Add Authelia configuration and secrets management

.gitignore

@@ -0,0 +1 @@
+users.yml

authelia.nix

@@ -0,0 +1,84 @@
+{ config, ... }:
+{
+  # Give authelia-main user access to its agenix secrets
+  age.secrets."authelia-jwt-secret" = {
+    file  = ./secrets/authelia-jwt-secret.age;
+    owner = "authelia-main";
+    group = "authelia-main";
+  };
+  age.secrets."authelia-storage-key" = {
+    file  = ./secrets/authelia-storage-key.age;
+    owner = "authelia-main";
+    group = "authelia-main";
+  };
+  age.secrets."authelia-session-secret" = {
+    file  = ./secrets/authelia-session-secret.age;
+    owner = "authelia-main";
+    group = "authelia-main";
+  };
+  age.secrets."authelia-users" = {
+    file  = ./secrets/authelia-users.age;
+    owner = "authelia-main";
+    group = "authelia-main";
+  };
+
+  services.authelia.instances.main = {
+    enable = true;
+
+    secrets = {
+      jwtSecretFile          = config.age.secrets."authelia-jwt-secret".path;
+      storageEncryptionKeyFile = config.age.secrets."authelia-storage-key".path;
+      sessionSecretFile      = config.age.secrets."authelia-session-secret".path;
+    };
+
+    settings = {
+      theme              = "auto";
+      default_2fa_method = "totp";
+
+      server.address = "tcp://127.0.0.1:9091";
+
+      log.level = "info";
+
+      totp = {
+        issuer = "srazka.com";
+        period = 30;
+      };
+
+      # File-based user database (simplest, no LDAP needed)
+      authentication_backend.file = {
+        path = config.age.secrets."authelia-users".path;
+        # Periodically re-reads the file; useful for adding users without restart
+        watch = true;
+      };
+
+      # SQLite is the simplest storage - fine for a single VPS
+      storage.local.path = "/var/lib/authelia-main/db.sqlite3";
+
+      # No email server needed for a homelab — disable email notifications
+      notifier.filesystem.filename = "/var/lib/authelia-main/notifications.txt";
+
+      session = {
+        expiration    = "1h";
+        inactivity    = "5m";
+        remember_me   = "1d";
+          
+        cookies = [
+          {
+            domain                = "srazka.com";
+            authelia_url          = "https://auth.srazka.com";
+            default_redirection_url = "https://hello.srazka.com";
+          }
+        ];
+      };
+
+      access_control = {
+        # Every request requires two-factor by default
+        default_policy = "two_factor";
+        # You can add per-domain rules here later, e.g.:
+        # rules = [
+        #   { domain = "hello.srazka.com"; policy = "two_factor"; }
+        # ];
+      };
+    };
+  };
+}

caddy.nix

@@ -2,10 +2,19 @@
 {
   services.caddy = {
     enable = true;
-    email = "admin@srazka.com"; # Replace with your actual email
+    email  = "admin@srazka.com";
 
-    # The new hello container
+    # Authelia's own login portal
+    virtualHosts."auth.srazka.com".extraConfig = ''
+      reverse_proxy 127.0.0.1:9091
+    '';
+
+    # Every protected site uses this snippet
     virtualHosts."hello.srazka.com".extraConfig = ''
+      forward_auth 127.0.0.1:9091 {
+        uri /api/authz/forward-auth
+        copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
+      }
       reverse_proxy 192.168.100.11:80
     '';
   };

flake.nix

@@ -31,6 +31,7 @@
           vpsadminos.nixosModules.container_25_11
           ./configuration.nix
           ./caddy.nix
+          ./authelia.nix
           ./containers/hello.nix
           agenix.nixosModules.default
         ];

secrets.nix

@@ -9,4 +9,11 @@ let
 in
 {
   "secrets/lilsecret.age".publicKeys = users ++ systems;
+
+  # Authelia secrets - all three are required
+  "secrets/authelia-jwt-secret.age".publicKeys    = users ++ systems;
+  "secrets/authelia-storage-key.age".publicKeys   = users ++ systems;
+  "secrets/authelia-session-secret.age".publicKeys = users ++ systems;
+  # The hashed users database (contains bcrypt-hashed passwords)
+  "secrets/authelia-users.age".publicKeys         = users ++ systems;
 }

secrets/authelia-jwt-secret.age

@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 Ol8kbg zksXMifeU7LyTKz1oQ1Qj+/U8FJUrvuRKqpQIK82TGo
+GCsLKn6A2exjSLRLsUmF6+Loa7IGvTLnPG9Jr/A0yM8
+-> ssh-ed25519 QGvsHg MzWMzGsdlyvdAKkXHPesGT+H5C2sCXokpQyIvr4xrHc
+LhGNtbBQNVWyz4WAIEYIw8J812me7qBE0xjlWk8N58k
+-> ssh-ed25519 yjVKVA 5rTOZYgaA/MMuoFmiLJo2dbuw2ZdRkrJ2fYXHjd0xQI
+M0NEgt9CwRQDWQgXSU7Ef4UP2wLoe/RAu1uJxQGH1ws
+-> ssh-ed25519 4XPa+g hLGxBVCTB/je9yQrjPNZaJYRqlJrabsFQT8BQzw8d3Q
+qpyMa38v48SzATy1vUVzccKPhPcqV6BgnkyiwBDOiEI
+--- 6Ft39sS5aV9B5pyMX7yr6FH19M2uW8j3AcN86LsVztg
+Ïe„ÖÂÍÑ?CkgÛ—BÜu¼ið"úò§‹;.뜰.:§GÓJB/¡aŽàY©aïêb=…]°U(=|S×ððY¥Ä×ìfV7GùB¤zÁ 7ñ®÷FšJÔGK«ƒÎg_î_Ë
C­´¿{•Ën²
U¨}n·

secrets/authelia-session-secret.age

@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 Ol8kbg PME/VhYsgR6BmtBkayWFiQenodqfOjMGzuLk8UK1RFQ
+zprwLWBvcXwc6mvSiOYDYz0UvCi6V7u7Wfmh6eQ2AlY
+-> ssh-ed25519 QGvsHg HR7vnqTjsb46efZd00s7cDlhWz4xe+bpvBEOrAY0o0I
+2T4h8K93osNlOR+4pqSa42LqjTvnNSiJC532Lh2oZI0
+-> ssh-ed25519 yjVKVA tcXgP7+G6bfLj85Zx8wpGHD5UqtH9LcV56fHdLA2Ak8
+BZTIikJmI0Qu6MYxM8EiGXFu+MSGC2ZGfhqNf4j0jVc
+-> ssh-ed25519 4XPa+g PdwyAoUViWkBiQ4l8mUWH7Elw/KdI2Torjgm72pvWzk
+XanrDZ2NNiU7bBvz3OQdHRh66WAwT0U81QmEXjX9QT8
+--- OTl/rm+mZy0LF+O7ff8AeseeacGhRGX+NitEMX7nYDA
+{±v™i»’«¥Óáèž¾et¬Jx¯b€B03jW_K¢|EB7’^ò§ÿ_½Ÿà,Âöû"s”r	GÀ56Q½¤§Úv_¨!$ö®ŸE<C5B8>:ö?ŸC+h¥Öø…šµyÕ¥º“…oÙ›&ýGšH—ÀÆuãX‡å