108 lines
3.9 KiB
YAML
108 lines
3.9 KiB
YAML
version: '3.7'
|
|
x-authelia-env: &authelia-env
|
|
X_AUTHELIA_EMAIL: authelia@nixc.us
|
|
X_AUTHELIA_SITE_NAME: ATLAS
|
|
# X_AUTHELIA_DUO_HOSTNAME: my_duo_hostname
|
|
X_AUTHELIA_CONFIG_FILTERS: template
|
|
X_AUTHELIA_LDAP_DOMAIN: dc=nixc,dc=us
|
|
TRAEFIK_DOMAIN: nixc.us
|
|
# CONFIG: /home/deleted-porcupine/docker-configs
|
|
|
|
networks:
|
|
default:
|
|
driver: overlay
|
|
traefik:
|
|
external: true
|
|
ad:
|
|
external: true
|
|
services:
|
|
authelia:
|
|
image: git.nixc.us/nixius/authelia:staging-authelia
|
|
command:
|
|
- "authelia"
|
|
- "--config=/config/configuration.server.yml"
|
|
- "--config=/config/configuration.ldap.yml"
|
|
- "--config=/config/configuration.acl.yml"
|
|
- "--config=/config/configuration.identity.providers.yml"
|
|
- "--config=/config/configuration.oidc.clients.yml"
|
|
environment:
|
|
<<: *authelia-env
|
|
# volumes:
|
|
# - /mnt/tank/persist/nixc.us/authelia/staging/config:/config
|
|
networks:
|
|
- traefik
|
|
- default
|
|
- ad
|
|
deploy:
|
|
placement:
|
|
constraints:
|
|
## - node.labels.role == db
|
|
- node.hostname == ingress.nixc.us
|
|
# - node.labels.mac-rack == true
|
|
labels:
|
|
- "us.nixc.autodeploy=true"
|
|
## https://www.staging-authelia_authelia.com/docs/deployment/supported-proxies/traefik2.x.html
|
|
- 'traefik.enable=true'
|
|
- 'traefik.http.routers.staging-authelia_authelia.tls=true'
|
|
- "traefik.http.services.staging-authelia_authelia.loadbalancer.server.port=9091"
|
|
- 'traefik.http.routers.staging-authelia_authelia.rule=Host(`staging.login.nixc.us`)'
|
|
- 'traefik.http.routers.staging-authelia_authelia.entrypoints=websecure'
|
|
- "traefik.http.routers.staging-authelia_authelia.tls.certresolver=letsencryptresolver"
|
|
- "traefik.http.routers.staging-authelia_authelia.service=authelia_authelia"
|
|
- "traefik.docker.network=traefik"
|
|
## Authelia recommendations
|
|
- 'traefik.http.middlewares.staging-authelia_authelia.forwardauth.address=http://authelia_authelia:9091/api/verify?rd=https://login.nixc.us/'
|
|
- 'traefik.http.middlewares.staging-authelia_authelia.forwardauth.trustForwardHeader=true'
|
|
- 'traefik.http.middlewares.staging-authelia_authelia.forwardauth.authResponseHeaders=Remote-User, Remote-Groups, Remote-Name, Remote-Email'
|
|
- 'traefik.http.middlewares.staging-authelia-basic.forwardauth.address=http://authelia_authelia:9091/api/verify?auth=basic'
|
|
- 'traefik.http.middlewares.staging-authelia-basic.forwardauth.trustForwardHeader=true'
|
|
- 'traefik.http.middlewares.staging-authelia-basic.forwardauth.authResponseHeaders=Remote-User, Remote-Groups, Remote-Name, Remote-Email'
|
|
|
|
redis:
|
|
image: git.nixc.us/nixius/authelia:staging-redis
|
|
# command: redis-server --appendonly yes
|
|
deploy:
|
|
replicas: 1
|
|
placement:
|
|
constraints:
|
|
## - node.labels.role == db
|
|
- node.hostname == ingress.nixc.us
|
|
# - node.labels.mac-rack == true
|
|
# preferences:
|
|
# - spread: node.id
|
|
labels:
|
|
- traefik.enable=false
|
|
- "us.nixc.autodeploy=true"
|
|
volumes:
|
|
- /mnt/tank/persist/nixc.us/authelia/staging/redis:/data
|
|
networks:
|
|
- default
|
|
|
|
mariadb:
|
|
image: git.nixc.us/nixius/authelia:staging-mariadb
|
|
# restart: always
|
|
environment:
|
|
MYSQL_ROOT_PASSWORD: authelia
|
|
MYSQL_DATABASE: authelia
|
|
MYSQL_USER: authelia
|
|
MYSQL_PASSWORD: authelia
|
|
volumes:
|
|
- '/mnt/tank/persist/nixc.us/authelia/staging/db:/var/lib/mysql'
|
|
deploy:
|
|
replicas: 1
|
|
placement:
|
|
constraints:
|
|
## - node.labels.role == db
|
|
- node.hostname == ingress.nixc.us
|
|
# - node.labels.mac-rack == true
|
|
# placement:
|
|
# constraints:
|
|
# - node.role == manager
|
|
# preferences:
|
|
# - spread: node.id
|
|
labels:
|
|
- traefik.enable=false
|
|
- "us.nixc.autodeploy=true"
|
|
networks:
|
|
- default
|