Docker - Authelia - Nginx Proxy Manager

services:
  authelia:
    image: authelia/authelia:latest
    container_name: authelia
    volumes:
      - /docker/authelia/config:/config
    ports:
      - 9091:9091
    security_opt:
      - no-new-privileges:true
    environment:
      - TZ=Europe/Berlin
      #- PUID=$PUID
      #- PGID=$PGID
      - AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE=/run/secrets/authelia_jwt_secret
      - AUTHELIA_SESSION_SECRET_FILE=/run/secrets/authelia_session_secret
      - AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE=/run/secrets/authelia_storage_encryption_key
    secrets:
      - authelia_jwt_secret
      - authelia_storage_encryption_key
      - authelia_session_secret
    networks:
      NPM:
        ipv4_address: 10.100.0.240
    restart: unless-stopped
    healthcheck:
      disable: true
    depends_on:
      - redis

  redis:
    image: redis:alpine
    container_name: redis
    volumes:
      - /docker/redis:/data
    expose:
      - 6379
    restart: unless-stopped
    environment:
      - TZ=Europe/Berlin
    networks:
      NPM:
        ipv4_address: 10.100.0.239

networks:
  NPM:
    external: true
    name: NPM
    ipam:
      config:
        - subnet: 10.100.0.0/24
          gateway: 10.100.0.1

secrets:
  authelia_jwt_secret:
    file: /docker/secrets/authelia_jwt_secret
  authelia_session_secret:
    file: /docker/secrets/authelia_session_secret
  authelia_storage_encryption_key:
    file: /docker/secrets/authelia_storage_encryption_key

###############################################################
#                   Authelia configuration                    #
###############################################################

server:
  address: tcp://0.0.0.0:9091/
  buffers:
    read: 4096
    write: 4096
  endpoints:
    enable_pprof: false
    enable_expvars: false
  disable_healthcheck: false
  tls:
    key: ""  
    certificate: ""  

# https:{{comment_single_line_double_slash:1}}
log:
  level: info
  format: text
  file_path: /config/authelia.log
  keep_stdout: true

# https:{{comment_single_line_double_slash:2}}
totp:
  issuer: domain.de
  period: 30
  skew: 1

# AUTHELIA_DUO_PLACEHOLDER

# https:{{comment_single_line_double_slash:3}}
authentication_backend:
  password_reset:
    disable: false
  refresh_interval: 5m
  file:
    path: /config/users_database.yml
    password:
      algorithm: argon2id
      #iterations: 1
      #salt_length: 16
      #parallelism: 8
      #memory: 256 # blocks this much of the RAM
      iterations: 1
      key_length: 32
      salt_length: 16
      memory: 1024
      parallelism: 8

# https:{{comment_single_line_double_slash:4}}
access_control:
  default_policy: deny
  rules:
    - domain:
    #     - "*.example.com" 
        - "a.domain.de"  
      policy: bypass
    #   networks: # bypass authentication for local networks
    #     - 10.0.0.0/8
    #     - 192.168.0.0/16
    #     - 172.16.0.0/12
    - domain:
       # - "*.example.com" 
        - "speed.domain.de"  
      policy: one_factor
    #- domain:
        #- "*.example.com" 
        #- "example.com" 
      #policy: two_factor


# https:{{comment_single_line_double_slash:5}}
session:
  name: authelia_session
  same_site: lax
  expiration: 7h
  inactivity: 5m
  remember_me: 1M
  cookies:
    - domain: 'domain.de'  
      authelia_url: 'https://a.domain.de'  
      #default_redirection_url: 'https://google.com' 
  # AUTHELIA_REDIS_PLACEHOLDER

# https:{{comment_single_line_double_slash:6}}
regulation:
  max_retries: 2
  find_time: 3m
  ban_time: 12h

# https:{{comment_single_line_double_slash:7}}
storage:
  # For local storage, uncomment lines below and comment out mysql. https:{{comment_single_line_double_slash:8}}
  # This is good for the beginning. If you have a busy site then switch to other databases.
  local:
   path: /config/db.sqlite3

# https:{{comment_single_line_double_slash:9}}
notifier:
  disable_startup_check: false
  # For testing purposes, notifications can be sent in a file. Be sure to map the volume in docker-compose.
  filesystem:
    filename: /config/notifications.txt

