md b/charts/stable/traefik-forward-auth/docs/how-to.md index 37b61ae4a67..ba30d534ae9 100644 --- a/charts/stable/traefik-forward-auth/docs/how-to.md +++ b/charts/stable/traefik-forward-auth/docs/how-to.md @@ -5,7 +5,7 @@ description: A How To Guide for Traefik Forward Auth :::note -We highly recommend to setup [authelia](/charts/premium/authelia/setup-guide)) instead. +We highly recommend to setup [authelia](/charts/stable/authelia/setup-guide) instead. :::