lab/homepage
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

deploy version 0.1

Browse Source
This commit is contained in:
Godopu 2022-12-26 04:36:19 +00:00
parent e4171d7a91
commit 24de27a714
10 changed files with 1140 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -1 +1,2 @@
iot-www/
volumes/

916
config/authelia/configuration.yml Normal file
View File

@ -0,0 +1,916 @@
# yamllint disable rule:comments-indentation
---
###############################################################################
# Authelia Configuration #
###############################################################################
## Note: the container by default expects to find this file at /config/configuration.yml.
## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to
## the system certificates store.
## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem.
# certificates_directory: /config/certificates/
## The theme to display: light, dark, grey, auto.
theme: dark
## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be
## set using a secret: https://www.authelia.com/c/secrets
jwt_secret: mydwxdd-c2hbo6zcmab1mzj232zx4
## Default redirection URL
##
## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end
## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use
## in such a case.
##
## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
default_redirection_url: https://auth.godopu.net/authenticated
## Set the default 2FA method for new users and for when a user has a preferred method configured that has been
## disabled. This setting must be a method that is enabled.
## Options are totp, webauthn, mobile_push.
default_2fa_method: ""
##
## Server Configuration
##
server:
## The address to listen on.
host: 0.0.0.0
## The port to listen on.
port: 9091
## Set the single level path Authelia listens on.
## Must be alphanumeric chars and should not contain any slashes.
path: ""
## Set the path on disk to Authelia assets.
## Useful to allow overriding of specific static assets.
# asset_path: /config/assets/
## Buffers usually should be configured to be the same value.
## Explanation at https://www.authelia.com/c/server#buffer-sizes
## Read buffer size adjusts the server's max incoming request size in bytes.
## Write buffer size does the same for outgoing responses.
read_buffer_size: 4096
write_buffer_size: 4096
## Enables the pprof endpoint.
enable_pprof: false
## Enables the expvars endpoint.
enable_expvars: false
## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0.
## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist.
disable_healthcheck: false
## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour.
tls:
## The path to the DER base64/PEM format private key.
key: ""
## The path to the DER base64/PEM format public certificate.
certificate: ""
## The list of certificates for client authentication.
client_certificates: []
## Server headers configuration/customization.
headers:
## The CSP Template. Read the docs.
csp_template: ""
##
## Log Configuration
##
log:
## Level of verbosity for logs: info, debug, trace.
level: debug
## Format the logs are written as: json, text.
# format: json
## File path where the logs will be written. If not set logs are written to stdout.
# file_path: /config/authelia.log
## Whether to also log to stdout when a log_file_path is defined.
# keep_stdout: false
##
## Telemetry Configuration
##
telemetry:
##
## Metrics Configuration
##
metrics:
## Enable Metrics.
enabled: false
## The address to listen on for metrics. This should be on a different port to the main server.port value.
address: tcp://0.0.0.0:9959
##
## TOTP Configuration
##
## Parameters used for TOTP generation.
totp:
## Disable TOTP.
disable: false
## The issuer name displayed in the Authenticator application of your choice.
issuer: godopu.net
## The TOTP algorithm to use.
## It is CRITICAL you read the documentation before changing this option:
## https://www.authelia.com/c/totp#algorithm
algorithm: sha1
## The number of digits a user has to input. Must either be 6 or 8.
## Changing this option only affects newly generated TOTP configurations.
## It is CRITICAL you read the documentation before changing this option:
## https://www.authelia.com/c/totp#digits
digits: 6
## The period in seconds a one-time password is valid for.
## Changing this option only affects newly generated TOTP configurations.
period: 30
## The skew controls number of one-time passwords either side of the current one that are valid.
## Warning: before changing skew read the docs link below.
skew: 1
## See: https://www.authelia.com/c/totp#input-validation to read
## the documentation.
## The size of the generated shared secrets. Default is 32 and is sufficient in most use cases, minimum is 20.
secret_size: 32
##
## WebAuthn Configuration
##
## Parameters used for WebAuthn.
webauthn:
## Disable Webauthn.
disable: false
## Adjust the interaction timeout for Webauthn dialogues.
timeout: 60s
## The display name the browser should show the user for when using Webauthn to login/register.
display_name: Authelia
## Conveyance preference controls if we collect the attestation statement including the AAGUID from the device.
## Options are none, indirect, direct.
attestation_conveyance_preference: indirect
