root/frigate_w_audio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update authelia stack: 4 auth cases, full Caddyfile, improved docs

Browse Source 
Keeps this as a standalone authelia+fail2ban stack (no Frigate services).

Changes:
- docker-compose.yml: fail2ban depends_on authelia with service_healthy
  condition so authelia.log exists before fail2ban tries to bind-mount it;
  add inline note about pre-creating the log file
- authelia/configuration.yml: expand access_control comment block to cover
  all 4 cases (added Case 3: app keeps own auth + Authelia as 2FA gate,
  and Case 4: app handles auth alone); clearer per-case commented rules
- caddy/Caddyfile (replaces snippet.example.caddyfile): complete Caddyfile
  with all 4 auth-case examples; (accesslog) imported in every block so
  fail2ban caddy-4xx jail covers all subdomains, not just gated ones;
  full inline docs for enabling Frigate proxy auth
- README.md: expand "Which sites" from 3 to 4 cases; add proxy-auth service
  compatibility table (Frigate, Grafana, Gitea, Nextcloud, HA, Portainer
  etc.); clarify fail2ban covers all sites via single caddy-4xx jail;
  add touch authelia/authelia.log to first-run; add troubleshooting entries
  for authelia.log bind-mount directory bug and fail2ban chain verification

https://claude.ai/code/session_012eTokAaGiZo7aGt1T2W9BC
This commit is contained in:
Claude
2026-04-26 02:46:42 +00:00
parent 3c2bb275ee
commit 1b4c9298e1
5 changed files with 529 additions and 455 deletions
Download Patch File Download Diff File Expand all files Collapse all files
authelia/configuration.yml
+54 -36
View File
@@ -25,7 +25,7 @@ server:
log:
level: 'info'
format: 'text' # fail2ban filter expects text format
format: 'text' # fail2ban filter expects text format -- don't change to json
file_path: '/config/authelia.log'
keep_stdout: true # also log to stdout for `docker logs`
@@ -63,60 +63,76 @@ authentication_backend:
# ---------------------------------------------------------------------------
# Access control
#
# default_policy: deny means every domain that Caddy forwards here must
# have an explicit allow rule. Caddy only forwards when a site block has
# `import authelia`, so domains where you keep the app's own auth (no
# `import authelia` in Caddy) bypass Authelia entirely and don't need
# rules here.
# default_policy: deny -- every domain Caddy forward_auths here must have
# an explicit rule. Domains with no `import authelia` in Caddy never reach
# Authelia at all, so the deny doesn't apply to them.
#
# Policies:
# bypass Authelia waves the request through (used for the portal)
# one_factor password only
# two_factor password + TOTP
#
# Decision tree for whether a site needs an Authelia rule at all:
# ---------------------------------------------------------------------------
# WHICH SITES NEED A RULE HERE?
#
# - App has NO built-in auth (doorbell PTT page) -> rule here +
# `import authelia` in Caddy. Use two_factor for anything that
# controls hardware in the house.
# There are four ways a site can relate to Authelia:
#
# - App has built-in auth but supports trusted-header proxy auth
# (Frigate 0.14+, Grafana, Gitea, Jellyfin, ...) -> rule here +
# `import authelia` in Caddy AND switch the app to proxy auth in
# its own config. Single login (Authelia), 2FA, app keeps its own
# user/role mapping driven from Authelia headers.
# CASE 1 -- App has NO built-in auth (e.g. Pi doorbell PTT page).
# -> Rule required + `import authelia` in Caddy.
# -> Authelia is the ONLY login. Use two_factor for hardware-control pages.
#
# - App has built-in auth and CAN'T switch (router admin, legacy
# things) -> NO rule here, NO `import authelia` in Caddy. The
# traffic skips Authelia entirely; the app handles its own login.
# CASE 2 -- App has built-in auth AND supports trusted-header proxy auth
# (Frigate 0.14+, Grafana, Gitea, Nextcloud, Home Assistant ...).
# -> Rule required + `import authelia` in Caddy + disable the app's login
# form in its own config (see README.md per-app instructions).
