---
###############################################################################
# Authelia configuration
#
#  - File-based user database (no LDAP)
#  - SQLite local storage (no Redis, no MySQL/Postgres)
#  - Filesystem notifier (writes "emails" to /config/notifications/...)
#  - Argon2id password hashing
#  - Per-domain access policies under access_control.rules
#
# Secrets are NOT in this file. They are loaded from files mounted at
# /secrets via the AUTHELIA_*_FILE env vars in docker-compose.yml.
#
# After editing, validate before restarting:
#   docker compose run --rm authelia authelia validate-config --config /config/configuration.yml
###############################################################################

theme: 'dark'

server:
  address: 'tcp://0.0.0.0:9091'
  buffers:
    read: 8192
    write: 8192

log:
  level: 'info'
  format: 'text'             # fail2ban filter expects text format
  file_path: '/config/authelia.log'
  keep_stdout: true          # also log to stdout for `docker logs`

identity_validation:
  reset_password:
    jwt_lifespan: '5 minutes'
    jwt_algorithm: 'HS256'
    # jwt_secret loaded via AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE

totp:
  disable: false
  issuer: 'example.com'      # CHANGE: your root domain (shown in authenticator app)
  algorithm: 'sha1'
  digits: 6
  period: 30

authentication_backend:
  password_change:
    disable: false
  password_reset:
    disable: false
  refresh_interval: '5 minutes'
  file:
    path: '/config/users_database.yml'
    password:
      algorithm: 'argon2'
      argon2:
        variant: 'argon2id'
        iterations: 3
        memory: 65536
        parallelism: 4
        key_length: 32
        salt_length: 16

# ---------------------------------------------------------------------------
# Access control
#
# default_policy: deny means every domain Authelia sees must have an
# explicit allow rule. Caddy only sends a domain to Authelia when its site
# block has `import authelia`, so domains you don't proxy through Authelia
# aren't affected.
#
# Policies:
#   bypass      no auth (Authelia portal itself)
#   one_factor  password only
#   two_factor  password + TOTP
# ---------------------------------------------------------------------------
access_control:
  default_policy: 'deny'
  rules:
    - domain: 'auth.example.com'        # CHANGE
      policy: 'bypass'

    # Examples -- uncomment / change to your subdomains:
    # - domain: 'cam.example.com'
    #   policy: 'one_factor'
    # - domain: 'doorbell.example.com'
    #   policy: 'two_factor'

session:
  # secret loaded via AUTHELIA_SESSION_SECRET_FILE
  cookies:
    - name: 'authelia_session'
      domain: 'example.com'                          # CHANGE: your root domain
      authelia_url: 'https://auth.example.com'       # CHANGE
      default_redirection_url: 'https://example.com' # CHANGE
      expiration: '1 hour'
      inactivity: '5 minutes'
      remember_me: '1 month'
      same_site: 'lax'

# In-app rate limiting. First line of defense; fail2ban is the second.
regulation:
  max_retries: 3
  find_time: '2 minutes'
  ban_time: '5 minutes'

storage:
  # encryption_key loaded via AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE
  local:
    path: '/config/db.sqlite3'

# Filesystem notifier -- password reset / new device emails get written to
# a file you can `tail -f`. Swap to `smtp:` when you wire up a real
# transactional sender.
notifier:
  disable_startup_check: false
  filesystem:
    filename: '/config/notifications/notification.txt'