Claude
ecbe1fc03d
Self-hosted SSO portal with file-based users, SQLite storage, filesystem notifier, and an iptables-banning fail2ban sidecar. Designed to drop into a DotheEvo-style ~/docker layout next to a dockerized Caddy on the main server, joining the same external caddy_net so Caddy reaches Authelia by container name. fail2ban runs in host network mode with NET_ADMIN/NET_RAW caps so its bans hit DOCKER-USER and actually drop packets at the edge. Includes a Caddy snippet (caddy/snippet.example.caddyfile) to merge into the user's real Caddyfile -- this repo doesn't manage Caddy itself. https://claude.ai/code/session_013XZ1vmgk78k2PEQ5DmJhF3
18 lines
602 B
Plaintext
18 lines
602 B
Plaintext
[authelia]
|
|
enabled = true
|
|
filter = authelia
|
|
logpath = /var/log/authelia/authelia.log
|
|
maxretry = 3
|
|
findtime = 10m
|
|
bantime = 1h
|
|
|
|
# DOCKER-USER is the chain Docker inserts before its own per-container
|
|
# rules; banning here drops packets destined for docker-published ports
|
|
# (i.e. your Caddy container's 80/443) before iptables routes them in.
|
|
chain = DOCKER-USER
|
|
banaction = iptables-allports
|
|
|
|
# Tuple-form action so we record where it came from. `port=anyport` is
|
|
# fine because chain=DOCKER-USER drops at the chain head regardless.
|
|
action = iptables-allports[name=authelia, chain=DOCKER-USER]
|