Chapter 25 Single Sign-On: Authelia and Authentik in Front of Everything

services:
  authelia:
    image: authelia/authelia:4.39.28
    container_name: authelia
    restart: unless-stopped
    volumes:
      - ./config:/config
    environment:
      - TZ=Your/Timezone
      - AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET=${JWT_SECRET}
      - AUTHELIA_SESSION_SECRET=${SESSION_SECRET}
      - AUTHELIA_STORAGE_ENCRYPTION_KEY=${STORAGE_ENCRYPTION_KEY}
    networks:
      # Chapter 8's shared network -- the proxy reaches it as
      # authelia:9091
      - proxy
networks:
  proxy:
    external: true

Generate each value with openssl rand -hex 32.

# .env
JWT_SECRET=first_random_value
SESSION_SECRET=second_random_value
STORAGE_ENCRYPTION_KEY=third_random_value

# /opt/stacks/authelia/config/configuration.yml
authentication_backend:
  file:
    path: /config/users_database.yml

access_control:
  default_policy: deny
  rules:
    - domain: '*.home.yourdomain.com'
      policy: two_factor

session:
  cookies:
    - domain: 'home.yourdomain.com'
      authelia_url: 'https://auth.home.yourdomain.com'

storage:
  local:
    path: /config/db.sqlite3

notifier:
  filesystem:
    filename: /config/notification.txt

docker run --rm -it authelia/authelia:4.39.28 \
  authelia crypto hash generate argon2
# Type your password when asked, then copy the line starting $argon2id

# /opt/stacks/authelia/config/users_database.yml
users:
  yourname:
    displayname: 'Your Name'
    # the hash from above
    password: '$argon2id$v=19$m=65536,t=3,p=4$...'
    email: [email protected]

# /opt/stacks/npm/data/snippets/authelia-location.conf
# Nginx sends a quiet background check here before serving each
# request.
set $upstream_authelia http://authelia:9091/api/authz/auth-request;
location /internal/authelia/authz {
    internal;
    proxy_pass $upstream_authelia;
    proxy_set_header X-Original-Method $request_method;
    proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header Content-Length "";
    proxy_set_header Connection "";
    proxy_pass_request_body off;
}

# /opt/stacks/npm/data/snippets/authelia-authrequest.conf
# Ask Authelia first; if you're not logged in, send you to its login
# page.
auth_request /internal/authelia/authz;
auth_request_set $user $upstream_http_remote_user;
proxy_set_header Remote-User $user;
auth_request_set $redirection_url $upstream_http_location;
error_page 401 =302 $redirection_url;

Per service you want behind SSO. Not on auth.home, and not on Vaultwarden.

include /data/snippets/authelia-location.conf;

location / {
    include /data/snippets/authelia-authrequest.conf;
    include conf.d/include/proxy.conf;
}