###########################################################################
#                   Minimal Authelia Configuration                        #
###########################################################################
# by: Wizardry and Steamworks, 2025, original by www.simplehomelab.com    #
###########################################################################

server:
  address: tcp://0.0.0.0:9091/
  endpoints:
    enable_pprof: false
    enable_expvars: false
  disable_healthcheck: false
  tls:
    key: ""
    certificate: ""

# https://www.authelia.com/configuration/miscellaneous/logging/
log:
  level: info
  format: text
  file_path: /config/authelia.log
  keep_stdout: true

# https://www.authelia.com/configuration/second-factor/time-based-one-time-password/
totp:
  issuer: DUCKDNS_DOMAIN
  period: 30
  skew: 1

# https://www.authelia.com/reference/guides/passwords/
authentication_backend:
  password_reset:
    disable: true
  refresh_interval: 5m
  file:
    path: /config/users.yml
    password:
      algorithm: argon2id
      iterations: 1
      salt_length: 16
      parallelism: 8
      memory: 256

# https://www.authelia.com/overview/authorization/access-control/
access_control:
  default_policy: deny
  rules:
    - domain:
        - "AUTH_DUCKDNS_DOMAIN"
        # notification services implement their own authentication
        - "gotify.DUCKDNS_DOMAIN"
      policy: bypass
    - domain:
        - "*.DUCKDNS_DOMAIN"
        - "DUCKDNS_DOMAIN"
      policy: one_factor

# https://www.authelia.com/configuration/session/introduction/
session:
  name: authelia_session
  same_site: lax
  expiration: 7h
  inactivity: 5m
  remember_me: 1M
  secret: '0523B3CB1E24FB555D59D5034128A9ECB0F952C7B2B43EF8A0871239F93F63CF'
  cookies:
    - domain: 'DUCKDNS_DOMAIN'
      authelia_url: 'https://AUTH_DUCKDNS_DOMAIN'
      default_redirection_url: 'https://REDIRECT_DUCKDNS_DOMAIN'

# https://www.authelia.com/configuration/security/regulation/
regulation:
  max_retries: 3
  find_time: 10m
  ban_time: 12h
  
# https://www.authelia.com/configuration/storage/introduction/
storage:
  encryption_key: 'B69FDB780D2A64F45B6846636FDF50E58E2BEDB168312799863AF5B9660D804D'
  local:
    path: /config/db.sqlite3

# https://www.authelia.com/configuration/notifications/introduction/
notifier:
  disable_startup_check: false
  filesystem:
    filename: /config/notifications.txt

identity_validation:
  reset_password:
    jwt_secret: 'FED54B095BA4EAEF10C1BCDDEB9A7BF6BBA05B3AF34D007D11AA61B89F16616B'
