misc/ansible-base
0
0
Fork 0
Code Issues Pull requests 1 Actions Packages Projects Releases Wiki Activity

[task-406] authelia

Browse source
This commit is contained in:
fenris 2025-10-09 01:43:49 +02:00
parent fb931da668
commit e0f485e556
5 changed files with 651 additions and 338 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

449
roles/authelia/cfg.schema.json Normal file
View file

@ -0,0 +1,449 @@
{
"nullable": false,
"type": "object",
"properties": {
"listen_address": {
"nullable": false,
"type": "string",
"default": "0.0.0.0"
},
"domain": {
"nullable": false,
"type": "string"
},
"session_domain": {
"nullable": false,
"type": "string"
},
"redirect_url": {
"nullable": false,
"type": "string"
},
"jwt_secret": {
"nullable": false,
"type": "string"
},
"session_secret": {
"nullable": false,
"type": "string"
},
"storage_encryption_key": {
"nullable": false,
"type": "string"
},
"users_file_path": {
"nullable": false,
"type": "string",
"default": "/var/authelia/users.yml"
},
"log_file_path": {
"nullable": false,
"type": "string",
"default": "/var/authelia/log.jsonl"
},
"storage": {
"anyOf": [
{
"nullable": false,
"type": "object",
"properties": {
"kind": {
"nullable": false,
"type": "string",
"enum": ["sqlite"],
"default": "sqlite"
},
"data": {
"nullable": false,
"type": "object",
"properties": {
"path": {
"nullable": false,
"type": "string",
"default": "/var/authelia/state.db"
}
},
"additionalProperties": false,
"required": [
"path"
],
"default": {
}
}
},
"additionalProperties": false,
"required": [
"kind",
"data"
],
"default": {
}
},
{
"nullable": false,
"type": "object",
"properties": {
"kind": {
"nullable": false,
"type": "string",
"enum": ["postgresql"]
},
"data": {
"nullable": false,
"type": "object",
"properties": {
"host": {
"nullable": false,
"type": "string",
"ddefault": "localhost"
},
"port": {
"nullable": false,
"type": "integer",
"default": 5432
},
"username": {
"nullable": false,
"type": "string",
"default": "authelia_user"
},
"password": {
"nullable": false,
"type": "string"
},
"schema": {
"nullable": false,
"type": "string",
"default": "authelia"
}
},
"additionalProperties": false,
"required": [
"host",
"port",
"username",
"password",
"schema"
],
"default": {
}
}
},
"additionalProperties": false,
"required": [
"kind",
"data"
],
"default": {
}
},
{
"nullable": false,
"type": "object",
"properties": {
"kind": {
"nullable": false,
"type": "string",
"enum": ["mariadb"]
},
"data": {
"nullable": false,
"type": "object",
"properties": {
"host": {
"nullable": false,
"type": "string",
"ddefault": "localhost"
},
"port": {
"nullable": false,
"type": "integer",
"default": 3306
},
"username": {
"nullable": false,
"type": "string",
"default": "authelia_user"
},
"password": {
"nullable": false,
"type": "string"
},
"schema": {
"nullable": false,
"type": "string",
"default": "authelia"
}
},
"additionalProperties": false,
"required": [
"host",
"port",
"username",
"password",
"schema"
],
"default": {
}
}
},
"additionalProperties": false,
"required": [
"kind",
"data"
],
"default": {
}
}
]
},
"ntp_server": {
"nullable": false,
"type": "string",
"default": "time.cloudflare.com:123"
},
"password_reset": {
"nullable": false,
"type": "object",
"properties": {
"enabled": {
"nullable": false,
"type": "boolean",
"default": false
},
"custom_url": {
"nullable": true,
"type": "string",
"default": null
}
},
"additionalProperties": false,
"required": [
"enabled",
"custom_url"
],
"default": {
}
},
"notification": {
"anyOf": [
{
"nullable": false,
"type": "object",
"properties": {
"kind": {
"nullable": false,
"type": "string",
"enum": ["file"],
"default": "file"
},
"data": {
"nullable": false,
"type": "object",
"properties": {
"path": {
"nullable": false,
"type": "string",
"default": "/var/authelia/notifications"
}
},
"additionalProperties": false,
"required": [
"path"
],
"default": {
}
}
},
"additionalProperties": false,
"required": [
"kind",
"data"
],
"default": {
}
},
{
"nullable": false,
"type": "object",
"properties": {
"kind": {
"nullable": false,
"type": "string",
"enum": ["smtp"],
"default": "smtp"
},
"data": {
"nullable": false,
"type": "object",
"properties": {
"host": {
"nullable": false,
"type": "string"
},
"port": {
"nullable": false,
"type": "integer",
"default": 465
},
"username": {
"nullable": false,
"type": "string",
"default": "authelia"
},
"password": {
"nullable": false,
"type": "string"
},
"sender": {
"nullable": false,
"type": "string",
"default": "authelia@example.org"
}
},
"additionalProperties": false,
"required": [
"host",
"port",
"username",
"password",
"sender"
]
}
},
"additionalProperties": false,
"required": [
"kind",
"data"
],
"default": {
}
}
]
},
"oidc": {
"nullable": false,
"type": "object",
"properties": {
"hmac_secret": {
"nullable": false,
"type": "string"
},
"lifespan": {
"nullable": false,
"type": "object",
"properties": {
"default": {
"nullable": false,
"type": "object",
"properties": {
"access_token": {
"nullable": false,
"type": "string",
"default": "1h"
},
"refresh_token": {
"nullable": false,
"type": "string",
"default": "1m"
}
},
"additionalProperties": false,
"required": [
],
"default": {
}
},
"custom": {
"nullable": false,
"type": "object",
"properties": {
},
"additionalProperties": {
"nullable": false,
"type": "object",
"properties": {
"access_token": {
"nullable": false,
"type": "string"
},
"refresh_token": {
"nullable": false,
"type": "string"
}
},
"additionalProperties": false,
"required": [
"access_token",
"refresh_token"
]
},
"required": [
],
"default": {
"long": {
"access_token": "2d",
"refresh_token": "3d"
}
}
}
},
"additionalProperties": false,
"required": [
],
"default": {
}
},
"cors_endpoints": {
"nullable": true,
"type": "array",
"items": {
"nullable": false,
"type": "string",
"enum": [
"authorization",
"pushed-authorization-request",
"token",
"revocation",
"introspection",
"userinfo"
]
},
"default": [
"authorization",
"token",
"revocation",
"introspection",
"userinfo"
]
}
},
"additionalProperties": false,
"required": [
"hmac_secret",
"lifespan",
"cors_endpoints"
],
"default": {
}
}
},
"additionalProperties": false,
"required": [
"listen_address",
"domain",
"session_domain",
"redirect_url",
"jwt_secret",
"session_secret",
"storage_encryption_key",
"users_file_path",
"log_file_path",
"storage",
"ntp_server",
"notification",
"oidc"
],
"default": {
}
}