  GNU nano 7.2                                                                                                  users_database.yml
users:
  USer: #username for user 1. change to whatever you'd like  
    displayname: "USer" #whatever you want the display name to be  
    password: "$argon2id$v=19$m=1024,t=1,p=8$ejlzWUbbbbbbbbbbbbbbbbbbbbbbbbbbbbLXaiB1wGCR5J8" #generated at https://argon2.online/  
    email: mail@gmail.com #whatever your email address is
    groups: #enter the groups you want the user to be part of below
      - admins
      - dev
 # user2: #username for user 2. change to whatever you'd like. Or delete this section if you only have 1 user  
  #  displayname: "User Name 2" #whatever you want the display name to be  
   # password: "$argon2i$v=19$m=1024,t=1,p=8$eTQ3MXdqOGFiaDZoMUtMVw$OeHWQSg9zGKslOepe5t4D1T9BZJjHA1Z+doxZrZYDgI" #generated at https://argon2.online/  
    #email: youremail2@gmail.com #whatever your email address is
    #groups: #enter the groups you want the user to be part of below
     # - dev

#any time you add a new user, you will need to restart the Authelia container to recognize the new settings/rules

location / {
        set $upstream_authelia http://öffentliche IP:9091; 
        proxy_pass $upstream_authelia;
        client_body_buffer_size 128k;
 
        #Timeout if the real server is dead
        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
 
        # Advanced Proxy Config
        send_timeout 5m;
        proxy_read_timeout 360;
        proxy_send_timeout 360;
        proxy_connect_timeout 360;
 
        # Basic Proxy Config
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header X-Forwarded-Uri $request_uri;
        proxy_set_header X-Forwarded-Ssl on;
        proxy_redirect  http://  $scheme://;
        proxy_http_version 1.1;
        proxy_set_header Connection "";  
        proxy_cache_bypass $cookie_session;
        proxy_no_cache $cookie_session;
        proxy_buffers 64 256k;
 
        # If behind reverse proxy, forwards the correct IP
        set_real_ip_from 10.0.0.0/8;
        set_real_ip_from 172.0.0.0/8;
        set_real_ip_from 192.168.0.0/16;
        set_real_ip_from fc00::/7;
        real_ip_header X-Forwarded-For;
        real_ip_recursive on;
    }

time="2024-10-27T22:29:12+01:00" level=info msg="Shutdown initiated"  
time="2024-10-27T22:29:12+01:00" level=info msg="Shutdown complete"  
time="2024-10-27T22:29:13+01:00" level=info msg="Authelia v4.38.16 is starting"  
time="2024-10-27T22:29:13+01:00" level=info msg="Log severity set to info"  
time="2024-10-27T22:29:13+01:00" level=info msg="Storage schema is being checked for updates"  
time="2024-10-27T22:29:13+01:00" level=info msg="Storage schema is already up to date"  
time="2024-10-27T22:29:13+01:00" level=info msg="Startup complete"  
time="2024-10-27T22:29:13+01:00" level=info msg="Listening for non-TLS connections on '[::]:9091' path '/'" server=main service=server  
time="2024-10-27T22:29:15+01:00" level=info msg="Access to https://speed.domain.de/api/speedtests/status (method GET) is not authorized to user <anonymous>, responding with status code 401" method=GET path=/api/verify remote_ip=99.999.999.999  
time="2024-10-27T22:30:29+01:00" level=info msg="Access to https://speed.domain.de/assets/fonts/inter-v12-latin-700.woff2 (method GET) is not authorized to user <anonymous>, responding with status code 401" method=GET path=/api/verify remote_ip=99.999.999.999  
time="2024-10-27T22:30:29+01:00" level=info msg="Access to https://speed.domain.de/assets/locales/de.json (method GET) is not authorized to user <anonymous>, responding with status code 401" method=GET path=/api/verify remote_ip=99.999.999.999  
time="2024-10-27T22:30:29+01:00" level=info msg="Access to https://speed.domain.de/assets/locales/en.json (method GET) is not authorized to user <anonymous>, responding with status code 401" method=GET path=/api/verify remote_ip=99.999.999.999