Initial Authelia + fail2ban stack

Self-hosted SSO portal with file-based users, SQLite storage, filesystem notifier, and an iptables-banning fail2ban sidecar. Designed to drop into a DotheEvo-style ~/docker layout next to a dockerized Caddy on the main server, joining the same external caddy_net so Caddy reaches Authelia by container name. fail2ban runs in host network mode with NET_ADMIN/NET_RAW caps so its bans hit DOCKER-USER and actually drop packets at the edge. Includes a Caddy snippet (caddy/snippet.example.caddyfile) to merge into the user's real Caddyfile -- this repo doesn't manage Caddy itself. https://claude.ai/code/session_013XZ1vmgk78k2PEQ5DmJhF3
2026-04-26 00:26:48 +00:00
commit ecbe1fc03d
13 changed files with 802 additions and 0 deletions
@@ -0,0 +1,87 @@
+# =============================================================================
+# Authelia + Caddy integration snippets
+#
+# Merge these blocks into your real Caddyfile (typically the one your
+# dockerized Caddy mounts from its own ~/docker/caddy/ folder). Reload Caddy
+# after editing:
+#   docker compose -f ~/docker/caddy/docker-compose.yml exec caddy \
+#     caddy reload --config /etc/caddy/Caddyfile
+#
+# Requires:
+#   - Caddy v2.5.1 or newer
+#   - Caddy joined to the external `caddy_net` docker network so it can
+#     resolve `authelia` by container name
+#   - access_control.rules in authelia/configuration.yml have an entry
+#     for each protected domain (otherwise Authelia's default_policy of
+#     `deny` will refuse access)
+# =============================================================================
+
+# -----------------------------------------------------------------------------
+# Reusable forward_auth snippet -- import into any site you want gated.
+# -----------------------------------------------------------------------------
+(authelia) {
+    forward_auth authelia:9091 {
+        uri /api/authz/forward-auth
+        copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
+    }
+}
+
+# -----------------------------------------------------------------------------
+# Caddy access logging -- fail2ban needs JSON access logs at a host path
+# both Caddy and fail2ban can see. Mount /var/log/caddy in BOTH compose
+# files (Caddy as rw, fail2ban as ro). The roll directives keep it bounded.
+# -----------------------------------------------------------------------------
+(accesslog) {
+    log {
+        output file /var/log/caddy/access.log {
+            roll_size     10MiB
+            roll_keep     5
+            roll_keep_for 720h
+        }
+        format json
+    }
+}
+
+# -----------------------------------------------------------------------------
+# Authelia login portal -- bypass policy in access_control.rules
+# -----------------------------------------------------------------------------
+auth.example.com {
+    import accesslog
+    reverse_proxy authelia:9091
+}
+
+# -----------------------------------------------------------------------------
+# Example: gate cam.example.com (Frigate UI on a different VLAN/host)
+# Per-domain policy lives in authelia/configuration.yml, NOT here.
+# -----------------------------------------------------------------------------
+cam.example.com {
+    import accesslog
+    import authelia
+    reverse_proxy 192.168.x.x:8971 {
+        transport http {
+            read_timeout  60s
+            write_timeout 60s
+        }
+    }
+}
+
+# -----------------------------------------------------------------------------
+# Example: gate doorbell.example.com (Pi PTT page + same-origin Frigate proxy)
+# -----------------------------------------------------------------------------
+doorbell.example.com {
+    import accesslog
+    import authelia
+
+    handle_path /frigate/* {
+        reverse_proxy 192.168.x.x:8971 {
+            transport http {
+                read_timeout  60s
+                write_timeout 60s
+            }
+        }
+    }
+
+    handle {
+        reverse_proxy 192.168.x.x:5555
+    }
+}