80
roles/authelia/defaults/main.json
View file

@ -1,39 +1,45 @@
{
"var_authelia_version": "4.37.5",
"var_authelia_architecture": "amd64",
"var_authelia_listen_address": "0.0.0.0",
"var_authelia_jwt_secret": "REPLACE_ME",
"var_authelia_users_file_path": "/var/authelia/users.yml",
"var_authelia_log_file_path": "/var/authelia/log.jsonl",
"var_authelia_domain": "authelia.example.org",
"var_authelia_redirect_url": "https://example.org",
"var_authelia_session_domain": "example.org",
"var_authelia_session_secret": "REPLACE_ME",
"var_authelia_storage_encryption_key": "REPLACE_ME",
"var_authelia_storage_kind": "sqlite",
"var_authelia_storage_data_sqlite_path": "/var/authelia/state.db",
"var_authelia_storage_data_postgresql_host": "localhost",
"var_authelia_storage_data_postgresql_port": 5432,
"var_authelia_storage_data_postgresql_username": "authelia_user",
"var_authelia_storage_data_postgresql_password": "REPLACE_ME",
"var_authelia_storage_data_postgresql_schema": "authelia",
"var_authelia_storage_data_mariadb_host": "localhost",
"var_authelia_storage_data_mariadb_port": 3306,
"var_authelia_storage_data_mariadb_username": "authelia_user",
"var_authelia_storage_data_mariadb_password": "REPLACE_ME",
"var_authelia_storage_data_mariadb_schema": "authelia",
"var_authelia_ntp_server": "time.cloudflare.com:123",
"var_authelia_password_reset_enabled": false,
"var_authelia_password_reset_custom_url": null,
"var_authelia_notification_mode": "smtp",
"var_authelia_notification_file_path": "/var/authelia/notifications",
"var_authelia_notification_smtp_host": "smtp.example.org",
"var_authelia_notification_smtp_port": 465,
"var_authelia_notification_smtp_username": "authelia",
"var_authelia_notification_smtp_password": "REPLACE_ME",
"var_authelia_notification_smtp_sender": "authelia@example.org",
"var_authelia_oidc_hmac_secret": "REPLACE_ME",
"var_authelia_oidc_lifespan_access_token": "1h",
"var_authelia_oidc_lifespan_refresh_token": "1m",
"var_authelia_oidc_cors_endpoints": null
"cfg_authelia_defaults": {
"listen_address": "0.0.0.0",
"users_file_path": "/var/authelia/users.yml",
"log_file_path": "/var/authelia/log.jsonl",
"storage": {
"kind": "sqlite",
"data": {
"path": "/var/authelia/state.db"
}
},
"ntp_server": "time.cloudflare.com:123",
"password_reset": {
"enabled": false,
"custom_url": null
},
"notification": {
"kind": "file",
"data": {
"path": "/var/authelia/notifications"
}
},
"oidc": {
"lifespan": {
"default": {
"access_token": "1d",
"refresh_token": "1h"
},
"custom": {
"long": {
"access_token": "2d",
"refresh_token": "3d"
}
}
},
"cors_endpoints": [
"authorization",
"token",
"revocation",
"introspection",
"userinfo"
]
}
}
}

