Move back to simpleauth

This commit is contained in:
Neale Pickett 2023-02-26 20:40:10 -07:00
parent bb7db9b716
commit befbffb12e
5 changed files with 33 additions and 166 deletions

View File

@ -3,32 +3,12 @@
#debug #debug
} }
(authelia) {
uri /api/verify?rd=https://auth.woozle.org/
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
}
# This has to be at the same level as other `handle` directives,
# since `handle` is a mutually-exclusive thingy.
# https://caddy.community/t/copy-header-into-new-header-iff-it-is-set/18827
(restricted-access) { (restricted-access) {
@noAuth header !Authorization forward_auth simpleauth:8080 {
@hasAuth not header !Authorization uri /
forward_auth @noAuth authelia:9091 { copy_headers X-Simpleauth-Username
import authelia header_down X-Simpleauth-Domain "woozle.org"
} }
forward_auth @hasAuth authelia:9091 {
import authelia
header_up Proxy-Authorization {header.authorization}
}
# XXX: If the client sends an "Accept" header, Authelia returns 401 with no Www-Authenticate header, violating HTTP
@unauthorized `{err.status_code} == 401`
header @unauthorized Www-Authenticate "Basic realm=goober"
}
auth.woozle.org {
reverse_proxy authelia:9091
} }
git.woozle.org { git.woozle.org {

View File

@ -1,5 +1,5 @@
. { . {
bind lan bind 192.168.86.2
hosts { hosts {
192.168.86.2 sweetums.woozle.org deergrove.woozle.org drive.woozle.org git.woozle.org ancestry.woozle.org media.woozle.org auth.woozle.org 192.168.86.2 sweetums.woozle.org deergrove.woozle.org drive.woozle.org git.woozle.org ancestry.woozle.org media.woozle.org auth.woozle.org
fallthrough fallthrough

View File

@ -1,97 +0,0 @@
log:
level: info # error, warn, [info], debug, trace
authentication_backend:
password_reset:
disable: true
file:
path: /run/secrets/users.yaml
totp:
issuer: woozle.org
session:
domain: woozle.org
same_site: strict
redis:
host: redis
port: 6379
database_index: 1
storage:
local:
path: /srv/sys/authelia/db.sqlite3
notifier:
filesystem:
filename: /run/emails.txt
access_control:
default_policy: deny
rules:
- domain: deergrove.woozle.org
subject:
- "group:octoprint"
resources:
- '^/octoprint/'
- '^/webcam/'
policy: one_factor
- domain: deergrove.woozle.org
subject:
- "group:media"
resources:
- '^/[a-z]+arr/'
- '^/nzbget/'
- '^/transmission/'
- '^/sucker/'
- '^/unmanic/'
policy: one_factor
- domain: deergrove.woozle.org
resources:
- '^/[a-z.]*$'
- '^/netdata/'
policy: one_factor
- domain: drive.woozle.org
methods:
- HEAD
- GET
- PROPFIND
resources:
- '^/storage/public/'
policy: bypass
- domain: drive.woozle.org
subject:
- "group:storage"
resources:
- '^/incoming/'
- '^/media/'
- '^/storage/(README.md)?$'
- '^/storage/(?P<User>\w+)/'
- '^/storage/(?P<Group>\w+)/'
- '^/storage/shared/'
- '^/storage/public/'
policy: one_factor
- domain: drive.woozle.org
methods:
- HEAD
- GET
- PROPFIND
- OPTIONS
resources:
- '^/(README.md)?$'
- '^/incoming/'
- '^/media/'
- '^/storage/shared/'
policy: one_factor
- domain: photos.woozle.org
resources:
- '^(/pgapi)?/gallery/(?P<User>\w+)'
- '^(/pgapi)?/gallery/(?P<Group>\w+)'
- '^(/pgapi)?/gallery/content/'
policy: one_factor
- domain: photos.woozle.org
resources:
- '^(/pgapi)?/gallery/.'
policy: deny
- domain: photos.woozle.org
policy: one_factor

