# Authelia Configuration
# Managed in nix-setup repo, deployed via activation script
# LLDAP provides user authentication and groups

server:
  address: tcp://0.0.0.0:9091

log:
  level: info

session:
  cookies:
    - domain: storel.xyz
      authelia_url: https://a.storel.xyz

# LLDAP authentication backend
authentication_backend:
  ldap:
    address: ldap://host.docker.internal:3890
    base_dn: dc=storel,dc=xyz
    user: uid=admin,ou=people,dc=storel,dc=xyz
    password: '{{ secret "/run/secrets/LLDAP_ADMIN_PASSWORD" }}'
    attributes:
      username: uid
      display_name: displayName
      mail: mail
      group_name: cn
    users_filter: (&({username_attribute}={input})(objectClass=person))
    groups_filter: (member={dn})

# Access control for forward auth (Traefik)
# Use group:groupname for LDAP group-based access
access_control:
  default_policy: deny
  rules:
    # Admin-only services
    - domain: traefik.storel.xyz
      policy: one_factor
      subject: ["group:admins"]

    # All authenticated users
    - domain: files.storel.xyz
      policy: one_factor
      subject: ["group:users"]
    - domain: jd.storel.xyz
      policy: one_factor
      subject: ["group:users"]
    - domain: sb.storel.xyz
      policy: one_factor
      subject: ["group:users"]
    - domain: khoj.storel.xyz
      policy: one_factor
      subject: ["group:users"]

storage:
  local:
    path: /config/db/authelia.sqlite3
  encryption_key: '{{ secret "/run/secrets/AUTHELIA_STORAGE_ENCRYPTION_KEY" }}'

notifier:
  filesystem:
    filename: /config/notices.log

totp:
  disable: false
  issuer: storel.xyz

identity_validation:
  reset_password:
    jwt_secret: '{{ secret "/run/secrets/AUTHELIA_JWT_SECRET" }}'

