Skip to content

Commit 5c19b95

Browse files
timothystewart6timothystewart6
committed
feat(video): authelia
1 parent 27f9b1d commit 5c19b95

File tree

5 files changed

+254
-0
lines changed

5 files changed

+254
-0
lines changed

‎_posts/2021-06-05-authelia-traefik.md

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
---
2+
layout: post
3+
title: "2 Factor Auth and Single Sign on with Authelia"
4+
date: 2021-06-05 09:00:00 -0500
5+
categories: traefik
6+
tags: authelia homelab traefik portainer ssl docker self-hosted
7+
---
8+
9+
[![2 Factor Auth and Single Sign on with Authelia?](https://img.youtube.com/vi/u6H-Qwf4nZA/0.jpg)](https://www.youtube.com/watch?v=u6H-Qwf4nZA "2 Factor Auth and Single Sign on with Authelia?")
10+
11+
Authelia is an open source Single Sign On and 2FA companion for reverse proxies. It helps you secure your endpoints with single factor and 2 factor auth. It works with Nginx, Traefik, and HA proxy. Today, we'll configure Authelia with Portainer and Traefik and have 2 Factor up and running with brute force protection!
12+
13+
[Watch Video](https://www.youtube.com/watch?v=u6H-Qwf4nZA)
14+
15+
## Traefik
16+
17+
Authelia will work with other reverse proxies but I used Traefik. If you want to configure Traefik as your reverse proxy see this [guide](https://techno-tim.github.io/posts/traefik-portainer-ssl/).
18+
19+
20+
## Docker Setup
21+
22+
### Install Docker
23+
```bash
24+
sudo apt-get update
25+
sudo apt-get install \
26+
apt-transport-https \
27+
ca-certificates \
28+
curl \
29+
gnupg \
30+
lsb-release
31+
```
32+
33+
```bash
34+
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
35+
```
36+
37+
```bash
38+
echo \
39+
"deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu \
40+
$(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
41+
```
42+
43+
```bash
44+
sudo apt-get update
45+
sudo apt-get install docker-ce docker-ce-cli containerd.io
46+
```
47+
48+
```bash
49+
sudo usermod -aG docker $USER
50+
```
51+
You'll need to log out then back in to apply this
52+
53+
### Install Docker Compose
54+
55+
```bash
56+
sudo curl -L "https://github.com/docker/compose/releases/download/1.29.1/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
57+
```
58+
59+
```bash
60+
sudo chmod +x /usr/local/bin/docker-compose
61+
```
62+
63+
## Authelia
64+
65+
`configuration.yml`, `users_database.yml`, and `docker-compose.yml` can be found [here](https://github.com/techno-tim/techno-tim.github.io/tree/master/reference_files/authelia-traefik/authelia)
66+
67+
Example `heimdall` can be found here [here](https://github.com/techno-tim/techno-tim.github.io/tree/master/reference_files/authelia-traefik/heimdall)
68+
69+
Traefik configuration changes can be found [here](https://github.com/techno-tim/techno-tim.github.io/tree/master/reference_files/authelia-traefik/traefik)
70+
71+
72+
## Generation a hashed password
73+
74+
```bash
75+
$ docker run authelia/authelia:latest authelia hash-password 'yourpassword'
76+
Password hash: $argon2id$v=19$m=65536$3oc26byQuSkQqksq$zM1QiTvVPrMfV6BVLs2t4gM+af5IN7euO0VB6+Q8ZFs
77+
```
78+
79+
## Files and folders
80+
81+
```bash
82+
mkdir authelia
83+
mkdir config
84+
cd config
85+
nano configuration.yml
86+
nano user_database.yml
87+
cd ..
88+
nano docker-compose.yml
89+
```
90+
91+
### Create Authelia container
92+
93+
```bash
94+
docker-compose up -d
95+
```