## User verification controls if the user must make a gesture or action to confirm they are present.
## Options are required, preferred, discouraged.
user_verification: preferred
##
## Duo Push API Configuration
##
## Parameters used to contact the Duo API. Those are generated when you protect an application of type
## "Partner Auth API" in the management panel.
duo_api:
disable: false
hostname: api-123456789.example.com
integration_key: ABCDEF
## Secret can also be set using a secret: https://www.authelia.com/c/secrets
secret_key: 1234567890abcdefghifjkl
enable_self_enrollment: false
##
## NTP Configuration
##
## This is used to validate the servers time is accurate enough to validate TOTP.
ntp:
## NTP server address.
address: "time.cloudflare.com:123"
## NTP version.
version: 4
## Maximum allowed time offset between the host and the NTP server.
max_desync: 3s
## Disables the NTP check on startup entirely. This means Authelia will not contact a remote service at all if you
## set this to true, and can operate in a truly offline mode.
disable_startup_check: false
## The default of false will prevent startup only if we can contact the NTP server and the time is out of sync with
## the NTP server more than the configured max_desync. If you set this to true, an error will be logged but startup
## will continue regardless of results.
disable_failure: false
##
## Authentication Backend Provider Configuration
##
## Used for verifying user passwords and retrieve information such as email address and groups users belong to.
##
## The available providers are: `file`, `ldap`. You must use only one of these providers.
authentication_backend:
# ## Password Reset Options.
# password_reset:
# ## Disable both the HTML element and the API for reset password functionality.
# disable: false
# ## External reset password url that redirects the user to an external reset portal. This disables the internal reset
# ## functionality.
# custom_url: ""
# ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation.
# ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
# ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
# ## To force update on every request you can set this to '0' or 'always', this will increase processor demand.
# ## See the below documentation for more information.
# ## Duration Notation docs: https://www.authelia.com/c/common#duration-notation-format
# ## Refresh Interval docs: https://www.authelia.com/c/1fa#refresh-interval
# refresh_interval: 5m
# ##
# ## LDAP (Authentication Provider)
# ##
# ## This is the recommended Authentication Provider in production
# ## because it allows Authelia to offload the stateful operations
# ## onto the LDAP service.
# ldap:
# ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
# ## Acceptable options are as follows:
# ## - 'activedirectory' - For Microsoft Active Directory.
# ## - 'custom' - For custom specifications of attributes and filters.
# ## This currently defaults to 'custom' to maintain existing behaviour.
# ##
# ## Depending on the option here certain other values in this section have a default value, notably all of the
# ## attribute mappings have a default value that this config overrides, you can read more about these default values
# ## at https://www.authelia.com/c/ldap#defaults
# implementation: custom
# ## The url to the ldap server. Format: <scheme>://<address>[:<port>].
# ## Scheme can be ldap or ldaps in the format (port optional).
# url: ldap://127.0.0.1
# ## The dial timeout for LDAP.
# timeout: 5s
# ## Use StartTLS with the LDAP connection.
# start_tls: false
# tls:
# ## Server Name for certificate validation (in case it's not set correctly in the URL).
# # server_name: ldap.example.com
# ## Skip verifying the server certificate (to allow a self-signed certificate).
# ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
# ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
# skip_verify: false
# ## Minimum TLS version for either Secure LDAP or LDAP StartTLS.
# minimum_version: TLS1.2
# ## The distinguished name of the container searched for objects in the directory information tree.
# ## See also: additional_users_dn, additional_groups_dn.
# base_dn: dc=example,dc=com
# ## The attribute holding the username of the user. This attribute is used to populate the username in the session
# ## information. It was introduced due to #561 to handle case insensitive search queries. For you information,
# ## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this
# ## attribute holds the unique identifiers for the users binding the user and the configuration stored in database.
# ## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user
# ## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also
# ## be used but we don't recommend using them, we instead advise to use the attributes mentioned above
# ## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt.
# # username_attribute: uid
# ## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users.
# ## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users.
# additional_users_dn: ou=users
# ## The users filter used in search queries to find the user profile based on input filled in login form.
