Claude
cd78a3560d
Previously every example.com had to be found and replaced manually.
Now a single DOMAIN=yourdomain.com in .env propagates everywhere:
- .env.example: add DOMAIN=example.com with explanation
- docker-compose.yml: pass DOMAIN into authelia container environment
- authelia/configuration.yml: use {{ env "DOMAIN" }} in totp.issuer,
access_control.rules, and all four session.cookies[] fields
(Authelia 4.38+ Go template substitution)
- caddy/Caddyfile: use {env.DOMAIN} in all site block addresses
(Caddy native env substitution); update header comment explaining
how to set DOMAIN for system vs dockerized Caddy
- README.md: update step 3 to explain DOMAIN is the only change needed;
update step 4 to say just uncomment the right rule; update Caddy
wiring section with DOMAIN env var instructions for both Caddy modes
https://claude.ai/code/session_012eTokAaGiZo7aGt1T2W9BC
84 lines
3.1 KiB
YAML
84 lines
3.1 KiB
YAML
# ---------------------------------------------------------------------------
|
|
# Authelia + fail2ban
|
|
#
|
|
# Self-hosted authentication portal (Authelia) plus an IP-banning sidecar
|
|
# (fail2ban). Sits next to your dockerized Caddy on the main server and
|
|
# joins the same external `caddy_net` so Caddy reaches Authelia by
|
|
# container name (`authelia:9091`). Authelia is NOT port-mapped to the
|
|
# host -- there is no reason for anything outside the docker network to
|
|
# hit it directly.
|
|
#
|
|
# fail2ban runs in host network mode so its iptables bans drop packets
|
|
# at the host edge, which is the only place the bans actually work for
|
|
# traffic destined for docker-published ports.
|
|
#
|
|
# First-run: see README.md.
|
|
# ---------------------------------------------------------------------------
|
|
|
|
name: authelia
|
|
|
|
services:
|
|
|
|
authelia:
|
|
container_name: authelia
|
|
image: authelia/authelia:${AUTHELIA_VERSION:-4.39.19}
|
|
restart: unless-stopped
|
|
networks:
|
|
- caddy_net
|
|
expose:
|
|
- 9091
|
|
environment:
|
|
# Secrets are loaded from files mounted at /secrets (see volumes).
|
|
# The _FILE suffix is supported for any AUTHELIA_* env var.
|
|
- AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE=/secrets/JWT_SECRET
|
|
- AUTHELIA_SESSION_SECRET_FILE=/secrets/SESSION_SECRET
|
|
- AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE=/secrets/STORAGE_ENCRYPTION_KEY
|
|
- TZ=${TZ:-UTC}
|
|
# Passed through so authelia/configuration.yml can use {{ env "DOMAIN" }}
|
|
# instead of hardcoding your domain in the config file.
|
|
- DOMAIN=${DOMAIN}
|
|
volumes:
|
|
- ./authelia:/config
|
|
- ./authelia/secrets:/secrets:ro
|
|
healthcheck:
|
|
test: ['CMD', 'authelia', 'healthcheck']
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 30s
|
|
|
|
fail2ban:
|
|
container_name: fail2ban
|
|
image: crazymax/fail2ban:${FAIL2BAN_VERSION:-1.1.0-r0}
|
|
restart: unless-stopped
|
|
# Host networking so iptables bans take effect on the host's edge,
|
|
# including DOCKER-USER chain rules that gate traffic to containers.
|
|
network_mode: host
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- NET_RAW
|
|
environment:
|
|
- TZ=${TZ:-UTC}
|
|
- F2B_LOG_LEVEL=INFO
|
|
- F2B_DB_PURGE_AGE=7d
|
|
volumes:
|
|
- ./fail2ban/data:/data
|
|
# Authelia text log -- fail2ban watches this for 1FA/TOTP failures.
|
|
# Authelia writes it to /config/authelia.log = ./authelia/authelia.log.
|
|
# IMPORTANT: `touch authelia/authelia.log` before first `docker compose up`
|
|
# so Docker creates it as a file, not a directory (see README.md).
|
|
- ./authelia/authelia.log:/var/log/authelia/authelia.log:ro
|
|
# Caddy JSON access log -- covers ALL sites that import (accesslog),
|
|
# not just Authelia-gated ones. Mount the host directory read-only.
|
|
# Your Caddy must write here; see README.md "Caddy access log path".
|
|
- /var/log/caddy:/var/log/caddy:ro
|
|
# Wait for Authelia to pass its healthcheck before starting, so the
|
|
# authelia.log file exists before fail2ban tries to bind-mount it.
|
|
depends_on:
|
|
authelia:
|
|
condition: service_healthy
|
|
|
|
networks:
|
|
caddy_net:
|
|
external: true
|