diff --git a/.gitignore b/.gitignore index a0b638f..c9464b2 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ -iot-www/ \ No newline at end of file +iot-www/ +volumes/ \ No newline at end of file diff --git a/config/authelia/configuration.yml b/config/authelia/configuration.yml new file mode 100644 index 0000000..57857a4 --- /dev/null +++ b/config/authelia/configuration.yml @@ -0,0 +1,916 @@ +# yamllint disable rule:comments-indentation +--- +############################################################################### +# Authelia Configuration # +############################################################################### + +## Note: the container by default expects to find this file at /config/configuration.yml. + +## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to +## the system certificates store. +## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem. +# certificates_directory: /config/certificates/ + +## The theme to display: light, dark, grey, auto. +theme: dark + +## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be +## set using a secret: https://www.authelia.com/c/secrets +jwt_secret: mydwxdd-c2hbo6zcmab1mzj232zx4 + +## Default redirection URL +## +## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end +## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use +## in such a case. +## +## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication. +default_redirection_url: https://auth.godopu.net/authenticated + +## Set the default 2FA method for new users and for when a user has a preferred method configured that has been +## disabled. This setting must be a method that is enabled. +## Options are totp, webauthn, mobile_push. +default_2fa_method: "" + +## +## Server Configuration +## +server: + + ## The address to listen on. + host: 0.0.0.0 + + ## The port to listen on. + port: 9091 + + ## Set the single level path Authelia listens on. + ## Must be alphanumeric chars and should not contain any slashes. + path: "" + + ## Set the path on disk to Authelia assets. + ## Useful to allow overriding of specific static assets. + # asset_path: /config/assets/ + + ## Buffers usually should be configured to be the same value. + ## Explanation at https://www.authelia.com/c/server#buffer-sizes + ## Read buffer size adjusts the server's max incoming request size in bytes. + ## Write buffer size does the same for outgoing responses. + read_buffer_size: 4096 + write_buffer_size: 4096 + + ## Enables the pprof endpoint. + enable_pprof: false + + ## Enables the expvars endpoint. + enable_expvars: false + + ## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0. + ## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist. + disable_healthcheck: false + + ## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour. + tls: + ## The path to the DER base64/PEM format private key. + key: "" + + ## The path to the DER base64/PEM format public certificate. + certificate: "" + + ## The list of certificates for client authentication. + client_certificates: [] + + ## Server headers configuration/customization. + headers: + + ## The CSP Template. Read the docs. + csp_template: "" + +## +## Log Configuration +## +log: + ## Level of verbosity for logs: info, debug, trace. + level: debug + + ## Format the logs are written as: json, text. + # format: json + + ## File path where the logs will be written. If not set logs are written to stdout. + # file_path: /config/authelia.log + + ## Whether to also log to stdout when a log_file_path is defined. + # keep_stdout: false + +## +## Telemetry Configuration +## +telemetry: + + ## + ## Metrics Configuration + ## + metrics: + ## Enable Metrics. + enabled: false + + ## The address to listen on for metrics. This should be on a different port to the main server.port value. + address: tcp://0.0.0.0:9959 + +## +## TOTP Configuration +## +## Parameters used for TOTP generation. +totp: + ## Disable TOTP. + disable: false + + ## The issuer name displayed in the Authenticator application of your choice. + issuer: godopu.net + + ## The TOTP algorithm to use. + ## It is CRITICAL you read the documentation before changing this option: + ## https://www.authelia.com/c/totp#algorithm + algorithm: sha1 + + ## The number of digits a user has to input. Must either be 6 or 8. + ## Changing this option only affects newly generated TOTP configurations. + ## It is CRITICAL you read the documentation before changing this option: + ## https://www.authelia.com/c/totp#digits + digits: 6 + + ## The period in seconds a one-time password is valid for. + ## Changing this option only affects newly generated TOTP configurations. + period: 30 + + ## The skew controls number of one-time passwords either side of the current one that are valid. + ## Warning: before changing skew read the docs link below. + skew: 1 + ## See: https://www.authelia.com/c/totp#input-validation to read + ## the documentation. + + ## The size of the generated shared secrets. Default is 32 and is sufficient in most use cases, minimum is 20. + secret_size: 32 + +## +## WebAuthn Configuration +## +## Parameters used for WebAuthn. +webauthn: + ## Disable Webauthn. + disable: false + + ## Adjust the interaction timeout for Webauthn