# ## Various placeholders are available in the user filter which you can read about in the documentation which can
# ## be found at: https://www.authelia.com/c/ldap#users-filter-replacements
# ##
# ## Recommended settings are as follows:
# ## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
# ## - OpenLDAP:
# ## - (&({username_attribute}={input})(objectClass=person))
# ## - (&({username_attribute}={input})(objectClass=inetOrgPerson))
# ##
# ## To allow sign in both with username and email, one can use a filter like
# ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
# users_filter: (&({username_attribute}={input})(objectClass=person))
# ## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups.
# ## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups.
# additional_groups_dn: ou=groups
# ## The groups filter used in search queries to find the groups based on relevant authenticated user.
# ## Various placeholders are available in the groups filter which you can read about in the documentation which can
# ## be found at: https://www.authelia.com/c/ldap#groups-filter-replacements
# ##
# ## If your groups use the `groupOfUniqueNames` structure use this instead:
# ## (&(uniqueMember={dn})(objectClass=groupOfUniqueNames))
# groups_filter: (&(member={dn})(objectClass=groupOfNames))
# ## The attribute holding the name of the group.
# # group_name_attribute: cn
# ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
# ## first one returned by the LDAP server is used.
# # mail_attribute: mail
# ## The attribute holding the display name of the user. This will be used to greet an authenticated user.
# # display_name_attribute: displayName
# ## Follow referrals returned by the server.
# ## This is especially useful for environments where read-only servers exist. Only implemented for write operations.
# permit_referrals: false
# ## The username and password of the admin user.
# user: cn=admin,dc=example,dc=com
# ## Password can also be set using a secret: https://www.authelia.com/c/secrets
# password: password
##
## File (Authentication Provider)
##
## With this backend, the users database is stored in a file which is updated when users reset their passwords.
## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia
## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security
## implications it is highly recommended you leave the default values. Before considering changing these settings
## please read the docs page below:
## https://www.authelia.com/r/passwords#tuning
##
## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
##
file:
path: /config/users_database.yml
password:
algorithm: argon2id
iterations: 1
key_length: 32
salt_length: 16
memory: 1024
parallelism: 8
##
## Password Policy Configuration.
##
password_policy:
## The standard policy allows you to tune individual settings manually.
standard:
enabled: false
## Require a minimum length for passwords.
min_length: 8
## Require a maximum length for passwords.
max_length: 0
## Require uppercase characters.
require_uppercase: true
## Require lowercase characters.
require_lowercase: true
## Require numeric characters.
require_number: true
## Require special characters.
require_special: true
## zxcvbn is a well known and used password strength algorithm. It does not have tunable settings.
zxcvbn:
enabled: false
## Configures the minimum score allowed.
min_score: 3
##
## Access Control Configuration
##
## Access control is a list of rules defining the authorizations applied for one resource to users or group of users.
##
## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed
## to anyone. Otherwise restrictions follow the rules defined.
##
## Note: One can use the wildcard * to match any subdomain.
## It must stand at the beginning of the pattern. (example: *.mydomain.com)
##
## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct.
##
## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'.
##
## - 'domain' defines which domain or set of domains the rule applies to.
##
## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not
## provided. If provided, the parameter represents either a user or a group. It should be of the form
## 'user:<username>' or 'group:<groupname>'.
##
## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'.
##
## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter
## is optional and matches any resource if not provided.
##
## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies.
access_control:
## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
## resource if there is no policy to be applied to the user.
default_policy: deny
networks:
- name: internal
networks:
- 10.10.0.0/16
- 192.168.2.0/24
- name: VPN
networks: 10.9.0.0/16
rules:
## Rules applied to everyone
- domain: 'auth.godopu.net'
policy: bypass
## Domain Regex examples. Generally we recommend just using a standard domain.
# - domain_regex: '^(?P<User>\w+)\.example\.com$'
# policy: one_factor
# - domain_regex: '^(?P<Group>\w+)\.example\.com$'
# policy: one_factor
# - domain_regex:
# - '^appgroup-.*\.example\.com$'
# - '^appgroup2-.*\.example\.com$'
# policy: one_factor
# - domain_regex: '^.*\.example\.com$'
# policy: two_factor
- domain: 'iot.knu.ac.kr'
