diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..3fb0379 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +users.yml diff --git a/authelia.nix b/authelia.nix new file mode 100644 index 0000000..d5b49c0 --- /dev/null +++ b/authelia.nix @@ -0,0 +1,84 @@ +{ config, ... }: +{ + # Give authelia-main user access to its agenix secrets + age.secrets."authelia-jwt-secret" = { + file = ./secrets/authelia-jwt-secret.age; + owner = "authelia-main"; + group = "authelia-main"; + }; + age.secrets."authelia-storage-key" = { + file = ./secrets/authelia-storage-key.age; + owner = "authelia-main"; + group = "authelia-main"; + }; + age.secrets."authelia-session-secret" = { + file = ./secrets/authelia-session-secret.age; + owner = "authelia-main"; + group = "authelia-main"; + }; + age.secrets."authelia-users" = { + file = ./secrets/authelia-users.age; + owner = "authelia-main"; + group = "authelia-main"; + }; + + services.authelia.instances.main = { + enable = true; + + secrets = { + jwtSecretFile = config.age.secrets."authelia-jwt-secret".path; + storageEncryptionKeyFile = config.age.secrets."authelia-storage-key".path; + sessionSecretFile = config.age.secrets."authelia-session-secret".path; + }; + + settings = { + theme = "auto"; + default_2fa_method = "totp"; + + server.address = "tcp://127.0.0.1:9091"; + + log.level = "info"; + + totp = { + issuer = "srazka.com"; + period = 30; + }; + + # File-based user database (simplest, no LDAP needed) + authentication_backend.file = { + path = config.age.secrets."authelia-users".path; + # Periodically re-reads the file; useful for adding users without restart + watch = true; + }; + + # SQLite is the simplest storage - fine for a single VPS + storage.local.path = "/var/lib/authelia-main/db.sqlite3"; + + # No email server needed for a homelab — disable email notifications + notifier.filesystem.filename = "/var/lib/authelia-main/notifications.txt"; + + session = { + expiration = "1h"; + inactivity = "5m"; + remember_me = "1d"; + + cookies = [ + { + domain = "srazka.com"; + authelia_url = "https://auth.srazka.com"; + default_redirection_url = "https://hello.srazka.com"; + } + ]; + }; + + access_control = { + # Every request requires two-factor by default + default_policy = "two_factor"; + # You can add per-domain rules here later, e.g.: + # rules = [ + # { domain = "hello.srazka.com"; policy = "two_factor"; } + # ]; + }; + }; + }; +} diff --git a/caddy.nix b/caddy.nix index c4eafed..2cc1e95 100755 --- a/caddy.nix +++ b/caddy.nix @@ -2,11 +2,20 @@ { services.caddy = { enable = true; - email = "admin@srazka.com"; # Replace with your actual email + email = "admin@srazka.com"; - # The new hello container + # Authelia's own login portal + virtualHosts."auth.srazka.com".extraConfig = '' + reverse_proxy 127.0.0.1:9091 + ''; + + # Every protected site uses this snippet virtualHosts."hello.srazka.com".extraConfig = '' + forward_auth 127.0.0.1:9091 { + uri /api/authz/forward-auth + copy_headers Remote-User Remote-Groups Remote-Email Remote-Name + } reverse_proxy 192.168.100.11:80 ''; }; -} \ No newline at end of file +} diff --git a/flake.nix b/flake.nix index 1f21a5c..f2587f9 100644 --- a/flake.nix +++ b/flake.nix @@ -31,6 +31,7 @@ vpsadminos.nixosModules.container_25_11 ./configuration.nix ./caddy.nix + ./authelia.nix ./containers/hello.nix agenix.nixosModules.default ]; diff --git a/secrets.nix b/secrets.nix index 2c98fbd..0141976 100644 --- a/secrets.nix +++ b/secrets.nix @@ -9,4 +9,11 @@ let in { "secrets/lilsecret.age".publicKeys = users ++ systems; -} \ No newline at end of file + + # Authelia secrets - all three are required + "secrets/authelia-jwt-secret.age".publicKeys = users ++ systems; + "secrets/authelia-storage-key.age".publicKeys = users ++ systems; + "secrets/authelia-session-secret.age".publicKeys = users ++ systems; + # The hashed users database (contains bcrypt-hashed passwords) + "secrets/authelia-users.age".publicKeys = users ++ systems; +} diff --git a/secrets/authelia-jwt-secret.age b/secrets/authelia-jwt-secret.age new file mode 100644 index 0000000..57e4a1c --- /dev/null +++ b/secrets/authelia-jwt-secret.age @@ -0,0 +1,11 @@ +age-encryption.org/v1 +-> ssh-ed25519 Ol8kbg zksXMifeU7LyTKz1oQ1Qj+/U8FJUrvuRKqpQIK82TGo +GCsLKn6A2exjSLRLsUmF6+Loa7IGvTLnPG9Jr/A0yM8 +-> ssh-ed25519 QGvsHg MzWMzGsdlyvdAKkXHPesGT+H5C2sCXokpQyIvr4xrHc +LhGNtbBQNVWyz4WAIEYIw8J812me7qBE0xjlWk8N58k +-> ssh-ed25519 yjVKVA 5rTOZYgaA/MMuoFmiLJo2dbuw2ZdRkrJ2fYXHjd0xQI +M0NEgt9CwRQDWQgXSU7Ef4UP2wLoe/RAu1uJxQGH1ws +-> ssh-ed25519 4XPa+g hLGxBVCTB/je9yQrjPNZaJYRqlJrabsFQT8BQzw8d3Q +qpyMa38v48SzATy1vUVzccKPhPcqV6BgnkyiwBDOiEI +--- 6Ft39sS5aV9B5pyMX7yr6FH19M2uW8j3AcN86LsVztg +eÑ?CkgBui";..:GJB/aYab=]U(=|SYfV7GBz7FJGKg__C{nU}n \ No newline at end of file diff --git a/secrets/authelia-session-secret.age b/secrets/authelia-session-secret.age new file mode 100644 index 0000000..8ee810b --- /dev/null +++ b/secrets/authelia-session-secret.age @@ -0,0 +1,11 @@ +age-encryption.org/v1 +-> ssh-ed25519 Ol8kbg PME/VhYsgR6BmtBkayWFiQenodqfOjMGzuLk8UK1RFQ +zprwLWBvcXwc6mvSiOYDYz0UvCi6V7u7Wfmh6eQ2AlY +-> ssh-ed25519 QGvsHg HR7vnqTjsb46efZd00s7cDlhWz4xe+bpvBEOrAY0o0I +2T4h8K93osNlOR+4pqSa42LqjTvnNSiJC532Lh2oZI0 +-> ssh-ed25519 yjVKVA tcXgP7+G6bfLj85Zx8wpGHD5UqtH9LcV56fHdLA2Ak8 +BZTIikJmI0Qu6MYxM8EiGXFu+MSGC2ZGfhqNf4j0jVc +-> ssh-ed25519 4XPa+g PdwyAoUViWkBiQ4l8mUWH7Elw/KdI2Torjgm72pvWzk +XanrDZ2NNiU7bBvz3OQdHRh66WAwT0U81QmEXjX9QT8 +--- OTl/rm+mZy0LF+O7ff8AeseeacGhRGX+NitEMX7nYDA +{vi螾etJx bB03jW_K|EB7^_,"sr G56Qv_!$E:?C+hyեoٛ&GHuX \ No newline at end of file diff --git a/secrets/authelia-storage-key.age b/secrets/authelia-storage-key.age new file mode 100644 index 0000000..a5101b1 Binary files /dev/null and b/secrets/authelia-storage-key.age differ diff --git a/secrets/authelia-users.age b/secrets/authelia-users.age new file mode 100644 index 0000000..0b09db2 Binary files /dev/null and b/secrets/authelia-users.age differ