dialogues. + timeout: 60s + + ## The display name the browser should show the user for when using Webauthn to login/register. + display_name: Authelia + + ## Conveyance preference controls if we collect the attestation statement including the AAGUID from the device. + ## Options are none, indirect, direct. + attestation_conveyance_preference: indirect + + ## User verification controls if the user must make a gesture or action to confirm they are present. + ## Options are required, preferred, discouraged. + user_verification: preferred + +## +## Duo Push API Configuration +## +## Parameters used to contact the Duo API. Those are generated when you protect an application of type +## "Partner Auth API" in the management panel. +duo_api: + disable: false + hostname: api-123456789.example.com + integration_key: ABCDEF + ## Secret can also be set using a secret: https://www.authelia.com/c/secrets + secret_key: 1234567890abcdefghifjkl + enable_self_enrollment: false + +## +## NTP Configuration +## +## This is used to validate the servers time is accurate enough to validate TOTP. +ntp: + ## NTP server address. + address: "time.cloudflare.com:123" + + ## NTP version. + version: 4 + + ## Maximum allowed time offset between the host and the NTP server. + max_desync: 3s + + ## Disables the NTP check on startup entirely. This means Authelia will not contact a remote service at all if you + ## set this to true, and can operate in a truly offline mode. + disable_startup_check: false + + ## The default of false will prevent startup only if we can contact the NTP server and the time is out of sync with + ## the NTP server more than the configured max_desync. If you set this to true, an error will be logged but startup + ## will continue regardless of results. + disable_failure: false + +## +## Authentication Backend Provider Configuration +## +## Used for verifying user passwords and retrieve information such as email address and groups users belong to. +## +## The available providers are: `file`, `ldap`. You must use only one of these providers. +authentication_backend: + + # ## Password Reset Options. + # password_reset: + # ## Disable both the HTML element and the API for reset password functionality. + # disable: false + + # ## External reset password url that redirects the user to an external reset portal. This disables the internal reset + # ## functionality. + # custom_url: "" + + # ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation. + # ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will + # ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP. + # ## To force update on every request you can set this to '0' or 'always', this will increase processor demand. + # ## See the below documentation for more information. + # ## Duration Notation docs: https://www.authelia.com/c/common#duration-notation-format + # ## Refresh Interval docs: https://www.authelia.com/c/1fa#refresh-interval + # refresh_interval: 5m + + # ## + # ## LDAP (Authentication Provider) + # ## + # ## This is the recommended Authentication Provider in production + # ## because it allows Authelia to offload the stateful operations + # ## onto the LDAP service. + # ldap: + # ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password. + # ## Acceptable options are as follows: + # ## - 'activedirectory' - For Microsoft Active Directory. + # ## - 'custom' - For custom specifications of attributes and filters. + # ## This currently defaults to 'custom' to maintain existing behaviour. + # ## + # ## Depending on the option here certain other values in this section have a default value, notably all of the + # ## attribute mappings have a default value that this config overrides, you can read more about these default values + # ## at https://www.authelia.com/c/ldap#defaults + # implementation: custom + + # ## The url to the ldap server. Format: ://
[:]. + # ## Scheme can be ldap or ldaps in the format (port optional). + # url: ldap://127.0.0.1 + + # ## The dial timeout for LDAP. + # timeout: 5s + + # ## Use StartTLS with the LDAP connection. + # start_tls: false + + # tls: + # ## Server Name for certificate validation (in case it's not set correctly in the URL). + # # server_name: ldap.example.com + + # ## Skip verifying the server certificate (to allow a self-signed certificate). + # ## In preference to setting this we strongly recommend you add the public portion of the certificate to the + # ## certificates directory which is defined by the `certificates_directory` option at the top of the config. + # skip_verify: false + + # ## Minimum TLS version for either Secure LDAP or LDAP StartTLS. + # minimum_version: TLS1.2 + + # ## The distinguished name of the container searched for objects in the directory information tree. + # ## See also: additional_users_dn, additional_groups_dn. + # base_dn: dc=example,dc=com + + # ## The attribute holding the username of the user. This attribute is used to populate the username in the session + # ## information. It was introduced due to #561 to handle case insensitive search queries. For you information, + # ## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this + # ## attribute holds the unique identifiers for the users binding