View File

@ -44,42 +44,29 @@ services:
- host.docker.internal:host-gateway - host.docker.internal:host-gateway
- host.lan:192.168.86.2 - host.lan:192.168.86.2
authelia: simpleauth:
image: authelia/authelia image: git.woozle.org/neale/simpleauth
environment:
AUTHELIA_JWT_SECRET_FILE: /run/secrets/jwt.secret
AUTHELIA_SESSION_SECRET_FILE: /run/secrets/session.secret
AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: /run/secrets/storage.secret
secrets: secrets:
- jwt.secret - passwd
- session.secret - simpleauth.key
- storage.secret
- users.yaml
- authelia.oidc.yaml
configs:
- source: authelia.yaml
target: /authelia.yaml
command:
- authelia
- --config=/authelia.yaml
- --config=/run/secrets/authelia.oidc.yaml
volumes:
- type: bind
source: /srv/sys/authelia
target: /srv/sys/authelia
# Authelia wants this jellyfin:
redis: image: jellyfin/jellyfin
image: redis:alpine deploy:
command: replicas: 0
- redis-server environment:
- --save TZ: US/Mountain
- "60"
- "1"
volumes: volumes:
- type: bind - type: bind
source: /srv/sys/redis source: /srv/sys/jellyfin/config
target: /data target: /config
- type: bind
source: /srv/sys/jellyfin/cache
target: /cache
- type: bind
source: /srv/media/
target: /srv/media/
read_only: true
plex: plex:
image: lscr.io/linuxserver/plex:latest image: lscr.io/linuxserver/plex:latest
@ -93,8 +80,8 @@ services:
source: /srv/sys/plex source: /srv/sys/plex
target: /config target: /config
- type: bind - type: bind
source: /srv source: /srv/media/
target: /srv target: /srv/media/
read_only: true read_only: true
pigallery2: pigallery2:
@ -115,7 +102,7 @@ services:
read_only: true read_only: true
transmission: transmission:
image: lscr.io/linuxserver/transmission image: lscr.io/linuxserver/transmission:latest
volumes: volumes:
- type: bind - type: bind
source: /srv/sys/transmission source: /srv/sys/transmission
@ -293,7 +280,6 @@ services:
target: 139 target: 139
- published: 445 - published: 445
target: 445 target: 445
webdav: webdav:
image: micromata/dave image: micromata/dave
volumes: volumes:
@ -347,16 +333,16 @@ configs:
name: dave.yaml-v3 name: dave.yaml-v3
Corefile: Corefile:
file: Corefile file: Corefile
name: Corefile-v4 name: Corefile-v5
Caddyfile: Caddyfile:
file: Caddyfile file: Caddyfile
name: Caddyfile-v133 name: Caddyfile-v135
index.html: index.html:
file: www/index.html file: www/index.html
name: index.html-v43 name: index.html-v43
index.mjs: index.mjs:
file: www/index.mjs file: www/index.mjs
name: index.mjs-v12 name: index.mjs-v14
index.css: index.css:
file: www/index.css file: www/index.css
name: index.css-v2 name: index.css-v2
@ -369,9 +355,6 @@ configs:
deergrove.png: deergrove.png:
file: www/deergrove.png file: www/deergrove.png
name: deergrove.png-v1 name: deergrove.png-v1
authelia.yaml:
file: authelia.yaml
name: authelia.yaml-v36
netdata.conf: netdata.conf:
file: netdata.conf file: netdata.conf
name: netdata.conf-v1 name: netdata.conf-v1

View File

@ -65,9 +65,10 @@ async function init() {
let icons = doc.body.appendChild(doc.createElement("section")) let icons = doc.body.appendChild(doc.createElement("section"))
icons.classList.add("icons") icons.classList.add("icons")
let nav = document.querySelector("nav") let portalURL = new URL("portal.json", window.location)
let resp = await fetch("portal.json") let resp = await fetch(portalURL)
let obj = await resp.json() let obj = await resp.json()
let nav = document.querySelector("nav")
for (let app of obj) { for (let app of obj) {
let hlink = null let hlink = null
if (app.target != "_blank") { if (app.target != "_blank") {