‎reference_files/authelia-traefik/authelia/configuration.yml

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
---
2+
###############################################################
3+
# Authelia configuration #
4+
###############################################################
5+
6+
host: 0.0.0.0
7+
port: 9091
8+
log_level: debug
9+
theme: dark
10+
# This secret can also be set using the env variables AUTHELIA_JWT_SECRET_FILE
11+
jwt_secret: a_very_important_secret
12+
default_redirection_url: https://auth.local.example.com
13+
totp:
14+
issuer: authelia.com
15+
16+
# duo_api:
17+
# hostname: api-123456789.example.com
18+
# integration_key: ABCDEF
19+
# # This secret can also be set using the env variables AUTHELIA_DUO_API_SECRET_KEY_FILE
20+
# secret_key: 1234567890abcdefghifjkl
21+
22+
authentication_backend:
23+
file:
24+
path: /config/users_database.yml
25+
password:
26+
algorithm: argon2id
27+
iterations: 1
28+
salt_length: 16
29+
parallelism: 8
30+
memory: 64
31+
32+
access_control:
33+
default_policy: deny
34+
rules:
35+
# Rules applied to everyone
36+
- domain: public.example.com
37+
policy: bypass
38+
- domain: heimdall.local.example.com
39+
policy: one_factor
40+
- domain: pve1.local.example.com
41+
policy: two_factor
42+
43+
session:
44+
name: authelia_session
45+
# This secret can also be set using the env variables AUTHELIA_SESSION_SECRET_FILE
46+
secret: unsecure_session_secret
47+
expiration: 3600 # 1 hour
48+
inactivity: 300 # 5 minutes
49+
domain: example.com # Should match whatever your root protected domain is
50+
51+
# redis:
52+
# host: redis
53+
# port: 6379
54+
# # This secret can also be set using the env variables AUTHELIA_SESSION_REDIS_PASSWORD_FILE
55+
# # password: authelia
56+
57+
regulation:
58+
max_retries: 3
59+
find_time: 120
60+
ban_time: 300
61+
62+
storage:
63+
local:
64+
path: /config/db.sqlite3
65+
66+
notifier:
67+
# smtp:
68+
# username: test
69+
# # This secret can also be set using the env variables AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE
70+
# password: password
71+
# host: mail.example.com
72+
# port: 25
73+
# sender: [email protected]
74+
filesystem:
75+
filename: /config/notification.txt
76+
...

‎reference_files/authelia-traefik/authelia/docker-compose.yml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
version: '3'
2+
3+
services:
4+
authelia:
5+
image: authelia/authelia
6+
container_name: authelia
7+
volumes:
8+
- ./config:/config
9+
networks:
10+
- proxy
11+
labels:
12+
- 'traefik.enable=true'
13+
- 'traefik.http.routers.authelia.rule=Host(`auth.local.example.com`)'
14+
- 'traefik.http.routers.authelia.entrypoints=https'
15+
- 'traefik.http.routers.authelia.tls=true'
16+
- 'traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.local.example.com'
17+
- 'traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true'
18+
- 'traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email'
19+
expose:
20+
- 9091
21+
restart: unless-stopped
22+
environment:
23+
- TZ=America/Chicago
24+
healthcheck:
25+
disable: true
26+
networks:
27+
proxy:
28+
external: true

‎reference_files/authelia-traefik/authelia/users_database.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
###############################################################
3+
# Users Database #
4+
###############################################################
5+
6+
# This file can be used if you do not have an LDAP set up.
7+
8+
# List of users
9+
users:
10+
username:
11+
displayname: "Your Name"
12+
# Password is Authelia
13+
password: "$argon2id$v=19$m=65536,t=1,p=8$cUI4a0E3L1laYnRDUXl3Lw$ZsdsrdadaoVIaVj8NltA8x4qVOzT+/r5GF62/bT8OuAs"
14+
email: [email protected]
15+
groups:
16+
- admins
17+
- dev
18+
...

‎reference_files/authelia-traefik/heimdall/docker-compose.yml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
version: "2.1"
3+
4+
services:
5+
heimdall:
6+
image: ghcr.io/linuxserver/heimdall
7+
container_name: heimdall
8+
environment:
9+
- PUID=1000
10+
- PGID=1000
11+
- TZ=America/Chicago
12+
volumes:
13+
- ./config:/config
14+
ports:
15+
- 8500:80
16+
# - 8600:443
17+
restart: unless-stopped
18+
security_opt:
19+
- no-new-privileges:true
20+
networks:
21+
- proxy
22+
labels:
23+
- "traefik.enable=true"
24+
- "traefik.http.routers.heimdall.entrypoints=http"
25+
- "traefik.http.routers.heimdall.rule=Host(`heimdall.local.example.com`)"
26+
- "traefik.http.middlewares.heimdall-https-redirect.redirectscheme.scheme=https"
27+
- "traefik.http.routers.heimdall.middlewares=heimdall-https-redirect"
28+
- "traefik.http.routers.heimdall-secure.entrypoints=https"
29+
- "traefik.http.routers.heimdall-secure.rule=Host(`heimdall.local.example.com`)"
30+
- "traefik.http.routers.heimdall-secure.tls=true"
31+
- "traefik.http.routers.heimdall-secure.service=heimdall"
32+
- "traefik.http.services.heimdall.loadbalancer.server.port=80"
33+
- "traefik.docker.network=proxy"
34+
- 'traefik.http.routers.heimdall-secure.middlewares=authelia@docker'
35+
networks:
36+
proxy:
37+
external: true

0 commit comments

Comments
 (0)