the user and the configuration stored in database. + # ## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user + # ## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also + # ## be used but we don't recommend using them, we instead advise to use the attributes mentioned above + # ## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt. + # # username_attribute: uid + + # ## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users. + # ## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users. + # additional_users_dn: ou=users + + # ## The users filter used in search queries to find the user profile based on input filled in login form. + # ## Various placeholders are available in the user filter which you can read about in the documentation which can + # ## be found at: https://www.authelia.com/c/ldap#users-filter-replacements + # ## + # ## Recommended settings are as follows: + # ## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) + # ## - OpenLDAP: + # ## - (&({username_attribute}={input})(objectClass=person)) + # ## - (&({username_attribute}={input})(objectClass=inetOrgPerson)) + # ## + # ## To allow sign in both with username and email, one can use a filter like + # ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person)) + # users_filter: (&({username_attribute}={input})(objectClass=person)) + + # ## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups. + # ## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups. + # additional_groups_dn: ou=groups + + # ## The groups filter used in search queries to find the groups based on relevant authenticated user. + # ## Various placeholders are available in the groups filter which you can read about in the documentation which can + # ## be found at: https://www.authelia.com/c/ldap#groups-filter-replacements + # ## + # ## If your groups use the `groupOfUniqueNames` structure use this instead: + # ## (&(uniqueMember={dn})(objectClass=groupOfUniqueNames)) + # groups_filter: (&(member={dn})(objectClass=groupOfNames)) + + # ## The attribute holding the name of the group. + # # group_name_attribute: cn + + # ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the + # ## first one returned by the LDAP server is used. + # # mail_attribute: mail + + # ## The attribute holding the display name of the user. This will be used to greet an authenticated user. + # # display_name_attribute: displayName + + # ## Follow referrals returned by the server. + # ## This is especially useful for environments where read-only servers exist. Only implemented for write operations. + # permit_referrals: false + + # ## The username and password of the admin user. + # user: cn=admin,dc=example,dc=com + # ## Password can also be set using a secret: https://www.authelia.com/c/secrets + # password: password + + ## + ## File (Authentication Provider) + ## + ## With this backend, the users database is stored in a file which is updated when users reset their passwords. + ## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia + ## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security + ## implications it is highly recommended you leave the default values. Before considering changing these settings + ## please read the docs page below: + ## https://www.authelia.com/r/passwords#tuning + ## + ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness + ## + file: + path: /config/users_database.yml + password: + algorithm: argon2id + iterations: 1 + key_length: 32 + salt_length: 16 + memory: 1024 + parallelism: 8 + +## +## Password Policy Configuration. +## +password_policy: + + ## The standard policy allows you to tune individual settings manually. + standard: + enabled: false + + ## Require a minimum length for passwords. + min_length: 8 + + ## Require a maximum length for passwords. + max_length: 0 + + ## Require uppercase characters. + require_uppercase: true + + ## Require lowercase characters. + require_lowercase: true + + ## Require numeric characters. + require_number: true + + ## Require special characters. + require_special: true + + ## zxcvbn is a well known and used password strength algorithm. It does not have tunable settings. + zxcvbn: + enabled: false + + ## Configures the minimum score allowed. + min_score: 3 + +## +## Access Control Configuration +## +## Access control is a list of rules defining the authorizations applied for one resource to users or group of users. +## +## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed +## to anyone. Otherwise restrictions follow the rules defined. +## +## Note: One can use the wildcard * to match any subdomain. +## It must stand at the beginning of the pattern. (example: *.mydomain.com) +## +## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct. +## +## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'. +## +## - 'domain' defines which domain or set of domains the rule applies to. +## +## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not +## provided. If provided, the parameter represents either a user or a group. It should be of the form +## 'user:' or 'group:'. +## +## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'. +## +## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter +## is optional and matches any resource if not provided. +## +## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies. +access_control: + ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any + ## resource if there is no policy to be applied to the user. + default_policy: deny + + networks: + - name: internal + networks: + - 10.10.0.0/16 + - 192.168.2.0/24 + - name: VPN + networks: 10.9.0.0/16 + + rules: + ## Rules applied to everyone + - domain: 'auth.godopu.net' + policy: bypass + + ## Domain Regex examples. Generally we recommend just using a standard domain. + # - domain_regex: '^(?P\w+)\.example\.com$' + # policy: one_factor + # - domain_regex: '^(?P\w+)\.example\.com$' + # policy: one_factor + # - domain_regex: + # - '^appgroup-.