Prepare isolated VPS UAT deployment bundle

2026-08-20 19:22:03 +03:00
parent bd053b073c
commit 52922b8e7f
14 changed files with 379 additions and 17 deletions
@@ -0,0 +1,64 @@
+server:
+  address: tcp4://0.0.0.0:9091
+  endpoints:
+    authz:
+      auth-request:
+        implementation: AuthRequest
+
+log:
+  level: info
+  format: text
+
+identity_validation:
+  reset_password:
+    disable: true
+
+authentication_backend:
+  password_reset:
+    disable: true
+  refresh_interval: 5m
+  file:
+    path: /config/users_database.yml
+    watch: true
+    password:
+      algorithm: argon2
+      argon2:
+        variant: argon2id
+        iterations: 3
+        memory: 65536
+        parallelism: 4
+        key_length: 32
+        salt_length: 16
+
+access_control:
+  default_policy: deny
+  rules:
+    - domain: laikapstak.li
+      policy: one_factor
+
+session:
+  name: weathertool_session
+  cookies:
+    - domain: laikapstak.li
+      authelia_url: https://auth.laikapstak.li
+      default_redirection_url: https://laikapstak.li
+      same_site: lax
+      inactivity: 1h
+      expiration: 12h
+      remember_me: -1
+
+regulation:
+  modes:
+    - ip
+  max_retries: 3
+  find_time: 2m
+  ban_time: 15m
+
+storage:
+  local:
+    path: /var/lib/authelia/db.sqlite3
+
+notifier:
+  disable_startup_check: false
+  filesystem:
+    filename: /var/lib/authelia/notification.txt
@@ -0,0 +1,11 @@
+# Generate the password hash on the VPS; never place a plaintext password here.
+# Then copy this file to users_database.yml, replace the placeholders, and set
+# mode 0640. The real users_database.yml is excluded from Git.
+users:
+  newsroom:
+    disabled: false
+    displayname: Newsroom tester
+    password: REPLACE_WITH_ARGON2ID_HASH
+    email: newsroom@invalid.local
+    groups:
+      - testers