46
roles/authelia/tasks/main.json
View file

@ -1,6 +1,16 @@
[
{
"name": "packages | prerequisites",
"name": "show vars",
"when": "switch_show_vars",
"ansible.builtin.debug": {
"var": "vars.cfg_authelia"
}
},
{
"name": "packages",
"block": [
{
"name": "prerequisites",
"become": true,
"ansible.builtin.apt": {
"update_cache": true,
@ -12,7 +22,7 @@
}
},
{
"name": "packages | keys",
"name": "keys",
"become": true,
"ansible.builtin.get_url": {
"url": "https://www.authelia.com/keys/authelia-security.gpg",
@ -20,7 +30,7 @@
}
},
{
"name": "packages | repository",
"name": "repository",
"become": true,
"ansible.builtin.shell": {
"cmd": "echo \"deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/authelia-security.gpg] https://apt.authelia.com stable main\" > /etc/apt/sources.list.d/authelia.list",
@ -29,7 +39,7 @@
},
{
"name": "packages | installation",
"name": "installation",
"become": true,
"ansible.builtin.apt": {
"update_cache": true,
@ -40,6 +50,8 @@
"authelia"
]
}
}
]
},
{
"name": "generate private key for signing OIDC JWTs",
@ -52,6 +64,9 @@
},
"register": "temp_tls_result"
},
{
"name": "configuration",
"block": [
{
"name": "configuration | compose script",
"become": true,
@ -87,40 +102,51 @@
"ansible.builtin.command": {
"cmd": "/usr/bin/authelia-conf-compose --main-file-path=/etc/authelia/conf.d/main.json --clients-directory-path=/etc/authelia/conf.d/clients --output-format=yaml --output-path=/etc/authelia/configuration.yml"
}
}
]
},
{
"name": "setup log directory",
"become": true,
"ansible.builtin.file": {
"state": "directory",
"path": "{{var_authelia_log_file_path | dirname}}"
"owner": "authelia",
"group": "authelia",
"path": "{{cfg_authelia.log_file_path | dirname}}"
}
},
{
"name": "users | directory",
"name": "users",
"block": [
{
"name": "directory",
"become": true,
"ansible.builtin.file": {
"state": "directory",
"path": "{{var_authelia_users_file_path | dirname}}"
"owner": "authelia",
"group": "authelia",
"path": "{{cfg_authelia.users_file_path | dirname}}"
}
},
{
"name": "users | initial file",
"name": "initial file",
"become": true,
"ansible.builtin.template": {
"src": "users.yml.j2",
"dest": "{{var_authelia_users_file_path}}",
"dest": "{{cfg_authelia.users_file_path}}",
"force": false
}
},
{
"name": "users | management script",
"name": "management script",
"become": true,
"ansible.builtin.copy": {
"src": "user-manage.py",
"dest": "/usr/bin/authelia-user-manage",
"mode": "0700"
}
}
]
},
{
"name": "apply",