*\.example\.com$' + # - '^appgroup2-.*\.example\.com$' + # policy: one_factor + # - domain_regex: '^.*\.example\.com$' + # policy: two_factor + + - domain: 'iot.knu.ac.kr' + policy: one_factor + - domain: 'protocol.knu.ac.kr' + policy: one_factor + ## Network based rule, if not provided any network matches. + # networks: + # - internal + # - VPN + # - 192.168.1.0/24 + # - 10.0.0.1 + + # - domain: + # - 'auth.godopu.com' + # - 'auth.godopu.com' + # policy: two_factor + + # - domain: 'singlefactor.example.com' + # policy: one_factor + + # ## Rules applied to 'admins' group + # - domain: 'mx2.mail.example.com' + # subject: 'group:admins' + # policy: deny + + # - domain: '*.example.com' + # subject: + # - 'group:admins' + # - 'group:moderators' + # policy: two_factor + + # ## Rules applied to 'dev' group + # - domain: 'dev.example.com' + # resources: + # - '^/groups/dev/.*$' + # subject: 'group:dev' + # policy: two_factor + + # ## Rules applied to user 'john' + # - domain: 'dev.example.com' + # resources: + # - '^/users/john/.*$' + # subject: 'user:john' + # policy: two_factor + + # ## Rules applied to user 'harry' + # - domain: 'dev.example.com' + # resources: + # - '^/users/harry/.*$' + # subject: 'user:harry' + # policy: two_factor + + # ## Rules applied to user 'bob' + # - domain: '*.mail.example.com' + # subject: 'user:bob' + # policy: two_factor + # - domain: 'dev.example.com' + # resources: + # - '^/users/bob/.*$' + # subject: 'user:bob' + # policy: two_factor + +## +## Session Provider Configuration +## +## The session cookies identify the user once logged in. +## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined. +session: + ## The name of the session cookie. + name: authelia_session + + ## The domain to protect. + ## Note: the authenticator must also be in that domain. + ## If empty, the cookie is restricted to the subdomain of the issuer. + domain: godopu.net + + ## Sets the Cookie SameSite value. Possible options are none, lax, or strict. + ## Please read https://www.authelia.com/c/session#same_site + same_site: lax + + ## The secret to encrypt the session data. This is only used with Redis / Redis Sentinel. + ## Secret can also be set using a secret: https://www.authelia.com/c/secrets + secret: insecure_session_secret + + ## The value for expiration, inactivity, and remember_me_duration are in seconds or the duration notation format. + ## See: https://www.authelia.com/c/common#duration-notation-format + ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure + ## because a stolen cookie will last longer giving attackers more time to spy or attack. + + ## The time before the cookie expires and the session is destroyed if remember me IS NOT selected. + expiration: 1h + + ## The inactivity time before the session is reset. If expiration is set to 1h, and this is set to 5m, if the user + ## does not select the remember me option their session will get destroyed after 1h, or after 5m since the last time + ## Authelia detected user activity. + inactivity: 5m + + ## The time before the cookie expires and the session is destroyed if remember me IS selected. + ## Value of -1 disables remember me. + remember_me_duration: 1M + + ## + ## Redis Provider + ## + ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness + ## + # redis: + # host: outline-redis + # port: 6379 + # ## Use a unix socket instead + # # host: /var/run/redis/redis.sock + + # ## Username used for redis authentication. This is optional and a new feature in redis 6.0. + # # username: authelia + + # ## Password can also be set using a secret: https://www.authelia.com/c/secrets + # password: authelia + + # ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc). + # database_index: 0 + + # ## The maximum number of concurrent active connections to Redis. + # maximum_active_connections: 8 + + # ## The target number of idle connections to have open ready for work. Useful when opening connections is slow. + # minimum_idle_connections: 0 + + ## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s). + # tls: + ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option). + # server_name: myredis.example.com + + ## Skip verifying the server certificate (to allow a self-signed certificate). + ## In preference to setting this we strongly recommend you add the public portion of the certificate to the + ## certificates directory which is defined by the `certificates_directory` option at the top of the config. + # skip_verify: false + + ## Minimum