Initial Authelia + fail2ban stack

Self-hosted SSO portal with file-based users, SQLite storage, filesystem notifier, and an iptables-banning fail2ban sidecar. Designed to drop into a DotheEvo-style ~/docker layout next to a dockerized Caddy on the main server, joining the same external caddy_net so Caddy reaches Authelia by container name. fail2ban runs in host network mode with NET_ADMIN/NET_RAW caps so its bans hit DOCKER-USER and actually drop packets at the edge. Includes a Caddy snippet (caddy/snippet.example.caddyfile) to merge into the user's real Caddyfile -- this repo doesn't manage Caddy itself. https://claude.ai/code/session_013XZ1vmgk78k2PEQ5DmJhF3
2026-04-26 00:26:48 +00:00
commit ecbe1fc03d
13 changed files with 802 additions and 0 deletions
@@ -0,0 +1,74 @@
+# ---------------------------------------------------------------------------
+# Authelia + fail2ban
+#
+# Self-hosted authentication portal (Authelia) plus an IP-banning sidecar
+# (fail2ban). Sits next to your dockerized Caddy on the main server and
+# joins the same external `caddy_net` so Caddy reaches Authelia by
+# container name (`authelia:9091`). Authelia is NOT port-mapped to the
+# host -- there is no reason for anything outside the docker network to
+# hit it directly.
+#
+# fail2ban runs in host network mode so its iptables bans drop packets
+# at the host edge, which is the only place the bans actually work for
+# traffic destined for docker-published ports.
+#
+# First-run: see README.md.
+# ---------------------------------------------------------------------------
+
+name: authelia
+
+services:
+
+  authelia:
+    container_name: authelia
+    image: authelia/authelia:${AUTHELIA_VERSION:-4.39}
+    restart: unless-stopped
+    networks:
+      - caddy_net
+    expose:
+      - 9091
+    environment:
+      # Secrets are loaded from files mounted at /secrets (see volumes).
+      # The _FILE suffix is supported for any AUTHELIA_* env var.
+      - AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE=/secrets/JWT_SECRET
+      - AUTHELIA_SESSION_SECRET_FILE=/secrets/SESSION_SECRET
+      - AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE=/secrets/STORAGE_ENCRYPTION_KEY
+      - TZ=${TZ:-UTC}
+    volumes:
+      - ./authelia:/config
+      - ./authelia/secrets:/secrets:ro
+    healthcheck:
+      test: ['CMD', 'authelia', 'healthcheck']
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
+
+  fail2ban:
+    container_name: fail2ban
+    image: crazymax/fail2ban:${FAIL2BAN_VERSION:-latest}
+    restart: unless-stopped
+    # Host networking so iptables bans take effect on the host's edge,
+    # including DOCKER-USER chain rules that gate traffic to containers.
+    network_mode: host
+    cap_add:
+      - NET_ADMIN
+      - NET_RAW
+    environment:
+      - TZ=${TZ:-UTC}
+      - F2B_LOG_LEVEL=INFO
+      - F2B_DB_PURGE_AGE=7d
+    volumes:
+      - ./fail2ban/data:/data
+      # Authelia log -- read-only mount so fail2ban can parse 1FA/TOTP
+      # failures. Authelia writes this under /config which is ./authelia.
+      - ./authelia/authelia.log:/var/log/authelia/authelia.log:ro
+      # Caddy access log -- you must configure your Caddyfile to write
+      # JSON access logs to this host path. See README.md.
+      - /var/log/caddy:/var/log/caddy:ro
+    depends_on:
+      - authelia
+
+networks:
+  caddy_net:
+    external: true