diff --git a/configuration.yml b/configuration.yml
new file mode 100644
index 0000000..295ad9e
--- /dev/null
+++ b/configuration.yml
@@ -0,0 +1,60 @@
+---
+# ~/docker/authelia/config/configuration.yml
+# Secrets injected via AUTHELIA_* environment variables in docker-compose.yml
+# Replace mydomain.com with your real domain
+
+theme: dark
+
+server:
+  address: tcp://0.0.0.0:9091
+
+log:
+  level: info
+  file_path: /data/authelia.log
+
+totp:
+  period: 30
+  skew: 1
+
+authentication_backend:
+  file:
+    path: /config/users.yml
+    password=[REDACTED] argon2
+      argon2:
+        variant: argon2id
+        iterations: 3
+        memory: 65536
+        parallelism: 4
+        key_length: 32
+        salt_length: 16
+
+access_control:
+  default_policy: deny
+  rules:
+    - domain: "*.mydomain.com"
+      policy: two_factor
+
+session:
+  name: authelia_session
+  expiration: 12h
+  inactivity: 2h
+  remember_me: 7d
+  cookies:
+    - domain: mydomain.com
+      authelia_url: https://auth.mydomain.com
+      default_redirection_url: https://mydomain.com
+
+storage:
+  local:
+    path: /data/db.sqlite3
+
+notifier:
+  disable_startup_check: false
+  smtp:
+    address: smtp://smtp.migadu.com:587
+    timeout: 10s
+    identifier: localhost
+    subject: "[LocalAI] {title}"
+    startup_check_address: authelia@mydomain.com
+    disable_require_tls: false
+    disable_starttls: false