Skip to content

Commit ed45526

Browse files
Youssef-HarbyYoussef-Harby
committed
feat: restructure Caddy and Nginx configurations for Authelia integration and remove unused LDAP service
1 parent fe3904c commit ed45526

8 files changed

+373
-39
lines changed

‎authelia/configuration-lldap.yml

+119
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
---
2+
###############################################################
3+
# Authelia configuration #
4+
###############################################################
5+
6+
# This secret can also be set using the env variables AUTHELIA_JWT_SECRET_FILE
7+
identity_validation:
8+
reset_password:
9+
jwt_secret: a_very_important_secret
10+
11+
server:
12+
address: tcp://0.0.0.0:9091/
13+
endpoints:
14+
authz:
15+
forward-auth:
16+
implementation: "ForwardAuth"
17+
18+
log:
19+
level: debug
20+
21+
totp:
22+
issuer: authelia.com
23+
24+
# duo_api:
25+
# hostname: api-123456789.pygeoapi.local
26+
# integration_key: ABCDEF
27+
# # This secret can also be set using the env variables AUTHELIA_DUO_API_SECRET_KEY_FILE
28+
# secret_key: 1234567890abcdefghifjkl
29+
30+
authentication_backend:
31+
password_reset:
32+
disable: false
33+
refresh_interval: 1m
34+
ldap:
35+
implementation: custom
36+
address: ldap://lldap:3890
37+
timeout: 5s
38+
start_tls: false
39+
base_dn: dc=pygeoapi,dc=local
40+
additional_users_dn: ou=people
41+
users_filter: "(&({username_attribute}={input})(objectClass=person))"
42+
additional_groups_dn: ou=groups
43+
groups_filter: "(member={dn})"
44+
attributes:
45+
display_name: displayName
46+
username: uid
47+
group_name: cn
48+
mail: mail
49+
user: uid=admin,ou=people,dc=pygeoapi,dc=local
50+
password: "super_strong_ldap_password" ## change this
51+
52+
access_control:
53+
default_policy: deny
54+
rules:
55+
- domain: "app.pygeoapi.local"
56+
policy: one_factor
57+
resources:
58+
- "^/api/collections/obs.*"
59+
subject:
60+
- "group:cartologic"
61+
62+
- domain: "app.pygeoapi.local"
63+
policy: one_factor
64+
resources:
65+
- "^/api/collections/lakes.*"
66+
subject:
67+
- "group:geobeyond"
68+
69+
- domain: "app.pygeoapi.local"
70+
policy: one_factor
71+
resources:
72+
- "^.*\\/api(?:\\/)?(?:\\?.*)?$"
73+
- "^/api/static/.*"
74+
- "^.*\\/api\\/collections(?:\\?.*)?$"
75+
- "^.*\\/api\\/processes(?:\\?.*)?$"
76+
- "^.*\\/api\\/jobs(?:\\?.*)?$"
77+
- "^.*\\/api\\/openapi(?:\\?.*)?$"
78+
- "^.*\\/api\\/conformance(?:\\?.*)?$"
79+
subject:
80+
- "group:geobeyond"
81+
- "group:cartologic"
82+
83+
session:
84+
secret: unsecure_session_secret
85+
name: authelia_session
86+
same_site: "lax"
87+
inactivity: 5m
88+
expiration: 1h
89+
remember_me: 5M
90+
# Remove the `cookies` block if keeping `domain`, or vice versa
91+
domain: "pygeoapi.local"
92+
# cookies:
93+
# - domain: "pygeoapi.local"
94+
# authelia_url: "https://pygeoapi.local"
95+
# default_redirection_url: "https://app.pygeoapi.local/api"
96+
# name: "authelia_session"
97+
# same_site: "lax"
98+
# inactivity: "5m"
99+
# expiration: "1h"
100+
# remember_me: "1d"
101+
102+
redis:
103+
host: redis
104+
port: 6379
105+
106+
regulation:
107+
max_retries: 3
108+
find_time: 120
109+
ban_time: 300
110+
111+
storage:
112+
encryption_key: you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this
113+
local:
114+
path: /config/db.sqlite3
115+
116+
notifier:
117+
disable_startup_check: true
118+
filesystem:
119+
filename: /config/notification.txt

