Claude
ecbe1fc03d
Self-hosted SSO portal with file-based users, SQLite storage, filesystem notifier, and an iptables-banning fail2ban sidecar. Designed to drop into a DotheEvo-style ~/docker layout next to a dockerized Caddy on the main server, joining the same external caddy_net so Caddy reaches Authelia by container name. fail2ban runs in host network mode with NET_ADMIN/NET_RAW caps so its bans hit DOCKER-USER and actually drop packets at the edge. Includes a Caddy snippet (caddy/snippet.example.caddyfile) to merge into the user's real Caddyfile -- this repo doesn't manage Caddy itself. https://claude.ai/code/session_013XZ1vmgk78k2PEQ5DmJhF3
88 lines
3.1 KiB
Caddyfile
88 lines
3.1 KiB
Caddyfile
# =============================================================================
|
|
# Authelia + Caddy integration snippets
|
|
#
|
|
# Merge these blocks into your real Caddyfile (typically the one your
|
|
# dockerized Caddy mounts from its own ~/docker/caddy/ folder). Reload Caddy
|
|
# after editing:
|
|
# docker compose -f ~/docker/caddy/docker-compose.yml exec caddy \
|
|
# caddy reload --config /etc/caddy/Caddyfile
|
|
#
|
|
# Requires:
|
|
# - Caddy v2.5.1 or newer
|
|
# - Caddy joined to the external `caddy_net` docker network so it can
|
|
# resolve `authelia` by container name
|
|
# - access_control.rules in authelia/configuration.yml have an entry
|
|
# for each protected domain (otherwise Authelia's default_policy of
|
|
# `deny` will refuse access)
|
|
# =============================================================================
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Reusable forward_auth snippet -- import into any site you want gated.
|
|
# -----------------------------------------------------------------------------
|
|
(authelia) {
|
|
forward_auth authelia:9091 {
|
|
uri /api/authz/forward-auth
|
|
copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
|
|
}
|
|
}
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Caddy access logging -- fail2ban needs JSON access logs at a host path
|
|
# both Caddy and fail2ban can see. Mount /var/log/caddy in BOTH compose
|
|
# files (Caddy as rw, fail2ban as ro). The roll directives keep it bounded.
|
|
# -----------------------------------------------------------------------------
|
|
(accesslog) {
|
|
log {
|
|
output file /var/log/caddy/access.log {
|
|
roll_size 10MiB
|
|
roll_keep 5
|
|
roll_keep_for 720h
|
|
}
|
|
format json
|
|
}
|
|
}
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Authelia login portal -- bypass policy in access_control.rules
|
|
# -----------------------------------------------------------------------------
|
|
auth.example.com {
|
|
import accesslog
|
|
reverse_proxy authelia:9091
|
|
}
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Example: gate cam.example.com (Frigate UI on a different VLAN/host)
|
|
# Per-domain policy lives in authelia/configuration.yml, NOT here.
|
|
# -----------------------------------------------------------------------------
|
|
cam.example.com {
|
|
import accesslog
|
|
import authelia
|
|
reverse_proxy 192.168.x.x:8971 {
|
|
transport http {
|
|
read_timeout 60s
|
|
write_timeout 60s
|
|
}
|
|
}
|
|
}
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Example: gate doorbell.example.com (Pi PTT page + same-origin Frigate proxy)
|
|
# -----------------------------------------------------------------------------
|
|
doorbell.example.com {
|
|
import accesslog
|
|
import authelia
|
|
|
|
handle_path /frigate/* {
|
|
reverse_proxy 192.168.x.x:8971 {
|
|
transport http {
|
|
read_timeout 60s
|
|
write_timeout 60s
|
|
}
|
|
}
|
|
}
|
|
|
|
handle {
|
|
reverse_proxy 192.168.x.x:5555
|
|
}
|
|
}
|