policy: one_factor
- domain: 'protocol.knu.ac.kr'
policy: one_factor
## Network based rule, if not provided any network matches.
# networks:
# - internal
# - VPN
# - 192.168.1.0/24
# - 10.0.0.1
# - domain:
# - 'auth.godopu.com'
# - 'auth.godopu.com'
# policy: two_factor
# - domain: 'singlefactor.example.com'
# policy: one_factor
# ## Rules applied to 'admins' group
# - domain: 'mx2.mail.example.com'
# subject: 'group:admins'
# policy: deny
# - domain: '*.example.com'
# subject:
# - 'group:admins'
# - 'group:moderators'
# policy: two_factor
# ## Rules applied to 'dev' group
# - domain: 'dev.example.com'
# resources:
# - '^/groups/dev/.*$'
# subject: 'group:dev'
# policy: two_factor
# ## Rules applied to user 'john'
# - domain: 'dev.example.com'
# resources:
# - '^/users/john/.*$'
# subject: 'user:john'
# policy: two_factor
# ## Rules applied to user 'harry'
# - domain: 'dev.example.com'
# resources:
# - '^/users/harry/.*$'
# subject: 'user:harry'
# policy: two_factor
# ## Rules applied to user 'bob'
# - domain: '*.mail.example.com'
# subject: 'user:bob'
# policy: two_factor
# - domain: 'dev.example.com'
# resources:
# - '^/users/bob/.*$'
# subject: 'user:bob'
# policy: two_factor
##
## Session Provider Configuration
##
## The session cookies identify the user once logged in.
## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined.
session:
## The name of the session cookie.
name: authelia_session
## The domain to protect.
## Note: the authenticator must also be in that domain.
## If empty, the cookie is restricted to the subdomain of the issuer.
domain: godopu.net
## Sets the Cookie SameSite value. Possible options are none, lax, or strict.
## Please read https://www.authelia.com/c/session#same_site
same_site: lax
## The secret to encrypt the session data. This is only used with Redis / Redis Sentinel.
## Secret can also be set using a secret: https://www.authelia.com/c/secrets
secret: insecure_session_secret
## The value for expiration, inactivity, and remember_me_duration are in seconds or the duration notation format.
## See: https://www.authelia.com/c/common#duration-notation-format
## All three of these values affect the cookie/session validity period. Longer periods are considered less secure
## because a stolen cookie will last longer giving attackers more time to spy or attack.
## The time before the cookie expires and the session is destroyed if remember me IS NOT selected.
expiration: 1h
## The inactivity time before the session is reset. If expiration is set to 1h, and this is set to 5m, if the user
## does not select the remember me option their session will get destroyed after 1h, or after 5m since the last time
## Authelia detected user activity.
inactivity: 5m
## The time before the cookie expires and the session is destroyed if remember me IS selected.
## Value of -1 disables remember me.
remember_me_duration: 1M
##
## Redis Provider
##
## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
##
# redis:
# host: outline-redis
# port: 6379
# ## Use a unix socket instead
# # host: /var/run/redis/redis.sock
# ## Username used for redis authentication. This is optional and a new feature in redis 6.0.
# # username: authelia
# ## Password can also be set using a secret: https://www.authelia.com/c/secrets
# password: authelia
# ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
# database_index: 0
# ## The maximum number of concurrent active connections to Redis.
# maximum_active_connections: 8
# ## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
# minimum_idle_connections: 0
## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s).
# tls:
## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
# server_name: myredis.example.com
## Skip verifying the server certificate (to allow a self-signed certificate).
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
# skip_verify: false
## Minimum TLS version for the connection.
# minimum_version: TLS1.2
## The Redis HA configuration options.
## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
# high_availability:
## Sentinel Name / Master Name.
# sentinel_name: mysentinel
## Specific username for Redis Sentinel. The node username and password is configured above.
# sentinel_username: sentinel_specific_user
## Specific password for Redis Sentinel. The node username and password is configured above.
# sentinel_password: sentinel_specific_pass
## The additional nodes to pre-seed the redis provider with (for sentinel).
## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
## For high availability to be used you must have either defined; the host above or at least one node below.
# nodes:
# - host: sentinel-node1
# port: 6379
# - host: sentinel-node2
# port: 6379
## Choose the host with the lowest latency.
# route_by_latency: false
## Choose the host randomly.
# route_randomly: false
##
## Regulation Configuration
##
## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are made
## in a short period of time.
regulation:
## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
max_retries: 3
## The time range during which the user can attempt login before being banned. The user is banned if the
## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.
## See: https://www.authelia.com/c/common#duration-notation-format
find_time: 2m
## The length of time before a banned user can login again. Ban Time accepts duration notation.
## See: https://www.authelia.com/c/common#duration-notation-format
ban_time: 5m
##
## Storage Provider Configuration
##
## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.
storage:
## The encryption key that is used to encrypt sensitive information in the database. Must be a string with a minimum
## length of 20. Please see the docs if you configure this with an undesirable key and need to change it.
encryption_key: mydwxdd-c2hbo6zcmab1mzj232zx4
##
## Local (Storage Provider)
##
## This stores the data in a SQLite3 Database.
## This is only recommended for lightweight non-stateful installations.
##
## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
##
local:
path: /config/db.sqlite3
##
## MySQL / MariaDB (Storage Provider)
##
# mysql:
# host: 127.0.0.1
# port: 3306
# database: authelia
# username: authelia
# ## Password can also be set using a secret: https://www.authelia.com/c/secrets
# password: mypassword
# timeout: 5s
##
## PostgreSQL (Storage Provider)
##
# postgres:
# host: 127.0.0.1
# port: 5432
# database: authelia
# schema: public
# username: authelia
# ## Password can also be set using a secret: https://www.authelia.com/c/secrets
# password: mypassword
# timeout: 5s
# ssl:
# mode: disable
# root_certificate: disable
# certificate: disable
# key: disable
##
## Notification Provider
##
## Notifications are sent to users when they require a password reset, a Webauthn registration or a TOTP registration.
## The available providers are: filesystem, smtp. You must use only one of these providers.
notifier:
## You can disable the notifier startup check by setting this to true.
disable_startup_check: false
##
## File System (Notification Provider)
##
## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
##
# filesystem:
# filename: /config/notification.txt
##
## SMTP (Notification Provider)
##
## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate.
## [Security] By default Authelia will:
## - force all SMTP connections over TLS including unauthenticated connections
## - use the disable_require_tls boolean value to disable this requirement
## (only works for unauthenticated connections)
## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates
## (configure in tls section)
smtp:
username: godopu16@gmail.com #your email address
password: cdjdagxrmywcbaqf #your email password
host: smtp.gmail.com #email smtp server
port: 587 #email smtp port
sender: godopu16@gmail.com
identifier: localhost
subject: "[Authelia] {title}" #email subject
startup_check_address: godopu16@gmail.com
disable_require_tls: false
disable_html_emails: false
##
## Identity Providers
##
identity_providers:
##
## OpenID Connect (Identity Provider)
##
## It's recommended you read the documentation before configuration of this section:
## https://www.authelia.com/c/oidc
oidc:
# The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens).
# HMAC Secret can also be set using a secret: https://www.authelia.com/c/secrets
hmac_secret: mydwxdd-c2hbo6zcmab1mzj232zx4
# The issuer_private_key is used to sign the JWT forged by OpenID Connect.
# Issuer Private Key can also be set using a secret: https://www.authelia.com/c/secrets
issuer_private_key: |
-----BEGIN RSA PRIVATE KEY-----
MIIJKAIBAAKCAgEA6O7deUistjW6/6AuZNk/bA6AsL4/s2VTfm1PQv3juAnnvU8K
hd8xb/nXV1B7AjsxGzP06BiJa0VzyM7pi0l3Y2bxxJPSNWojg5HNzsZ24BebzAH8
oCHo/NU1OWw5eJNDIT/kuFJ0vImR6ransev56MZ2Ton2WrTF9jfBQQrQT6RoE1y6
okrHI+lVNkAwilDAALXhvdpeWuQ2vLem973ZHlSsHHUazEfjAkbT96r74vhmd6rQ
wJEAKnGYwsKUvxX8UschUnlr8t3tDEZuDEW2+fZ1P4QTwK5Y5WY4QCUFVBaY+MDo
sXDzCe/Wsw1yX0A3KpJq6+wI+r6/DMQUFcZoMQvU6IFfNk/l5ATAOmt/VZVeX3XW
QbdbkDwGE1su+VMM7efQw0kIXqcWWYJ48tcMxAPGnXtZ6i6smlbFtSW1rVB5WOnc
mv8ER5C0lqswp7yC0W9hBSM5xphlgS6909RzhIBPJavcorN18BukrN0+EA37NW3a
p+oNHSQHOMbAXrChYdUSwma/gcUfXy+WtU147N2PzPZTSe7CXiSIodNPbC62IGqu
BkTrVNpROncvnH55sZ8qhZVPP70qylIvXFEDjpCwWmObsPehGMMJN8DW3xDd7WrI
eXlNGsAQHs7Dihp1opUeBF0n1gS6dNweFI1aG3+gVtpPiHQumC69bdO52KcCAwEA
AQKCAgEAnj23w681dctmsEY3fleAGH55uphkWhEZ+ad000P7sYk5H4hU08Feqn2G
Z1DLYCaqI5rWY95XbMKP9/lo+zD7pFHJKQxrH9JtMfKZaEG3fGFNe/hVkMu4phqJ
v+rf2CPi1PG9BeMuXu7ubA+OOPbgndxFfvGGpPRuD+ispu0bux8rfQvf1mUKiED5
nJNa5nwZE+J76ygwNXsYHHh/O4qDt3E6Q1Li06h6dY98bKKB4B10LxOiIU/gVvU5
HAZoWrAq7GlPH+JRDXrqkQ4/sKKjvYhK+s1VRe6rgZxB1oHP7uIzJbqX2gOreDKx
Ho6iBkdvssIpVQDS0NVIoPmL04coO+1171p94lI0BjgU/+9kr3rSpSDqJETuyUwL
m4dnfuEE2CHU0tOeb7i/Mw55rJ2YtfXddWH7u0hp5AHLWqoEFBKjhYwzvim40Ghd
Acr2z52X9WkoNU2kuBIHF+MnZ/4E1w2jIhsrxi5R8fVa3C8OKVTYIjA5Cj8IWe18
c+pQrwGSNMaKJyOZFNAF9J22hXgY3BJNOyVX2JGA4+HYfAMxiaEPnZqQlkAsDoSb
LcdVSQ/bJH2dXJg2kosa5okwI//GPo8Kj1GyPUlu/3C7IoehHEnGsfbgzjg5yhs8
htyZObzeNqf6mf7AjTVtnDneUKYurI8inoJgePc0aKBOc0ZzPTECggEBAOlRWUWz
ZvLdZNJmo4fvzZp91wDsI5gnG0GKaWMxqDpcasv8midRdEcZ9y4r489vF7xNVpeM
dHUnmyeiq3GR+beFDAZTXmt1VxY87kdbmXMzc/jxxrmY76NQRIVoe372sromCS/7
mTF1fpsASFHXbcHEe0RE8jcrCFFiSsHWrHeux9iiVHlF3d+MLua/pYuCM9wu6uq0
/VQXK1RLcTQn5O6nUtwhVWuCaHfyTjEXsr9nZ85lNFlb0qOSscZErlNmPreFyoPd
FphLx14GdjfYGnf3Nz6q0KXqVk2FUJ2cZ+0u5yfjbVFD5eZbs/fHFtA+1MZjoRFf