identity_providers:
  oidc:
    hmac_secret: '{{ secret "/run/secrets/AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET" }}'
    jwks:
      - key_id: 'rsa_key_2048'
        algorithm: 'RS256'
        use: 'sig'
        key: |
          -----BEGIN PRIVATE KEY-----
          MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCTEhi+b06l8Czf
          NHsa1iEh5Su20T30Ghn9yGqwnUOqMI158yYVhUvSZOermyi6x/COLWfB00whag+j
          wjBaOYsuhzFGcZmlOkpEKo1RP9LrQeANMJYJXxn3vZ2x5XIlI1jhoyG0TM4R3U+K
          xYhIXA/TP4u/mtdYGdQ+YRevCmMfrvhSOfvGCvezL32qZ0nCMwIsZWlWmp7g9H68
          klcUFA5T7dpBgSMaKfXrq78WduDfuECHhDj7OAzzw2Kv9IZW0bVMz6JWZsMynaea
          nXRniII2lVUiqgMcMhpcmYYQj7T1FoPvDyi8q45PI6dvdSUAOrYf7CjwVsY4ypst
          ++uSf5C/AgMBAAECggEAIlmos9n1iaZmJJ/yXNtEk9Ed+641hS0PgwnreWLR6g87
          DA+xhndCtVpiDd/IjI+kbODICipa7rcB/iKd/oTQMEbdSHHCDChoLjGuHhsFHXOe
          bBY8BOZUf1unWGSZ23i9Cr56Yc1KmDuTl3r5kMUH4TRHZLI6t9YYj5VH3ddUPZLa
          wvJXp38VucJ/14qc7LPiNpXtPz25u0sFSGgpOHgcYi5nQ0anlKYS2GPfC7NJ5Qdu
          ulEeeMrcGgAWQg86QY6vEunXvSCuqhou95i7ITV2ej8WLA7009OWjZ4GjL+y+7T1
          U8y+suCQWKRjDg3Ss0HVL98pEvB1qBR3qmlImZ7+QQKBgQDCalU7jYtuO6g/dIb8
          HecKbKVxOhSqFhLx0Ve44Qm32YridIeUAWAIap8Rg1Qr23Z6fL0pGWRYGNZ5KgrZ
          OW9IwuNI/hkLug4rQDbnAwfpwgcXy9tuighIompsdLUojSbRfsx93oOZPf+9VH8U
          3oR45gTPP5AmESQJjfqX9mRUoQKBgQDBqHTN+IgldS7gyZQIR9BtHOK1YNwJevFU
          IekGpjcx7jCR69DjP7IJfjHD8UE4GNKLOgbJEpb3HpbPkH2/odv3V1ERqi3X78H1
          cPeBzbjg199Lr6lSAvZaHHJc2DUy9Q68pPl03wEvu4ylx2Q7B0MANDHkTOwlJ6HB
          qNHc1bqJXwKBgCFPkM0EYph/lkNRFvPJt9V8ahhtaC8AWzydrtcZj821c2t7peNB
          HRA0HI8mnlxpXPJ9vvd0x1Gk59KY1oUDp0KjScgu6WGt/lGAzidkyI1P1mFIZ4+Y
          DPVNBskQch3BmZ4ZiLYkUw4FpnTtLl0IB1CjsL1F2c/77d3JOt+gsu4hAoGAdvpQ
          CNtQifLcwi4WTKASZXcBsf24MfremZnb2MH11y9Hl98RjwxrDXoCiSeHsjdN40vb
          L13Ecj7Q2OUk3L9MrUFwBTJQyAH9YBXvekgx9bGq9o0Nsd0wDVy8xl3vEUeNrkiN
          GkiIKhNH7fH6mmlzuIRYwrKfwpP+xUQ66zpESHECgYATJzACIXBwTu7NFPr5rUhY
          5EC1AjKaE5OyMA6cHHukvfwT4hRugVCT7hSwdTjzHuRH9zmQ8qSy8aBVnBlEqh/p
          2LdSRFKJA+I/+AcTzTiTQodHPZ5yGfONVSgTHc0ilKzIxLzAVvsH4wYS3ATdPj9t
          S5QfARk9aI16BA0rPzuxcg==
          -----END PRIVATE KEY-----
    cors:
      endpoints:
        - authorization
        - token
        - userinfo
        - introspection
        - revocation
      allowed_origins:
        - https://cloud.storel.xyz
        - https://p.storel.xyz
    clients:
      - client_id: 'immich'
        client_name: 'Immich'
        client_secret: '{{ secret "/run/secrets/IMMICH_CLIENT_SECRET" }}'
        authorization_policy: 'one_factor'
        token_endpoint_auth_method: 'client_secret_post'
        redirect_uris:
          - 'https://i.storel.xyz/auth/login'
          - 'https://i.storel.xyz/user-settings'
          - 'app.immich:///oauth-callback'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'

      - client_id: 'paperless'
        client_name: 'Paperless'
        client_secret: '{{ secret "/run/secrets/PAPERLESS_CLIENT_SECRET" }}'
        public: false
        authorization_policy: 'one_factor'
        token_endpoint_auth_method: 'client_secret_basic'
        require_pkce: true
        pkce_challenge_method: 'S256'
        redirect_uris:
          - 'https://p.storel.xyz/accounts/oidc/authelia/login/callback/'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
          - 'groups'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'

      - client_id: 'web'
        client_name: 'OpenCloud Web'
        public: true
        authorization_policy: 'one_factor'
        require_pkce: true
        pkce_challenge_method: S256
        token_endpoint_auth_method: 'none'
        redirect_uris:
          - 'https://cloud.storel.xyz/oidc-callback'
          - 'https://cloud.storel.xyz'
          - 'https://cloud.storel.xyz/oidc-callback.html'
          - 'https://cloud.storel.xyz/oidc-silent-redirect.html'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
          - 'groups'
          - 'offline_access'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'

      - client_id: OpenCloudDesktop
        client_name: OpenCloud Desktop
        public: true
        authorization_policy: 'one_factor'
        require_pkce: true
        pkce_challenge_method: S256
        token_endpoint_auth_method: none
        redirect_uris:
          - http://127.0.0.1
          - http://localhost
        scopes:
          - openid
          - profile
          - email
          - offline_access
        response_types: [code]
        grant_types:
          - authorization_code
          - refresh_token