# -> Single Authelia login covers both access AND the app's user/role
# mapping via Remote-User / Remote-Groups headers.
#
# CASE 3 -- App has built-in auth and CANNOT switch to proxy auth, but you
# still want a 2FA gate in front of it (extra security layer).
# -> Rule required + `import authelia` in Caddy.
# -> User logs into Authelia (2FA) THEN into the app's own login form.
# Two separate logins -- the app auth is unchanged.
# -> Useful for: router admin pages, NAS UIs, any legacy app.
#
# CASE 4 -- App handles its own auth and you don't want Authelia involved.
# -> NO rule here + NO `import authelia` in Caddy.
# -> Traffic skips Authelia entirely; the app handles everything.
# ---------------------------------------------------------------------------
access_control:
default_policy: 'deny'
rules:
# The Authelia portal itself is always bypass.
- domain: 'auth.example.com' # CHANGE
policy: 'bypass'
# ----- Apps with NO built-in auth: Authelia is the only gate -----
# The Pi doorbell PTT page has no app-level auth, so Authelia is it.
# 2FA is appropriate -- this URL controls a speaker in your house.
# - domain: 'doorbell.example.com'
# -------------------------------------------------------------------
# CASE 1: No app auth -- Authelia is the only gate.
# The Pi doorbell PTT page has no built-in authentication.
# two_factor is appropriate -- this URL controls a speaker in your house.
# -------------------------------------------------------------------
# - domain: 'doorbell.example.com' # CHANGE
# policy: 'two_factor'
# ----- Apps that switched FROM their own auth TO Authelia -----
# Frigate 0.14+ supports trusted-header proxy auth. To use this:
# 1. In frigate_config/config.yml, set `auth.enabled: False`
# and add a `proxy:` block with `header_map.user: remote-user`
# and `header_map.role: remote-groups` (see README).
# 2. `import authelia` in the cam.* Caddy block.
# 3. Add the rule below.
# - domain: 'cam.example.com'
# -------------------------------------------------------------------
# CASE 2: App supports trusted-header proxy auth -- replace app login.
# Frigate 0.14+: set `auth.enabled: False` and configure `proxy:` in
# frigate_config/config.yml (see README.md "Switching Frigate to Authelia").
# Single login: Authelia authenticates, Frigate reads Remote-User/Groups.
# -------------------------------------------------------------------
# - domain: 'cam.example.com' # CHANGE
# policy: 'two_factor'
# ----- Apps that KEEP their own auth -----
# Don't add a rule and don't `import authelia` in their Caddy block.
# Example: a router admin page on `router.example.com` -- no rule
# appears here, the request never reaches Authelia.
# -------------------------------------------------------------------
# CASE 3: App keeps its own auth; Authelia adds a 2FA gate in front.
# The app's login form is still shown after Authelia passes the request.
# User logs into Authelia (2FA) then into the app separately.
# -------------------------------------------------------------------
# - domain: 'nas.example.com' # CHANGE/REMOVE example
# policy: 'two_factor'
# CASE 4: No rule here, no `import authelia` in Caddy. App handles auth.
session:
# secret loaded via AUTHELIA_SESSION_SECRET_FILE
@@ -130,7 +146,9 @@ session:
remember_me: '1 month'
same_site: 'lax'
# In-app rate limiting. First line of defense; fail2ban is the second.
# In-app rate limiting. Locks the user account after repeated failures.
# fail2ban is the second line of defense: it bans the source IP.
# Together: Authelia locks the *user*, fail2ban bans the *IP*.
regulation:
max_retries: 3
find_time: '2 minutes'
@@ -143,7 +161,7 @@ storage:
# Filesystem notifier -- password reset / new device emails get written to
# a file you can `tail -f`. Swap to `smtp:` when you wire up a real
# transactional sender.
# transactional sender (see README.md "Switching the notifier to SMTP").
notifier:
disable_startup_check: false
filesystem: