Initial Authelia + fail2ban stack

Self-hosted SSO portal with file-based users, SQLite storage, filesystem
notifier, and an iptables-banning fail2ban sidecar. Designed to drop into
a DotheEvo-style ~/docker layout next to a dockerized Caddy on the main
server, joining the same external caddy_net so Caddy reaches Authelia by
container name. fail2ban runs in host network mode with NET_ADMIN/NET_RAW
caps so its bans hit DOCKER-USER and actually drop packets at the edge.

Includes a Caddy snippet (caddy/snippet.example.caddyfile) to merge into
the user's real Caddyfile -- this repo doesn't manage Caddy itself.

https://claude.ai/code/session_013XZ1vmgk78k2PEQ5DmJhF3

authelia/users_database.yml.example

@@ -0,0 +1,34 @@
+---
+###############################################################################
+# Authelia users database
+#
+# Copy this to users_database.yml (gitignored) and edit. Generate the
+# password hash with:
+#
+#   docker compose run --rm authelia \
+#     authelia crypto hash generate argon2 --password 'your-plaintext-pass'
+#
+# Paste the resulting `$argon2id$v=19$m=...` string as the `password:` value.
+# Restart Authelia for changes to take effect (or wait refresh_interval).
+###############################################################################
+
+users:
+
+  yourname:
+    disabled: false
+    displayname: 'Your Name'
+    password: '$argon2id$v=19$m=65536,t=3,p=4$REPLACE_WITH_GENERATED_HASH'
+    email: 'you@example.com'
+    groups:
+      - 'admins'
+
+  # Add more users here. `groups` are referenced from access_control rules
+  # via `subject: 'group:admins'`.
+  #
+  # guest:
+  #   disabled: false
+  #   displayname: 'Guest'
+  #   password: '$argon2id$v=19$m=65536,t=3,p=4$...'
+  #   email: 'guest@example.com'
+  #   groups:
+  #     - 'guests'