43 lines
1.7 KiB
YAML
43 lines
1.7 KiB
YAML
services:
|
|
authelia:
|
|
image: authelia/authelia:latest
|
|
container_name: authelia
|
|
restart: unless-stopped
|
|
networks:
|
|
- traefik_network
|
|
volumes:
|
|
- /srv/docker/authelia/config:/config
|
|
- ./config.yaml:/config/configuration.yml:ro
|
|
secrets:
|
|
- authelia_jwt_secret
|
|
- authelia_session_secret
|
|
- authelia_storage_encryption_key
|
|
environment:
|
|
- TZ=America/Chicago
|
|
- AUTHELIA_JWT_SECRET_FILE=/run/secrets/authelia_jwt_secret
|
|
- AUTHELIA_SESSION_SECRET_FILE=/run/secrets/authelia_session_secret
|
|
- AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE=/run/secrets/authelia_storage_encryption_key
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=traefik_network"
|
|
# Portal router - serves the login UI itself
|
|
- "traefik.http.routers.${SERVICE_NAME}.rule=Host(`auth.${DOMAIN_NAME}`)"
|
|
- "traefik.http.routers.${SERVICE_NAME}.entrypoints=websecure"
|
|
- "traefik.http.routers.${SERVICE_NAME}.tls.certresolver=cloudflare"
|
|
- "traefik.http.services.${SERVICE_NAME}.loadbalancer.server.port=9091"
|
|
# ForwardAuth middleware - attach this to any OTHER router you want gated
|
|
- "traefik.http.middlewares.authelia.forwardauth.address=http://${SERVICE_NAME}:9091/api/verify?rd=https://auth.${DOMAIN_NAME}"
|
|
- "traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true"
|
|
- "traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email"
|
|
|
|
networks:
|
|
traefik_network:
|
|
external: true
|
|
|
|
secrets:
|
|
authelia_jwt_secret:
|
|
file: ./secrets/jwt_secret
|
|
authelia_session_secret:
|
|
file: ./secrets/session_secret
|
|
authelia_storage_encryption_key:
|
|
file: ./secrets/storage_encryption_key |