‎authelia/configuration.yml

-14
Original file line numberDiff line numberDiff line change
@@ -87,19 +87,6 @@ session:
8787
inactivity: 5m
8888
expiration: 1h
8989
remember_me: 5M
90-
<<<<<<< HEAD
91-
# Remove the `cookies` block if keeping `domain`, or vice versa
92-
domain: "pygeoapi.local"
93-
# cookies:
94-
# - domain: "pygeoapi.local"
95-
# authelia_url: "https://pygeoapi.local"
96-
# default_redirection_url: "https://app.pygeoapi.local/api"
97-
# name: "authelia_session"
98-
# same_site: "lax"
99-
# inactivity: "5m"
100-
# expiration: "1h"
101-
# remember_me: "1d"
102-
=======
10390
cookies:
10491
- domain: "pygeoapi.local"
10592
authelia_url: "https://pygeoapi.local"
@@ -109,7 +96,6 @@ session:
10996
inactivity: "5m"
11097
expiration: "1h"
11198
remember_me: "1d"
112-
>>>>>>> main
11399

114100
redis:
115101
host: redis

‎caddy/Caddyfile

-4
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,4 @@ app.pygeoapi.local {
1313
header_up Proxy-Authorization {http.request.header.Authorization}
1414
}
1515
reverse_proxy pygeoapi:80
16-
}
17-
18-
lldap.pygeoapi.local {
19-
reverse_proxy lldap:17170
2016
}

‎caddy/lldap.Caddyfile

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Authelia Portal.
2+
pygeoapi.local {
3+
reverse_proxy authelia:9091
4+
}
5+
6+
# Protected Endpoint.
7+
app.pygeoapi.local {
8+
forward_auth authelia:9091 {
9+
uri /api/authz/forward-auth?authelia_url=https://pygeoapi.local/
10+
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
11+
header_up X-Forwarded-Method {method}
12+
header_up X-Forwarded-URI {uri}
13+
header_up Proxy-Authorization {http.request.header.Authorization}
14+
}
15+
reverse_proxy pygeoapi:80
16+
}
17+
18+
lldap.pygeoapi.local {
19+
reverse_proxy lldap:17170
20+
}

‎docker-compose-caddy-lldap.yml

+75
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
services:
2+
caddy:
3+
container_name: caddy
4+
image: caddy:2.8.4
5+
restart: unless-stopped
6+
networks:
7+
- caddy
8+
ports:
9+
- 80:80
10+
- 443:443
11+
volumes:
12+
- ./caddy/lldap.Caddyfile:/etc/caddy/Caddyfile
13+
14+
authelia:
15+
container_name: authelia
16+
image: authelia/authelia:4.38.17
17+
restart: unless-stopped
18+
networks:
19+
- caddy
20+
expose:
21+
- 9091
22+
ports:
23+
- 9091
24+
volumes:
25+
- ./authelia:/config
26+
- ./authelia/configuration-lldap.yml:/config/configuration.yml
27+
depends_on:
28+
- redis
29+
environment:
30+
- AUTHELIA_SESSION_DOMAIN=pygeoapi.local
31+
- AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD=super_strong_ldap_password
32+
- AUTHELIA_AUTHENTICATION_BACKEND_LDAP_BASE_DN=dc=pygeoapi,dc=local
33+
34+
redis:
35+
container_name: redis
36+
image: redis:7.0
37+
restart: unless-stopped
38+
networks:
39+
- caddy
40+
41+
pygeoapi:
42+
container_name: pygeoapi
43+
image: geopython/pygeoapi:latest
44+
volumes:
45+
- ./pygeoapi-config.yml:/pygeoapi/local.config.yml
46+
ports:
47+
- 80
48+
environment:
49+
- SCRIPT_NAME=/api
50+
depends_on:
51+
- redis
52+
- caddy
53+
- authelia
54+
networks:
55+
- caddy
56+
57+
lldap:
58+
container_name: lldap
59+
image: lldap/lldap:stable
60+
restart: unless-stopped
61+
networks:
62+
- caddy
63+
expose:
64+
- 3890 # LDAP service
65+
- 17170 # Web service
66+
volumes:
67+
- ./lldap/config:/data:rw
68+
environment:
69+
- LLDAP_JWT_SECRET=REPLACE_WITH_RANDOM
70+
- LLDAP_KEY_SEED=REPLACE_WITH_RANDOM
71+
- LLDAP_LDAP_BASE_DN=dc=pygeoapi,dc=local
72+
- LLDAP_LDAP_USER_PASS="super_strong_ldap_password"
73+
networks:
74+
caddy:
75+
name: caddy