TLS version for the connection. + # minimum_version: TLS1.2 + + ## The Redis HA configuration options. + ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name). + # high_availability: + ## Sentinel Name / Master Name. + # sentinel_name: mysentinel + + ## Specific username for Redis Sentinel. The node username and password is configured above. + # sentinel_username: sentinel_specific_user + + ## Specific password for Redis Sentinel. The node username and password is configured above. + # sentinel_password: sentinel_specific_pass + + ## The additional nodes to pre-seed the redis provider with (for sentinel). + ## If the host in the above section is defined, it will be combined with this list to connect to sentinel. + ## For high availability to be used you must have either defined; the host above or at least one node below. + # nodes: + # - host: sentinel-node1 + # port: 6379 + # - host: sentinel-node2 + # port: 6379 + + ## Choose the host with the lowest latency. + # route_by_latency: false + + ## Choose the host randomly. + # route_randomly: false + +## +## Regulation Configuration +## +## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are made +## in a short period of time. +regulation: + ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation. + max_retries: 3 + + ## The time range during which the user can attempt login before being banned. The user is banned if the + ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation. + ## See: https://www.authelia.com/c/common#duration-notation-format + find_time: 2m + + ## The length of time before a banned user can login again. Ban Time accepts duration notation. + ## See: https://www.authelia.com/c/common#duration-notation-format + ban_time: 5m + +## +## Storage Provider Configuration +## +## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers. +storage: + ## The encryption key that is used to encrypt sensitive information in the database. Must be a string with a minimum + ## length of 20. Please see the docs if you configure this with an undesirable key and need to change it. + encryption_key: mydwxdd-c2hbo6zcmab1mzj232zx4 + + ## + ## Local (Storage Provider) + ## + ## This stores the data in a SQLite3 Database. + ## This is only recommended for lightweight non-stateful installations. + ## + ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness + ## + local: + path: /config/db.sqlite3 + + ## + ## MySQL / MariaDB (Storage Provider) + ## + # mysql: + # host: 127.0.0.1 + # port: 3306 + # database: authelia + # username: authelia + # ## Password can also be set using a secret: https://www.authelia.com/c/secrets + # password: mypassword + # timeout: 5s + + ## + ## PostgreSQL (Storage Provider) + ## + # postgres: + # host: 127.0.0.1 + # port: 5432 + # database: authelia + # schema: public + # username: authelia + # ## Password can also be set using a secret: https://www.authelia.com/c/secrets + # password: mypassword + # timeout: 5s + # ssl: + # mode: disable + # root_certificate: disable + # certificate: disable + # key: disable + +## +## Notification Provider +## +## Notifications are sent to users when they require a password reset, a Webauthn registration or a TOTP registration. +## The available providers are: filesystem, smtp. You must use only one of these providers. +notifier: + ## You can disable the notifier startup check by setting this to true. + disable_startup_check: false + + ## + ## File System (Notification Provider) + ## + ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness + ## + # filesystem: + # filename: /config/notification.txt + + ## + ## SMTP (Notification Provider) + ## + ## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate. + ## [Security] By default Authelia will: + ## - force all SMTP connections over TLS including unauthenticated connections + ## - use the disable_require_tls boolean value to disable this requirement + ## (only works for unauthenticated connections) + ## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates + ## (configure in tls section) + smtp: + username: godopu16@gmail.com #your email address + password: cdjdagxrmywcbaqf #your email password + host: smtp.gmail.com #email smtp server + port: 587 #email smtp port + sender: godopu16@gmail.com + identifier: localhost + subject: "[Authelia] {title}" #email subject + startup_check_address: godopu16@gmail.com + disable_require_tls: false + disable_html_emails: false +## +## Identity Providers +## +identity_providers: + + ## + ## OpenID Connect (Identity Provider) + ## + ## It's recommended you read the documentation before configuration of this section: + ## https://www.authelia.com/c/oidc + oidc: + # The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens). + # HMAC Secret can also be set using a secret: https://www.authelia.com/c/secrets + hmac_secret: mydwxdd-c2hbo6zcmab1mzj232zx4 + + # The issuer_private_key is used to sign the JWT forged by OpenID Connect. + # Issuer Private Key can also be set using a secret: https://www.authelia.com/c/secrets + issuer_private_key: | + -----BEGIN RSA PRIVATE KEY----- + MIIJKAIBAAKCAgEA6O7deUistjW6/6AuZNk/bA6AsL4/s2VTfm1PQv3juAnnvU8K + hd8xb/nXV1B7AjsxGzP06BiJa0VzyM7pi0l3Y2bxxJPSNWojg5HNzsZ24BebzAH8 + oCHo/NU1OWw5eJNDIT/kuFJ0vImR6ransev56MZ2Ton2WrTF9jfBQQrQT6RoE1y6 + okrHI+lVNkAwilDAALXhvdpeWuQ2vLem973ZHlSsHHUazEfjAkbT96r74vhmd6rQ + wJEAKnGYwsKUvxX8UschUnlr8t3tDEZuDEW2+fZ1P4QTwK5Y5WY4QCUFVBaY+MDo + sXDzCe/Wsw1yX0A3KpJq6+wI+r6/DMQUFcZoMQvU6IFfNk/l5ATAOmt/VZVeX3XW + QbdbkDwGE1su+VMM7efQw0kIXqcWWYJ48tcMxAPGnXtZ6i6smlbFtSW1rVB5WOnc + mv8ER5C0lqswp7yC0W9hBSM5xphlgS6909RzhIBPJavcorN18BukrN0+EA37NW3a + p+oNHSQHOMbAXrChYdUSwma/gcUfXy+WtU147N2PzPZTSe7CXiSIodNPbC62IGqu + BkTrVNpROncvnH55sZ8qhZVPP70qylIvXFEDjpCwWmObsPehGMMJN8DW3xDd7WrI + eXlNGsAQHs7Dihp1opUeBF0n1gS6dNweFI1aG3+gVtpPiHQumC69bdO52KcCAwEA + AQKCAgEAnj23w681dctmsEY3fleAGH55uphkWhEZ+ad000P7sYk5H4hU08Feqn2G + Z1DLYCaqI5rWY95XbMKP9/lo+zD7pFHJKQxrH9JtMfKZaEG3fGFNe/hVkMu4phqJ + v+rf2CPi1PG9BeMuXu7ubA+OOPbgndxFfvGGpPRuD+ispu0bux8rfQvf1mUKiED5 + nJNa5nwZE+J76ygwNXsYHHh/O4qDt3E6Q1Li06h6dY98bKKB4B10LxOiIU/gVvU5 + HAZoWrAq7GlPH+JRDXrqkQ4/sKKjvYhK+s1VRe6rgZxB1oHP7uIzJbqX2gOreDKx + Ho6iBkdvssIpVQDS0NVIoPmL04coO+1171p94lI0BjgU/+9kr3rSpSDqJETuyUwL + m4dnfuEE2CHU0tOeb7i/Mw55rJ2YtfXddWH7u0hp5AHLWqoEFBKjhYwzvim40Ghd + Acr2z52X9WkoNU2kuBIHF+MnZ/4E1w2jIhsrxi5R8fVa3C8OKVTYIjA5Cj8IWe18 + c+pQrwGSNMaKJyOZFNAF9J22hXgY3BJNOyVX2JGA4+HYfAMxiaEPnZqQlkAsDoSb + LcdVSQ/bJH2dXJg2kosa5okwI//GPo8Kj1GyPUlu/3C7IoehHEnGsfbgzjg5yhs8 + htyZObzeNqf6mf7AjTVtnDneUKYurI8inoJgePc0aKBOc0ZzPTECggEBAOlRWUWz + ZvLdZNJmo4fvzZp91wDsI5gnG0GKaWMxqDpcasv8midRdEcZ9y4r489vF7xNVpeM + dHUnmyeiq3GR+beFDAZTXmt1VxY87kdbmXMzc/jxxrmY76NQRIVoe372sromCS/7 + mTF1fpsASFHXbcHEe0RE8jcrCFFiSsHWrHeux9iiVHlF3d+MLua/pYuCM9wu6uq0 + /VQXK1RLcTQn5O6nUtwhVWuCaHfyTjEXsr9nZ85lNFlb0qOSscZErlNmPreFyoPd + FphLx14GdjfYGnf3Nz6q0KXqVk2FUJ2cZ+0u5yfjbVFD5eZbs/fHFtA+1MZjoRFf + K486uJFI0yCOBvMCggEBAP+T8TXGq0+EzwdSWxk3Pb0/i7a1t5gEYsrSd8b1nDYH + BP8ekqzv2wEVSFdg+GbuZL8NqjTb9Dkds7Y94zqAGl5FwNge5/l3E4X+Y9yue1Cd + a704BLrURN6SJlPBQ+zDr/YmE6Zz1mbNvRKVReLeDv1CIRLDCjA3q3kOvnxNPlYO + +zmo07ElLq7gedn8VmjiJfjZeXYxq9+UVxR6Pm9aDeZFTBzQa7URfESB2JU9x7Mz + zBImE5jUQcsHn9Ha/KaU5FzPoUWdDVPdv4T9IBJaOjam0ck/G0FwqzvSZ0i9HRrX + mXpO/bXGlyHchMvadJZvqJPd+cc+JvYmDHXvfrcivH0CggEAMJLrDwPGjxFgiB0u + NoLKPzuro1mGH4sktYRnZGtWJrBO26D/RuhCWPsi5s3kY68xNda0DGEFbc6NErdf + Egnd/0MHudlpct2+/7Y3tUtwqvcvUcikIsegPFPdsBiMfWZG11JL3112C0H21bY9 + WCyNgSWytAfWlX20AZ2BCtHynggZOxSwmX7eLkg1C30ireSxf0mVRr/fbb5VGvuJ + 2d3kX3seWQ3nhrZjoXUkqjvQzuBsUB/pwiDHvZ4wvKJX2K0UqYiFHObOaW59Vynp + Or8W45roOXe+cIxU41a57dY+HLcDEN7cR2rnVgoJcbBVI42xJoxfYAp8Oxlyi2yp + 58Ep2QKCAQAXxtqs5xOu7SsZgkbpXKNIxO2pjNRMtzO9rMDp6JWkzRhg56Y7ooDc + Y+97+ZCCevEyeQH5svDQk3vRm4ZVPe+2D4U2VgG8yqAtWhJOSIk+YbbRPrHp86+I + iU45goRgNYBcRQSU+rfajo9leC+tQH1igFF1XmHHRJaWR5HfHIyNEw26OoOfOldS + e526cuhTD576vLi5DzvvK+zCAfFnCJi8cHv5PkaW7M6DzRSqJbo7aLk2gwZVtIF+ + cvIiYt4YXUe1freBM3A2+i1EIQxnyK8bwH9J2q4dc27qvNNRCA76HU6w+0JNM/GB + e/N6x5MLH84uG3uOVrDnO3jzS9mdDgU9AoIBAAHACoyvwR7nAN3ZdyzMzsfcqZno + tCtHpaxm3k/rz81b7rLdCh6+rO44QmQxl/fEQwrx2lhCCzNC5JRXXdWjlY7pul6Z + Rse3kpuHMiprQhZcbPTW11JrQrz/UOsCy6x9axEjL3PRAfc9HK9byz00CwTNLlx8 + 0QKaVqk61VcUGcaOPCgQmnvSt9EQQwWhCaozF67GXBSooaA7RtrUeKIENDSrYZbc + BrHj8cxynIM56zJJ9YE3eyY4gsa2T6ChtRcY6edvzmwaKFz4PEtkZSHm6uc1Mu83 + Z5H4liEDpxHfvUuYjRIdvILtb4M2rgpQGkt+TDrvv1150DexQWS7UMDv2Fo= + -----END RSA PRIVATE KEY----- + + # The lifespans configure the expiration for these token types. + access_token_lifespan: 1h + authorize_code_lifespan: 1m + id_token_lifespan: 1h + refresh_token_lifespan: 90m + + # Enables additional debug messages. + enable_client_debug_messages: false + clients: + - id: iot-ws + description: iot server + secret: mydwxdd-c2hbo6zcmab1mzj232zx4 + public: false + authorization_policy: one_factor + audience: [] + scopes: + - openid + - groups + - email + - profile + redirect_uris: + - https://iot.knu.ac.kr/auth/oidc.callback + grant_types: + - refresh_token + - authorization_code + response_types: + - code + response_modes: + - form_post + - query + - fragment + userinfo_signing_algorithm: none + # SECURITY NOTICE: It's not recommended changing this option and values below 8 are strongly discouraged. + minimum_parameter_entropy: 8 + + # SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it set to 'never' + # for security reasons. + enforce_pkce: public_clients_only + + ## Cross-Origin Resource Sharing (CORS) settings. + # cors: + ## List of endpoints in addition to the metadata endpoints to permit cross-origin requests on. + # endpoints: + # - authorization + # - token + # - revocation + # - introspection + # - userinfo + + ## List of allowed origins. + ## Any origin with https is permitted unless this option is configured or the + ## allowed_origins_from_client_redirect_uris option is enabled. + # allowed_origins: + # - https://example.com + + ## Automatically adds the origin portion of all redirect URI's on all clients to the list of allowed_origins, + ## provided they have the scheme http or https and do not have the hostname of localhost. + # allowed_origins_from_client_redirect_uris: false + + ## Clients is a list of known clients and their configuration. + # clients: + # - + ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration. + # id: myapp + + ## The description to show to users when they end up on the consent screen. Defaults to the ID above. + # description: My Application + + ## The client