Claude
ecbe1fc03d
Self-hosted SSO portal with file-based users, SQLite storage, filesystem notifier, and an iptables-banning fail2ban sidecar. Designed to drop into a DotheEvo-style ~/docker layout next to a dockerized Caddy on the main server, joining the same external caddy_net so Caddy reaches Authelia by container name. fail2ban runs in host network mode with NET_ADMIN/NET_RAW caps so its bans hit DOCKER-USER and actually drop packets at the edge. Includes a Caddy snippet (caddy/snippet.example.caddyfile) to merge into the user's real Caddyfile -- this repo doesn't manage Caddy itself. https://claude.ai/code/session_013XZ1vmgk78k2PEQ5DmJhF3
75 lines
2.5 KiB
YAML
75 lines
2.5 KiB
YAML
# ---------------------------------------------------------------------------
|
|
# Authelia + fail2ban
|
|
#
|
|
# Self-hosted authentication portal (Authelia) plus an IP-banning sidecar
|
|
# (fail2ban). Sits next to your dockerized Caddy on the main server and
|
|
# joins the same external `caddy_net` so Caddy reaches Authelia by
|
|
# container name (`authelia:9091`). Authelia is NOT port-mapped to the
|
|
# host -- there is no reason for anything outside the docker network to
|
|
# hit it directly.
|
|
#
|
|
# fail2ban runs in host network mode so its iptables bans drop packets
|
|
# at the host edge, which is the only place the bans actually work for
|
|
# traffic destined for docker-published ports.
|
|
#
|
|
# First-run: see README.md.
|
|
# ---------------------------------------------------------------------------
|
|
|
|
name: authelia
|
|
|
|
services:
|
|
|
|
authelia:
|
|
container_name: authelia
|
|
image: authelia/authelia:${AUTHELIA_VERSION:-4.39}
|
|
restart: unless-stopped
|
|
networks:
|
|
- caddy_net
|
|
expose:
|
|
- 9091
|
|
environment:
|
|
# Secrets are loaded from files mounted at /secrets (see volumes).
|
|
# The _FILE suffix is supported for any AUTHELIA_* env var.
|
|
- AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE=/secrets/JWT_SECRET
|
|
- AUTHELIA_SESSION_SECRET_FILE=/secrets/SESSION_SECRET
|
|
- AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE=/secrets/STORAGE_ENCRYPTION_KEY
|
|
- TZ=${TZ:-UTC}
|
|
volumes:
|
|
- ./authelia:/config
|
|
- ./authelia/secrets:/secrets:ro
|
|
healthcheck:
|
|
test: ['CMD', 'authelia', 'healthcheck']
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 30s
|
|
|
|
fail2ban:
|
|
container_name: fail2ban
|
|
image: crazymax/fail2ban:${FAIL2BAN_VERSION:-latest}
|
|
restart: unless-stopped
|
|
# Host networking so iptables bans take effect on the host's edge,
|
|
# including DOCKER-USER chain rules that gate traffic to containers.
|
|
network_mode: host
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- NET_RAW
|
|
environment:
|
|
- TZ=${TZ:-UTC}
|
|
- F2B_LOG_LEVEL=INFO
|
|
- F2B_DB_PURGE_AGE=7d
|
|
volumes:
|
|
- ./fail2ban/data:/data
|
|
# Authelia log -- read-only mount so fail2ban can parse 1FA/TOTP
|
|
# failures. Authelia writes this under /config which is ./authelia.
|
|
- ./authelia/authelia.log:/var/log/authelia/authelia.log:ro
|
|
# Caddy access log -- you must configure your Caddyfile to write
|
|
# JSON access logs to this host path. See README.md.
|
|
- /var/log/caddy:/var/log/caddy:ro
|
|
depends_on:
|
|
- authelia
|
|
|
|
networks:
|
|
caddy_net:
|
|
external: true
|