K486uJFI0yCOBvMCggEBAP+T8TXGq0+EzwdSWxk3Pb0/i7a1t5gEYsrSd8b1nDYH
BP8ekqzv2wEVSFdg+GbuZL8NqjTb9Dkds7Y94zqAGl5FwNge5/l3E4X+Y9yue1Cd
a704BLrURN6SJlPBQ+zDr/YmE6Zz1mbNvRKVReLeDv1CIRLDCjA3q3kOvnxNPlYO
+zmo07ElLq7gedn8VmjiJfjZeXYxq9+UVxR6Pm9aDeZFTBzQa7URfESB2JU9x7Mz
zBImE5jUQcsHn9Ha/KaU5FzPoUWdDVPdv4T9IBJaOjam0ck/G0FwqzvSZ0i9HRrX
mXpO/bXGlyHchMvadJZvqJPd+cc+JvYmDHXvfrcivH0CggEAMJLrDwPGjxFgiB0u
NoLKPzuro1mGH4sktYRnZGtWJrBO26D/RuhCWPsi5s3kY68xNda0DGEFbc6NErdf
Egnd/0MHudlpct2+/7Y3tUtwqvcvUcikIsegPFPdsBiMfWZG11JL3112C0H21bY9
WCyNgSWytAfWlX20AZ2BCtHynggZOxSwmX7eLkg1C30ireSxf0mVRr/fbb5VGvuJ
2d3kX3seWQ3nhrZjoXUkqjvQzuBsUB/pwiDHvZ4wvKJX2K0UqYiFHObOaW59Vynp
Or8W45roOXe+cIxU41a57dY+HLcDEN7cR2rnVgoJcbBVI42xJoxfYAp8Oxlyi2yp
58Ep2QKCAQAXxtqs5xOu7SsZgkbpXKNIxO2pjNRMtzO9rMDp6JWkzRhg56Y7ooDc
Y+97+ZCCevEyeQH5svDQk3vRm4ZVPe+2D4U2VgG8yqAtWhJOSIk+YbbRPrHp86+I
iU45goRgNYBcRQSU+rfajo9leC+tQH1igFF1XmHHRJaWR5HfHIyNEw26OoOfOldS
e526cuhTD576vLi5DzvvK+zCAfFnCJi8cHv5PkaW7M6DzRSqJbo7aLk2gwZVtIF+
cvIiYt4YXUe1freBM3A2+i1EIQxnyK8bwH9J2q4dc27qvNNRCA76HU6w+0JNM/GB
e/N6x5MLH84uG3uOVrDnO3jzS9mdDgU9AoIBAAHACoyvwR7nAN3ZdyzMzsfcqZno
tCtHpaxm3k/rz81b7rLdCh6+rO44QmQxl/fEQwrx2lhCCzNC5JRXXdWjlY7pul6Z
Rse3kpuHMiprQhZcbPTW11JrQrz/UOsCy6x9axEjL3PRAfc9HK9byz00CwTNLlx8
0QKaVqk61VcUGcaOPCgQmnvSt9EQQwWhCaozF67GXBSooaA7RtrUeKIENDSrYZbc
BrHj8cxynIM56zJJ9YE3eyY4gsa2T6ChtRcY6edvzmwaKFz4PEtkZSHm6uc1Mu83
Z5H4liEDpxHfvUuYjRIdvILtb4M2rgpQGkt+TDrvv1150DexQWS7UMDv2Fo=
-----END RSA PRIVATE KEY-----
# The lifespans configure the expiration for these token types.
access_token_lifespan: 1h
authorize_code_lifespan: 1m
id_token_lifespan: 1h
refresh_token_lifespan: 90m
# Enables additional debug messages.
enable_client_debug_messages: false
clients:
- id: iot-ws
description: iot server
secret: mydwxdd-c2hbo6zcmab1mzj232zx4
public: false
authorization_policy: one_factor
audience: []
scopes:
- openid
- groups
- email
- profile
redirect_uris:
- https://iot.knu.ac.kr/auth/oidc.callback
grant_types:
- refresh_token
- authorization_code
response_types:
- code
response_modes:
- form_post
- query
- fragment
userinfo_signing_algorithm: none
# SECURITY NOTICE: It's not recommended changing this option and values below 8 are strongly discouraged.
minimum_parameter_entropy: 8
# SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it set to 'never'
# for security reasons.
enforce_pkce: public_clients_only
## Cross-Origin Resource Sharing (CORS) settings.
# cors:
## List of endpoints in addition to the metadata endpoints to permit cross-origin requests on.
# endpoints:
# - authorization
# - token
# - revocation
# - introspection
# - userinfo
## List of allowed origins.
## Any origin with https is permitted unless this option is configured or the
## allowed_origins_from_client_redirect_uris option is enabled.
# allowed_origins:
# - https://example.com
## Automatically adds the origin portion of all redirect URI's on all clients to the list of allowed_origins,
## provided they have the scheme http or https and do not have the hostname of localhost.
# allowed_origins_from_client_redirect_uris: false
## Clients is a list of known clients and their configuration.
# clients:
# -
## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
# id: myapp
## The description to show to users when they end up on the consent screen. Defaults to the ID above.
# description: My Application
## The client secret is a shared secret between Authelia and the consumer of this client.
# secret: this_is_a_secret
## Sector Identifiers are occasionally used to generate pairwise subject identifiers. In most cases this is not
## necessary. Read the documentation for more information.
## The subject identifier must be the host component of a URL, which is a domain name with an optional port.
# sector_identifier: example.com
## Sets the client to public. This should typically not be set, please see the documentation for usage.
# public: false
## The policy to require for this client; one_factor or two_factor.
# authorization_policy: two_factor
## By default users cannot remember pre-configured consents. Setting this value to a period of time using a
## duration notation will enable users to remember consent for this client. The time configured is the amount
## of time the pre-configured consent is valid for granting new authorizations to the user.
# pre_configured_consent_duration:
## Audience this client is allowed to request.
# audience: []
## Scopes this client is allowed to request.
# scopes:
# - openid
# - groups
# - email
# - profile
## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
# redirect_uris:
# - https://oidc.example.com:8080/oauth2/callback
## Grant Types configures which grants this client can obtain.
## It's not recommended to define this unless you know what you're doing.
# grant_types:
# - refresh_token
# - authorization_code
## Response Types configures which responses this client can be sent.
## It's not recommended to define this unless you know what you're doing.
# response_types:
# - code
## Response Modes configures which response modes this client supports.
# response_modes:
# - form_post
# - query
# - fragment
## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
# userinfo_signing_algorithm: none
...