secret is a shared secret between Authelia and the consumer of this client. + # secret: this_is_a_secret + + ## Sector Identifiers are occasionally used to generate pairwise subject identifiers. In most cases this is not + ## necessary. Read the documentation for more information. + ## The subject identifier must be the host component of a URL, which is a domain name with an optional port. + # sector_identifier: example.com + + ## Sets the client to public. This should typically not be set, please see the documentation for usage. + # public: false + + ## The policy to require for this client; one_factor or two_factor. + # authorization_policy: two_factor + + ## By default users cannot remember pre-configured consents. Setting this value to a period of time using a + ## duration notation will enable users to remember consent for this client. The time configured is the amount + ## of time the pre-configured consent is valid for granting new authorizations to the user. + # pre_configured_consent_duration: + + ## Audience this client is allowed to request. + # audience: [] + + ## Scopes this client is allowed to request. + # scopes: + # - openid + # - groups + # - email + # - profile + + ## Redirect URI's specifies a list of valid case-sensitive callbacks for this client. + # redirect_uris: + # - https://oidc.example.com:8080/oauth2/callback + + ## Grant Types configures which grants this client can obtain. + ## It's not recommended to define this unless you know what you're doing. + # grant_types: + # - refresh_token + # - authorization_code + + ## Response Types configures which responses this client can be sent. + ## It's not recommended to define this unless you know what you're doing. + # response_types: + # - code + + ## Response Modes configures which response modes this client supports. + # response_modes: + # - form_post + # - query + # - fragment + + ## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256. + # userinfo_signing_algorithm: none +... diff --git a/config/authelia/db.sqlite3 b/config/authelia/db.sqlite3 new file mode 100644 index 0000000..4ae7817 Binary files /dev/null and b/config/authelia/db.sqlite3 differ diff --git a/config/authelia/users_database.yml b/config/authelia/users_database.yml new file mode 100644 index 0000000..1c4b0eb --- /dev/null +++ b/config/authelia/users_database.yml @@ -0,0 +1,36 @@ +# yamllint disable rule:line-length +--- +############################################################### +# Users Database # +############################################################### + +# This file can be used if you do not have an LDAP set up. + + +users: + godopu16@godopu.net: + displayname: "Godopu" + password: "$argon2id$v=19$m=1024,t=1,p=8$YkdjeHNkdERqNzNTWHN1aw$ve9otTk53kLiBjCeWD5u9YJxU4EtoGKxNB7BTlEcRC4" # Password is 'Rhehvn16^^', salt is bGcxsdtDj73SXsuk + email: godopu16@godopu.net + groups: + - admins + - dev + + sjkoh: + displayname: "sjkoh" + password: "$argon2id$v=19$m=65536,t=3,p=4$VFx84S5QYd1J8WbI8NvdFw$BxFMZ/Vatqq8qdwtCTiR8qRLH8QgErMd9loNYgnBjSg" + email: sjkoh12@gmail.com + groups: + - admins + - dev + +... + + # supergint: + # displayname: "Dongle" + # password: "$argon2id$v=19$m=1024,t=1,p=8$c2NpM0RCcWM0UVVvSXNuaw$03SJ3Lk+WhvEzcJb7UpuuqKStqUw65pGuUj3cY9cVKg" # Password is 'Rhehvn16^^', salt is bGcxsdtDj73SXsuk + # email: supergint@gmail.com + # groups: + # - admins + # - dev +# yamllint enable rule:line-length diff --git a/config/traefik/router.yaml b/config/traefik/router.yaml new file mode 100644 index 0000000..40462d3 --- /dev/null +++ b/config/traefik/router.yaml @@ -0,0 +1,71 @@ +http: + routers: + to-traefik: + rule: Host(`traefik.godopu.net`) + service: traefik + entrypoints: http + middlewares: https-redirect + to-traefik-secure: + rule: Host(`traefik.godopu.net`) + service: traefik + entrypoints: https + tls: + certresolver: https-resolver + + to-iot-ws: + rule: Host(`iot.knu.ac.kr`) + service: iot-ws + entrypoints: http + middlewares: https-redirect + to-iot-ws-secure: + rule: Host(`iot.knu.ac.kr`) + service: iot-ws + entrypoints: https + tls: + certresolver: https-resolver + + to-protoecol-ws: + rule: Host(`protocol.knu.ac.kr`) + service: iot-ws + entrypoints: http + middlewares: https-redirect + to-protoecol-ws-secure: + rule: Host(`protocol.knu.ac.kr`) + service: iot-ws + entrypoints: https + tls: + certresolver: https-resolver + + to-authelia: + rule: Host(`auth.godopu.net`) + service: authelia + entrypoints: http + middlewares: https-redirect + to-authelia-secure: + rule: Host(`auth.godopu.net`) + service: authelia + entrypoints: https + tls: + certresolver: https-resolver + + middlewares: + https-redirect: + redirectscheme: + scheme: https + permanent: true + + services: + traefik: + loadBalancer: + servers: + - url: http://traefik:8080 + + iot-ws: + loadBalancer: + servers: + - url: http://iot-web-server:4000 + + authelia: + loadBalancer: + servers: + - url: http://authelia-app:9091 \ No newline at end of file diff --git a/config/traefik/traefik.yaml b/config/traefik/traefik.yaml new file mode 100644 index 0000000..4eb00ff --- /dev/null +++ b/config/traefik/traefik.yaml @@ -0,0 +1,65 @@ +experimental: + http3: true + +global: + checkNewVersion: true + sendAnonymousUsage: true + +certificatesResolvers: + https-resolver: + acme: + httpchallenge: + entrypoint: http + email: godopu16@gmail.com + storage: /letsencrypt/acme.json + +################################################################ +# Traefik logs configuration +################################################################ + +log: + level: DEBUG + +################################################################ +# Access logs configuration +################################################################ + +accessLog: + filePath: /traefik.log + bufferingSize: 100 + filters: + statusCodes: ["400-499"] + +################################################################ +# API and dashboard configuration +################################################################ + +api: + insecure: true + +################################################################ +# EntryPoints configuration +################################################################ + + +entryPoints: + http: + address: :80 + https: + address: :443 + +################################################################ +# Docker configuration backend +################################################################ +serversTransport: + insecureSkipVerify: true + +providers: + file: + directory: /etc/traefik/dynamic/conf + +# docker: +# exposedbydefault: false +# file: +# directory: /rules +# watch: true \ No newline at end of file diff --git a/docker-compose.yaml b/docker-compose.yaml index 8e5b384..994e76c 100644 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -1,29 +1,66 @@ version: '3' services: + traefik: + image: "docker.io/traefik:latest" + container_name: "traefik" + hostname: traefik + networks: + - lab-net + restart: always + expose: + - "80" + - "443" + - "8080" + command: + - "--configFile=/etc/traefik/dynamic/traefik.yaml" + ports: + - 80:80 + - 443:443 + - 8080:8080 + volumes: + - "./config/traefik/traefik.yaml:/etc/traefik/dynamic/traefik.yaml" + - "./config/traefik/router.yaml:/etc/traefik/dynamic/conf/router.yaml" + - "./volumes/traefik/letsencrypt:/letsencrypt" + - "./volumes/traefik/cert/:/certs/" + labels: + - "traefik.enable=true" + iot-web-server: + hostname: iot-web-server build: ./webserver image: iot-web-server/v0.1 networks: - lab-net - ports: - - 8080:8080 container_name: iot-web-server restart: always - hostname: iot-web-server volumes: - - "./iot-www:/home/www" + - "/home/sjkoh/www:/home/www" + openvscode-server: image: gitpod/openvscode-server:latest container_name: "openvscode-server" - ports: - - 3000:3000 + hostname: openvscode-server + networks: + - lab-net volumes: - - "./iot-www:/home/workspace" + - "/home/sjkoh/www:/home/workspace" entrypoint: - "/home/.openvscode-server/bin/openvscode-server" - "--host=0.0.0.0" - "--without-connection-token" # - "--connection-token=6b97db13-f2e3-41bb-a3a5-a18fdd1369e5" + authelia-app: + image: authelia/authelia:latest + container_name: authelia-app + hostname: authelia-app + networks: + - lab-net + restart: unless-stopped + ports: + - 9091:9091 + volumes: + - ./config/authelia:/config + networks: lab-net: null diff --git a/webserver/router/auth.go b/webserver/router/auth.go index 121083f..47feae7 100644 --- a/webserver/router/auth.go +++ b/webserver/router/auth.go @@ -17,7 +17,7 @@ import ( var ( // clientID = os.Getenv("GOOGLE_OAUTH2_CLIENT_ID") // clientSecret = os.Getenv("GOOGLE_OAUTH2_CLIENT_SECRET") - clientID = "godopu-dev" + clientID = "iot-ws" clientSecret = "mydwxdd-c2hbo6zcmab1mzj232zx4" ) var config oauth2.Config @@ -25,7 +25,7 @@ var provider *oidc.Provider func init() { var err error - provider, err = oidc.NewProvider(context.Background(), "https://auth.godopu.com") + provider, err = oidc.NewProvider(context.Background(), "https://auth.godopu.net") if err != nil { log.Fatal(err) } @@ -33,7 +33,7 @@ func init() { ClientID: clientID, ClientSecret: clientSecret, Endpoint: provider.Endpoint(), - RedirectURL: "http://localhost:4000/auth/oidc.callback", + RedirectURL: "https://iot.knu.ac.kr/auth/oidc.callback", Scopes: []string{oidc.ScopeOpenID, "profile", "email"}, } } @@ -97,14 +97,13 @@ func authCallback(ctx *gin.Context) { c := &http.Cookie{ Name: "__edit_access_token_", - Value: "value", + Value: "temporary-token", MaxAge: int(time.Hour.Seconds()), Secure: ctx.Request.TLS != nil, HttpOnly: true, Path: "/", } - ctx.Set("__edit_access_token_", "^^") http.SetCookie(ctx.Writer, c) ctx.Redirect(http.StatusFound, "/edit") } diff --git a/webserver/router/reverse_proxy.go b/webserver/router/reverse_proxy.go index d5f0464..c4f8cc7 100644 --- a/webserver/router/reverse_proxy.go +++ b/webserver/router/reverse_proxy.go @@ -13,7 +13,7 @@ func reverseProxyHandle(c *gin.Context) { path := c.Param("any") - remote, err := url.Parse("http://localhost:3000") + remote, err := url.Parse("http://openvscode-server:3000") if err != nil { panic(err) } diff --git a/webserver/router/route.go b/webserver/router/route.go index 1383ac7..8cf34c9 100644 --- a/webserver/router/route.go +++ b/webserver/router/route.go @@ -11,7 +11,7 @@ import ( func NewRouter() *gin.Engine { assetEngine := gin.New() - assetEngine.Static("/home", "../iot-www") + assetEngine.Static("/home", "./www") r := gin.New()