75
roles/authelia/templates/conf-main.json.j2
View file

@ -2,12 +2,12 @@
"theme": "auto",
"identity_validation": {
"reset_password": {
"jwt_secret": "{{var_authelia_jwt_secret}}"
"jwt_secret": "{{cfg_authelia.jwt_secret}}"
}
},
"default_2fa_method": "totp",
"server": {
"address": "{{var_authelia_listen_address}}:9091",
"address": "{{cfg_authelia.listen_address}}:9091",
"endpoints": {
"enable_pprof": false,
"enable_expvars": false
@ -17,7 +17,7 @@
"log": {
"level": "info",
"format": "json",
"file_path": "{{var_authelia_log_file_path}}",
"file_path": "{{cfg_authelia.log_file_path}}",
"keep_stdout": false
},
"telemetry": {
@ -43,7 +43,7 @@
"user_verification": "preferred"
},
"ntp": {
"address": "{{var_authelia_ntp_server}}",
"address": "{{cfg_authelia.ntp_server}}",
"version": 4,
"max_desync": "3s",
"disable_startup_check": false,
@ -51,16 +51,16 @@
},
"authentication_backend": {
"password_reset": {
{% if var_authelia_password_reset_enabled %}
{% if cfg_authelia.password_reset.enabled %}
"disable": false,
{% else %}
"disable": true,
{% endif %}
"custom_url": "{{var_authelia_password_reset_custom_url}}"
"custom_url": {{cfg_authelia.password_reset.custom_url | to_json}}
},
"refresh_interval": "5m",
"file": {
"path": "{{var_authelia_users_file_path}}",
"path": "{{cfg_authelia.users_file_path}}",
"watch": true,
"search": {
"email": false,
@ -121,15 +121,15 @@
"session": {
"name": "authelia_session",
"same_site": "lax",
"secret": "{{var_authelia_session_secret}}",
"secret": "{{cfg_authelia.session_secret}}",
"expiration": "1h",
"inactivity": "5m",
"remember_me": "1M",
"cookies": [
{
"domain": "{{var_authelia_session_domain}}",
"authelia_url": "https://{{var_authelia_domain}}/",
"default_redirection_url": "{{var_authelia_redirect_url}}"
"domain": "{{cfg_authelia.session_domain}}",
"authelia_url": "https://{{cfg_authelia.domain}}/",
"default_redirection_url": "{{cfg_authelia.redirect_url}}"
}
]
},
@ -139,44 +139,44 @@
"ban_time": "5m"
},
"storage": {
"encryption_key": "{{var_authelia_storage_encryption_key}}",
{% if var_authelia_storage_kind == "sqlite" %}
"encryption_key": "{{cfg_authelia.storage_encryption_key}}",
{% if cfg_authelia.storage.kind == "sqlite" %}
"local": {
"path": "{{var_authelia_storage_data_sqlite_path}}"
"path": "{{cfg_authelia.storage.data.path}}"
}
{% endif %}
{% if var_authelia_storage_kind == "postgresql" %}
{% if cfg_authelia.storage.kind == "postgresql" %}
"postgres": {
"address": "{{var_authelia_storage_data_postgresql_host}}:{{var_authelia_storage_data_postgresql_port | string}}",
"address": "{{cfg_authelia.storage.data.host}}:{{cfg_authelia.storage.data.port | string}}",
"schema": "public",
"username": "{{var_authelia_storage_data_postgresql_username}}",
"password": "{{var_authelia_storage_data_postgresql_password}}",
"database": "{{var_authelia_storage_data_postgresql_schema}}"
"username": "{{cfg_authelia.storage.data.username}}",
"password": "{{cfg_authelia.storage.data.password}}",
"database": "{{cfg_authelia.storage.data.schema}}"
}
{% endif %}
{% if var_authelia_storage_kind == "mariadb" %}
{% if cfg_authelia.storage.kind == "mariadb" %}
"mysql": {
"host": "{{var_authelia_storage_data_mariadb_host}}",
"port": {{var_authelia_storage_data_mariadb_port | string}},
"username": "{{var_authelia_storage_data_mariadb_username}}",
"password": "{{var_authelia_storage_data_mariadb_password}}",
"database": "{{var_authelia_storage_data_mariadb_schema}}"
"host": "{{cfg_authelia.storage.data.host}}",
"port": {{cfg_authelia.storage.data.port | string}},
"username": "{{cfg_authelia.storage.data.username}}",
"password": "{{cfg_authelia.storage.data.password}}",
"database": "{{cfg_authelia.storage.data.schema}}"
}
{% endif %}
},
"notifier": {
"disable_startup_check": true,
{% if var_authelia_notification_mode == "file" %}
{% if cfg_authelia.notification.kind == "file" %}
"filesystem": {
"filename": "{{var_authelia_notification_file_path}}"
"filename": "{{cfg_authelia.notification.data.path}}"
}
{% endif %}
{% if var_authelia_notification_mode == "smtp" %}
{% if cfg_authelia.notification.kind == "smtp" %}
"smtp": {
"address": "{{var_authelia_notification_smtp_host}}:{{var_authelia_notification_smtp_port | string}}",
"username": "{{var_authelia_notification_smtp_username}}",
"password": "{{var_authelia_notification_smtp_password}}",
"sender": "{{var_authelia_notification_smtp_sender}}",
"address": "{{cfg_authelia.notification.data.host}}:{{cfg_authelia.notification.data.port | string}}",
"username": "{{cfg_authelia.notification.data.username}}",
"password": "{{cfg_authelia.notification.data.password}}",
"sender": "{{cfg_authelia.notification.data.sender}}",
"disable_require_tls": false,
"disable_html_emails": false,
"tls": {
@ -187,7 +187,7 @@
},
"identity_providers": {
"oidc": {
"hmac_secret": "{{var_authelia_oidc_hmac_secret}}",
"hmac_secret": "{{cfg_authelia.oidc.hmac_secret}}",
"jwks": [
{
"algorithm": "RS256",
@ -195,14 +195,15 @@
}
],
"lifespans": {
"access_token": "{{var_authelia_oidc_lifespan_access_token}}",
"refresh_token": "{{var_authelia_oidc_lifespan_refresh_token}}"
"access_token": "{{cfg_authelia.oidc.lifespan.default.access_token}}",
"refresh_token": "{{cfg_authelia.oidc.lifespan.default.refresh_token}}",
"custom": {{cfg_authelia.oidc.lifespan.custom | to_json}}
},
"cors": {
"allowed_origins_from_client_redirect_uris": true
{% if var_authelia_oidc_cors_endpoints == None %}
{% if cfg_authelia.oidc.cors_endpoints == None %}
{% else %}
,"endpoints": {{var_authelia_oidc_cors_endpoints | to_json}}
,"endpoints": {{cfg_authelia.oidc.cors_endpoints | to_json}}
{% endif %}
},
"clients": [