BIN
config/authelia/db.sqlite3 Normal file
View File

Binary file not shown.

36
config/authelia/users_database.yml Normal file
View File

@ -0,0 +1,36 @@
# yamllint disable rule:line-length
---
###############################################################
# Users Database #
###############################################################
# This file can be used if you do not have an LDAP set up.
users:
godopu16@godopu.net:
displayname: "Godopu"
password: "$argon2id$v=19$m=1024,t=1,p=8$YkdjeHNkdERqNzNTWHN1aw$ve9otTk53kLiBjCeWD5u9YJxU4EtoGKxNB7BTlEcRC4" # Password is 'Rhehvn16^^', salt is bGcxsdtDj73SXsuk
email: godopu16@godopu.net
groups:
- admins
- dev
sjkoh:
displayname: "sjkoh"
password: "$argon2id$v=19$m=65536,t=3,p=4$VFx84S5QYd1J8WbI8NvdFw$BxFMZ/Vatqq8qdwtCTiR8qRLH8QgErMd9loNYgnBjSg"
email: sjkoh12@gmail.com
groups:
- admins
- dev
...
# supergint:
# displayname: "Dongle"
# password: "$argon2id$v=19$m=1024,t=1,p=8$c2NpM0RCcWM0UVVvSXNuaw$03SJ3Lk+WhvEzcJb7UpuuqKStqUw65pGuUj3cY9cVKg" # Password is 'Rhehvn16^^', salt is bGcxsdtDj73SXsuk
# email: supergint@gmail.com
# groups:
# - admins
# - dev
# yamllint enable rule:line-length

71
config/traefik/router.yaml Normal file
View File

@ -0,0 +1,71 @@
http:
routers:
to-traefik:
rule: Host(`traefik.godopu.net`)
service: traefik
entrypoints: http
middlewares: https-redirect
to-traefik-secure:
rule: Host(`traefik.godopu.net`)
service: traefik
entrypoints: https
tls:
certresolver: https-resolver
to-iot-ws:
rule: Host(`iot.knu.ac.kr`)
service: iot-ws
entrypoints: http
middlewares: https-redirect
to-iot-ws-secure:
rule: Host(`iot.knu.ac.kr`)
service: iot-ws
entrypoints: https
tls:
certresolver: https-resolver
to-protoecol-ws:
rule: Host(`protocol.knu.ac.kr`)
service: iot-ws
entrypoints: http
middlewares: https-redirect
to-protoecol-ws-secure:
rule: Host(`protocol.knu.ac.kr`)
service: iot-ws
entrypoints: https
tls:
certresolver: https-resolver
to-authelia:
rule: Host(`auth.godopu.net`)
service: authelia
entrypoints: http
middlewares: https-redirect
to-authelia-secure:
rule: Host(`auth.godopu.net`)
service: authelia
entrypoints: https
tls:
certresolver: https-resolver
middlewares:
https-redirect:
redirectscheme:
scheme: https
permanent: true
services:
traefik:
loadBalancer:
servers:
- url: http://traefik:8080
iot-ws:
loadBalancer:
servers:
- url: http://iot-web-server:4000
authelia:
loadBalancer:
servers:
- url: http://authelia-app:9091

