diff --git a/confs/site/authelia-auth-request.conf b/confs/site/authelia-auth-request.conf new file mode 100644 index 0000000..8e28946 --- /dev/null +++ b/confs/site/authelia-auth-request.conf @@ -0,0 +1,27 @@ +# Basic Authelia Config +# Send a subsequent request to Authelia to verify if the user is authenticated +# and has the right permissions to access the resource. +auth_request /authelia; +# Set the `target_url` variable based on the request. It will be used to build the portal +# URL with the correct redirection parameter. +auth_request_set $target_url $scheme://$http_host$request_uri; +# Set the X-Forwarded-User and X-Forwarded-Groups with the headers +# returned by Authelia for the backends which can consume them. +# This is not safe, as the backend must make sure that they come from the +# proxy. In the future, it's gonna be safe to just use OAuth. +auth_request_set $user $upstream_http_remote_user; +auth_request_set $groups $upstream_http_remote_groups; +auth_request_set $name $upstream_http_remote_name; +auth_request_set $email $upstream_http_remote_email; +fastcgi_param REMOTE_USER $user; +fastcgi_param REMOTE_GROUPS $groups; +fastcgi_param REMOTE_NAME $name; +fastcgi_param REMOTE_EMAIL $email; +proxy_set_header Remote-User $user; +proxy_set_header Remote-Groups $groups; +proxy_set_header Remote-Name $name; +proxy_set_header Remote-Email $email; +# If Authelia returns 401, then nginx redirects the user to the login portal. +# If it returns 200, then the request pass through to the backend. +# For other type of errors, nginx will handle them as usual. +error_page 401 =302 {{ AUTHELIA_BACKEND }}/?rd=$target_url; diff --git a/confs/site/authelia-proxy.conf b/confs/site/authelia-proxy.conf new file mode 100644 index 0000000..a204f10 --- /dev/null +++ b/confs/site/authelia-proxy.conf @@ -0,0 +1,40 @@ +set $upstream_authelia {{ AUTHELIA_UPSTREAM }}/api/verify; + +# Virtual endpoint created by nginx to forward auth requests. +location /authelia { + internal; + proxy_pass_request_body off; + proxy_pass $upstream_authelia; + proxy_set_header Content-Length ""; + + # Timeout if the real server is dead + proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; + + # [REQUIRED] Needed by Authelia to check authorizations of the resource. + # Provide either X-Original-URL and X-Forwarded-Proto or + # X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-Uri or both. + # Those headers will be used by Authelia to deduce the target url of the user. + # Basic Proxy Config + client_body_buffer_size 128k; + proxy_set_header Host $host; + proxy_set_header X-Original-URL $scheme://$http_host$request_uri; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-Method $request_method; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Host $http_host; + proxy_set_header X-Forwarded-Uri $request_uri; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Forwarded-Ssl on; + proxy_redirect http:// $scheme://; + proxy_http_version 1.1; + proxy_set_header Connection ""; + proxy_cache_bypass $cookie_session; + proxy_no_cache $cookie_session; + proxy_buffers 4 32k; + + # Advanced Proxy Config + send_timeout 5m; + proxy_read_timeout 240; + proxy_send_timeout 240; + proxy_connect_timeout 240; +} diff --git a/confs/site/reverse-proxy.conf b/confs/site/reverse-proxy.conf index 312da41..2575c7d 100644 --- a/confs/site/reverse-proxy.conf +++ b/confs/site/reverse-proxy.conf @@ -8,6 +8,9 @@ location {{ url }} {% raw %}{{% endraw %} etag off; proxy_pass {{ host }}; + {% if USE_AUTHELIA == "yes" %} + include {{ NGINX_PREFIX }}authelia-upstream.conf; + {% endif %} include {{ NGINX_PREFIX }}reverse-proxy-headers.conf; {% if ws == "yes" %} proxy_http_version 1.1; diff --git a/confs/site/server.conf b/confs/site/server.conf index 90dc577..a333398 100644 --- a/confs/site/server.conf +++ b/confs/site/server.conf @@ -164,6 +164,12 @@ server { include {{ NGINX_PREFIX }}proxy-cache.conf; {% endif %} + # authelia +{% if USE_AUTHELIA == "yes" %} + include {{ NGINX_PREFIX}}authelia-upstream.conf; + include {{ NGINX_PREFIX}}authelia-auth-request.conf; +{% endif %} + # reverse proxy {% if USE_REVERSE_PROXY == "yes" %} include {{ NGINX_PREFIX }}reverse-proxy.conf; diff --git a/examples/authelia/authelia/configuration.yml b/examples/authelia/authelia/configuration.yml new file mode 100644 index 0000000..8f1a863 --- /dev/null +++ b/examples/authelia/authelia/configuration.yml @@ -0,0 +1,72 @@ +############################################################### +# Authelia configuration # +############################################################### + +host: 0.0.0.0 +port: 9091 +# log: +# level: debug +# This secret can also be set using the env variables AUTHELIA_JWT_SECRET_FILE +jwt_secret: a_very_important_secret +default_redirection_url: https://auth.example.com +totp: + issuer: authelia.com + +# duo_api: +# hostname: api-123456789.example.com +# integration_key: ABCDEF +# # This secret can also be set using the env variables AUTHELIA_DUO_API_SECRET_KEY_FILE +# secret_key: 1234567890abcdefghifjkl + +authentication_backend: + file: + path: /config/users_database.yml + +access_control: + default_policy: deny + rules: + # Rules applied to everyone + - domain: auth.example.com + policy: bypass + - domain: app1.example.com + policy: one_factor + - domain: app2.example.com + policy: two_factor + +session: + name: authelia_session + # This secret can also be set using the env variables AUTHELIA_SESSION_SECRET_FILE + secret: unsecure_session_secret + expiration: 3600 # 1 hour + inactivity: 300 # 5 minutes + domain: example.com # Should match whatever your root protected domain is + + redis: + host: redis + port: 6379 + # This secret can also be set using the env variables AUTHELIA_SESSION_REDIS_PASSWORD_FILE + # password: authelia + +regulation: + max_retries: 3 + find_time: 120 + ban_time: 300 + +storage: + local: + path: /config/db.sqlite3 + +notifier: + disable_startup_check: false + filesystem: + filename: /config/notification.txt + +#notifier: +# smtp: +# username: test + # This secret can also be set using the env variables AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE +# password: password +# host: mail.example.com +# port: 25 +# sender: admin@example.com + diff --git a/examples/authelia/authelia/users_database.yml b/examples/authelia/authelia/users_database.yml new file mode 100644 index 0000000..715f736 --- /dev/null +++ b/examples/authelia/authelia/users_database.yml @@ -0,0 +1,16 @@ +############################################################### +# Users Database # +############################################################### + +# This file can be used if you do not have an LDAP set up. + +# List of users +users: + authelia: + displayname: "Authelia User" + # Password is Authelia + password: "$6$rounds=50000$BpLnfgDsc2WD8F2q$Zis.ixdg9s/UOJYrs56b5QEZFiZECu0qZVNsIYxBaNJ7ucIL.nlxVCT5tqh8KHG8X4tlwCFm5r6NTOZZ5qRFN/" # yamllint disable-line rule:line-length + email: authelia@authelia.com + groups: + - admins + - dev diff --git a/examples/authelia/docker-compose.yml b/examples/authelia/docker-compose.yml new file mode 100644 index 0000000..3bbff8c --- /dev/null +++ b/examples/authelia/docker-compose.yml @@ -0,0 +1,71 @@ +--- +version: '3.3' + +services: + + authelia: + image: authelia/authelia + volumes: + - ./authelia:/config + restart: unless-stopped + healthcheck: + disable: true + environment: + - TZ=France/Paris + + redis: + image: redis:alpine + volumes: + - ./redis:/data + restart: unless-stopped + environment: + - TZ=France/Paris + + bunkerized-nginx: + image: bunkerity/bunkerized-nginx + restart: always + depends_on: + - authelia + - myapp1 + - myapp2 + ports: + - 80:8080 + - 443:8443 + # bunkerized-nginx runs as an unprivileged user with UID/GID 101 + # don't forget to edit the permissions of the files and folders accordingly + volumes: + - ./web-files:/www:ro + - ./letsencrypt:/etc/letsencrypt + environment: + - SERVER_NAME=auth.example.com app1.example.com app2.example.com # replace with your domains + - MULTISITE=yes + - AUTO_LETS_ENCRYPT=yes + - REDIRECT_HTTP_TO_HTTPS=yes + - DISABLE_DEFAULT_SERVER=yes + - USE_CLIENT_CACHE=yes + - USE_GZIP=yes + - USE_AUTHELIA=yes + - AUTHELIA_BACKEND=https://auth.example.com + - AUTHELIA_UPSTREAM=http://authelia:9091 + - auth.example.com_USE_AUTHELIA=no + - auth.example.com_USE_REVERSE_PROXY=yes + - auth.example.com_REVERSE_PROXY_URL=/ + - auth.example.com_REVERSE_PROXY_HOST=http://authelia:9091 + - app1.example.com_REMOTE_PHP=myapp1 + - app1.example.com_REMOTE_PHP_PATH=/app + - app2.example.com_SERVE_FILES=no + - app2.example.com_USE_REVERSE_PROXY=myapp2 + - app2.example.com_REVERSE_PROXY_URL=/ + - app2.example.com_REVERSE_PROXY_HOST=http://myapp2 + + myapp1: + image: php:fpm + restart: always + volumes: + - ./web-files/app1.example.com:/app + + myapp2: + image: php:apache + restart: always + volumes: + - ./web-files/app2.example.com:/var/www/html diff --git a/examples/authelia/web-files/app1.example.com/index.php b/examples/authelia/web-files/app1.example.com/index.php new file mode 100644 index 0000000..3ca6425 --- /dev/null +++ b/examples/authelia/web-files/app1.example.com/index.php @@ -0,0 +1,10 @@ +
"; + +echo "REMOTE_USER = " . $_SERVER['REMOTE_USER'] . "
"; +echo "REMOTE_GROUPS = " . $_SERVER['REMOTE_GROUPS'] . "
"; +echo "REMOTE_NAME = " . $_SERVER['REMOTE_NAME'] . "
"; +echo "REMOTE_EMAIL = " . $_SERVER['REMOTE_EMAIL'] . "
"; + +?> diff --git a/gen/Templator.py b/gen/Templator.py index 9f87394..ad3f442 100644 --- a/gen/Templator.py +++ b/gen/Templator.py @@ -17,7 +17,7 @@ class Templator : self.__target_path = target_path if not self.__target_path.endswith("/") : self.__target_path += "/" - self.__template_env = jinja2.Environment(loader=jinja2.FileSystemLoader(searchpath=self.__input_path), lstrip_blocks=True) + self.__template_env = jinja2.Environment(loader=jinja2.FileSystemLoader(searchpath=self.__input_path), lstrip_blocks=True, trim_blocks=True) def render_global(self) : return self.__render("global")