169
roles/authelia/vardef.json
View file

@ -1,169 +0,0 @@
{
"version": {
"type": "string",
"mandatory": false
},
"architecture": {
"type": "string",
"mandatory": false
},
"listen_address": {
"type": "string",
"mandatory": false
},
"jwt_secret": {
"type": "string",
"mandatory": true
},
"users_file_path": {
"type": "string",
"mandatory": false
},
"log_file_path": {
"type": "string",
"mandatory": false
},
"domain": {
"type": "string",
"mandatory": false
},
"redirect_url": {
"type": "string",
"mandatory": false
},
"session_domain": {
"type": "string",
"mandatory": false
},
"session_secret": {
"type": "string",
"mandatory": true
},
"storage_encryption_key": {
"type": "string",
"mandatory": true
},
"storage_kind": {
"type": "string",
"mandatory": false
},
"storage_data_sqlite_path": {
"type": "string",
"mandatory": false
},
"storage_data_postgresql_host": {
"type": "string",
"mandatory": false
},
"storage_data_postgresql_port": {
"type": "integer",
"mandatory": false
},
"storage_data_postgresql_username": {
"type": "string",
"mandatory": false
},
"storage_data_postgresql_password": {
"type": "string",
"mandatory": false
},
"storage_data_postgresql_schema": {
"type": "string",
"mandatory": false
},
"storage_data_mariadb_host": {
"type": "string",
"mandatory": false
},
"storage_data_mariadb_port": {
"type": "integer",
"mandatory": false
},
"storage_data_mariadb_username": {
"type": "string",
"mandatory": false
},
"storage_data_mariadb_password": {
"type": "string",
"mandatory": false
},
"storage_data_mariadb_schema": {
"type": "string",
"mandatory": false
},
"ntp_server": {
"type": "string",
"mandatory": false
},
"password_reset_enabled": {
"type": "boolean",
"mandatory": false
},
"password_reset_custom_url": {
"nullable": true,
"type": "string",
"mandatory": false
},
"notification_mode": {
"type": "string",
"mandatory": false,
"options": [
"file",
"smtp"
]
},
"notification_file_path": {
"type": "string",
"mandatory": false
},
"notification_smtp_host": {
"type": "string",
"mandatory": false
},
"notification_smtp_port": {
"type": "integer",
"mandatory": false
},
"notification_smtp_username": {
"type": "string",
"mandatory": false
},
"notification_smtp_password": {
"type": "string",
"mandatory": false
},
"notification_smtp_sender": {
"type": "string",
"mandatory": false
},
"oidc_hmac_secret": {
"type": "string",
"mandatory": true
},
"oidc_lifespan_access_token": {
"nullable": true,
"type": "string",
"mandatory": false
},
"oidc_lifespan_refresh_token": {
"nullable": true,
"type": "string",
"mandatory": false
},
"oidc_cors_endpoints": {
"nullable": true,
"type": "array",
"items": {
"type": "string",
"enum": [
"authorization",
"pushed-authorization-request",
"token",
"revocation",
"introspection",
"userinfo"
]
},
"mandatory": false
}
}