65
config/traefik/traefik.yaml Normal file
View File

@ -0,0 +1,65 @@
experimental:
http3: true
global:
checkNewVersion: true
sendAnonymousUsage: true
certificatesResolvers:
https-resolver:
acme:
httpchallenge:
entrypoint: http
email: godopu16@gmail.com
storage: /letsencrypt/acme.json
################################################################
# Traefik logs configuration
################################################################
log:
level: DEBUG
################################################################
# Access logs configuration
################################################################
accessLog:
filePath: /traefik.log
bufferingSize: 100
filters:
statusCodes: ["400-499"]
################################################################
# API and dashboard configuration
################################################################
api:
insecure: true
################################################################
# EntryPoints configuration
################################################################
entryPoints:
http:
address: :80
https:
address: :443
################################################################
# Docker configuration backend
################################################################
serversTransport:
insecureSkipVerify: true
providers:
file:
directory: /etc/traefik/dynamic/conf
# docker:
# exposedbydefault: false
# file:
# directory: /rules
# watch: true

51
docker-compose.yaml
View File

@ -1,29 +1,66 @@
version: '3'
services:
traefik:
image: "docker.io/traefik:latest"
container_name: "traefik"
hostname: traefik
networks:
- lab-net
restart: always
expose:
- "80"
- "443"
- "8080"
command:
- "--configFile=/etc/traefik/dynamic/traefik.yaml"
ports:
- 80:80
- 443:443
- 8080:8080
volumes:
- "./config/traefik/traefik.yaml:/etc/traefik/dynamic/traefik.yaml"
- "./config/traefik/router.yaml:/etc/traefik/dynamic/conf/router.yaml"
- "./volumes/traefik/letsencrypt:/letsencrypt"
- "./volumes/traefik/cert/:/certs/"
labels:
- "traefik.enable=true"
iot-web-server:
hostname: iot-web-server
build: ./webserver
image: iot-web-server/v0.1
networks:
- lab-net
ports:
- 8080:8080
container_name: iot-web-server
restart: always
hostname: iot-web-server
volumes:
- "./iot-www:/home/www"
- "/home/sjkoh/www:/home/www"
openvscode-server:
image: gitpod/openvscode-server:latest
container_name: "openvscode-server"
ports:
- 3000:3000
hostname: openvscode-server
networks:
- lab-net
volumes:
- "./iot-www:/home/workspace"
- "/home/sjkoh/www:/home/workspace"
entrypoint:
- "/home/.openvscode-server/bin/openvscode-server"
- "--host=0.0.0.0"
- "--without-connection-token"
# - "--connection-token=6b97db13-f2e3-41bb-a3a5-a18fdd1369e5"
authelia-app:
image: authelia/authelia:latest
container_name: authelia-app
hostname: authelia-app
networks:
- lab-net
restart: unless-stopped
ports:
- 9091:9091
volumes:
- ./config/authelia:/config
networks:
lab-net: null

9
webserver/router/auth.go
View File

@ -17,7 +17,7 @@ import (
var (
// clientID = os.Getenv("GOOGLE_OAUTH2_CLIENT_ID")
// clientSecret = os.Getenv("GOOGLE_OAUTH2_CLIENT_SECRET")
clientID = "godopu-dev"
clientID = "iot-ws"
clientSecret = "mydwxdd-c2hbo6zcmab1mzj232zx4"
)
var config oauth2.Config
@ -25,7 +25,7 @@ var provider *oidc.Provider
func init() {
var err error
provider, err = oidc.NewProvider(context.Background(), "https://auth.godopu.com")
provider, err = oidc.NewProvider(context.Background(), "https://auth.godopu.net")
if err != nil {
log.Fatal(err)
}
@ -33,7 +33,7 @@ func init() {
ClientID: clientID,
ClientSecret: clientSecret,
Endpoint: provider.Endpoint(),
RedirectURL: "http://localhost:4000/auth/oidc.callback",
RedirectURL: "https://iot.knu.ac.kr/auth/oidc.callback",
Scopes: []string{oidc.ScopeOpenID, "profile", "email"},
}
}
@ -97,14 +97,13 @@ func authCallback(ctx *gin.Context) {
c := &http.Cookie{
Name: "__edit_access_token_",
Value: "value",
Value: "temporary-token",
MaxAge: int(time.Hour.Seconds()),
Secure: ctx.Request.TLS != nil,
HttpOnly: true,
Path: "/",
}
ctx.Set("__edit_access_token_", "^^")
http.SetCookie(ctx.Writer, c)
ctx.Redirect(http.StatusFound, "/edit")
}

2
webserver/router/reverse_proxy.go
View File

@ -13,7 +13,7 @@ func reverseProxyHandle(c *gin.Context) {
path := c.Param("any")
remote, err := url.Parse("http://localhost:3000")
remote, err := url.Parse("http://openvscode-server:3000")
if err != nil {
panic(err)
}

2
webserver/router/route.go
View File

@ -11,7 +11,7 @@ import (
func NewRouter() *gin.Engine {
assetEngine := gin.New()
assetEngine.Static("/home", "../iot-www")
assetEngine.Static("/home", "./www")
r := gin.New()