‎docker-compose-nginx-lldap.yml

+73
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
2+
services:
3+
nginx:
4+
container_name: nginx
5+
image: lscr.io/linuxserver/nginx
6+
restart: unless-stopped
7+
networks:
8+
- nginx
9+
ports:
10+
- 80:80
11+
- 443:443
12+
volumes:
13+
- ./nginx/site-confs:/config/nginx/site-confs
14+
- ./nginx/snippets:/config/nginx/snippets
15+
- ./nginx/certs:/config/ssl # see nginx/README.md to generate self signed certs in this directory
16+
environment:
17+
TZ: 'UTC'
18+
DOCKER_MODS: 'linuxserver/mods:nginx-proxy-confs'
19+
20+
authelia:
21+
container_name: authelia
22+
image: authelia/authelia:4.38.9
23+
restart: unless-stopped
24+
networks:
25+
- nginx
26+
ports:
27+
- 9091:9091
28+
volumes:
29+
- ./authelia:/config
30+
- ./authelia/configuration-lldap.yml:/config/configuration.yml
31+
depends_on:
32+
- redis
33+
34+
redis:
35+
container_name: redis
36+
image: redis:7.0
37+
restart: unless-stopped
38+
networks:
39+
- nginx
40+
41+
pygeoapi:
42+
container_name: pygeoapi
43+
image: geopython/pygeoapi:latest
44+
volumes:
45+
- ./pygeoapi-config.yml:/pygeoapi/local.config.yml
46+
environment:
47+
- SCRIPT_NAME=/api
48+
depends_on:
49+
- redis
50+
- nginx
51+
- authelia
52+
networks:
53+
- nginx
54+
55+
lldap:
56+
container_name: lldap
57+
image: lldap/lldap:stable
58+
restart: unless-stopped
59+
networks:
60+
- nginx
61+
expose:
62+
- 3890 # LDAP service
63+
- 17170 # Web service
64+
volumes:
65+
- ./lldap/config:/data:rw
66+
environment:
67+
- LLDAP_JWT_SECRET=REPLACE_WITH_RANDOM
68+
- LLDAP_KEY_SEED=REPLACE_WITH_RANDOM
69+
- LLDAP_LDAP_BASE_DN=dc=pygeoapi,dc=local
70+
- LLDAP_LDAP_USER_PASS="super_strong_ldap_password"
71+
networks:
72+
nginx:
73+
name: nginx

‎docker-compose.yml

+1-21
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,6 @@ services:
2525
- ./authelia:/config
2626
depends_on:
2727
- redis
28-
environment:
29-
- AUTHELIA_SESSION_DOMAIN=pygeoapi.local
30-
- AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD=super_strong_ldap_password
31-
- AUTHELIA_AUTHENTICATION_BACKEND_LDAP_BASE_DN=dc=pygeoapi,dc=local
3228

3329
redis:
3430
container_name: redis
@@ -53,22 +49,6 @@ services:
5349
networks:
5450
- caddy
5551

56-
lldap:
57-
container_name: lldap
58-
image: lldap/lldap:stable
59-
restart: unless-stopped
60-
networks:
61-
- caddy
62-
expose:
63-
- 3890 # LDAP service
64-
- 17170 # Web service
65-
volumes:
66-
- ./lldap/config:/data:rw
67-
environment:
68-
- LLDAP_JWT_SECRET=REPLACE_WITH_RANDOM
69-
- LLDAP_KEY_SEED=REPLACE_WITH_RANDOM
70-
- LLDAP_LDAP_BASE_DN=dc=pygeoapi,dc=local
71-
- LLDAP_LDAP_USER_PASS="super_strong_ldap_password"
7252
networks:
7353
caddy:
74-
name: caddy
54+
name: caddy

0 commit comments

Comments
 (0)