      - client_id: OpenCloudAndroid
        client_name: OpenCloud Android
        public: true
        require_pkce: true
        authorization_policy: 'one_factor'
        pkce_challenge_method: S256
        token_endpoint_auth_method: none
        redirect_uris:
          - oc://android.opencloud.eu
        scopes:
          - openid
          - profile
          - email
          - offline_access
        response_types: [code]
        grant_types:
          - authorization_code
          - refresh_token

      - client_id: OpenCloudiOS
        client_name: OpenCloud iOS
        public: true
        require_pkce: true
        pkce_challenge_method: S256
        token_endpoint_auth_method: none
        redirect_uris:
          - oc://ios.opencloud.eu
        scopes:
          - openid
          - profile
          - email
          - offline_access
        response_types: [code]
        grant_types:
          - authorization_code
          - refresh_token

      - client_id: 'kitchenowl'
        client_name: 'KitchenOwl'
        client_secret: '{{ secret "/run/secrets/KITCHENOWL_CLIENT_SECRET" }}'
        public: false
        authorization_policy: 'one_factor'
        pre_configured_consent_duration: '1M'
        audience: []
        scopes:
          - 'openid'
          - 'email'
          - 'profile'
        redirect_uris:
          - 'https://k.storel.xyz/signin/redirect'
          - 'kitchenowl:/signin/redirect'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        userinfo_signing_algorithm: 'none'
        token_endpoint_auth_method: 'client_secret_post'

      - client_id: 'jellyfin'
        client_name: 'Jellyfin'
        client_secret: '{{ secret "/run/secrets/JELLYFIN_CLIENT_SECRET" }}'
        public: false
        authorization_policy: 'one_factor'
        require_pkce: true
        pkce_challenge_method: 'S256'
        redirect_uris:
          - https://j.storel.xyz/sso/OID/redirect/authelia
        scopes:
          - 'openid'
          - 'profile'
          - 'groups'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_post'

      - client_id: 'memos'
        client_name: 'Memos Notes'
        client_secret: '{{ secret "/run/secrets/MEMOS_CLIENT_SECRET" }}'
        public: false
        authorization_policy: 'one_factor'
        redirect_uris:
          - 'https://memos.storel.xyz/auth/callback'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        token_endpoint_auth_method: 'client_secret_post'

      - client_id: 'karakeep'
        client_name: 'Karakeep Bookmarks'
        client_secret: '{{ secret "/run/secrets/KARAKEEP_CLIENT_SECRET" }}'
        public: false
        authorization_policy: 'one_factor'
        claims_policy: 'karakeep'
        redirect_uris:
          - 'https://kk.storel.xyz/api/auth/callback/custom'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        token_endpoint_auth_method: 'client_secret_basic'
        require_pkce: false
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'

      - client_id: 'open-webui'
        client_name: 'Open WebUI AI Chat'
        client_secret: '{{ secret "/run/secrets/OPEN_WEBUI_CLIENT_SECRET" }}'
        public: false
        authorization_policy: 'one_factor'
        require_pkce: true
        pkce_challenge_method: 'S256'
        redirect_uris:
          - 'https://ai.storel.xyz/oauth/oidc/callback'
        scopes:
          - 'openid'
          - 'profile'
          - 'groups'
          - 'email'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_basic'

      - client_id: 'vikunja'
        client_name: 'Vikunja'
        client_secret: '{{ secret "/run/secrets/VIKUNJA_CLIENT_SECRET" }}'
        authorization_policy: 'one_factor'
        redirect_uris:
          - 'https://vikunja.storel.xyz/auth/openid/authelia'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        token_endpoint_auth_method: 'client_secret_post'

      - client_id: 'norish'
        client_name: 'Norish Recipes'
        client_secret: '{{ secret "/run/secrets/NORISH_CLIENT_SECRET" }}'
        public: false
        authorization_policy: 'one_factor'
        redirect_uris:
          - 'https://recipes.storel.xyz/api/auth/oauth2/callback/oidc'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        token_endpoint_auth_method: 'client_secret_post'

    claims_policies:
      karakeep:
        id_token: ['email']
