[Feature] Add Authelia auth

[Sigri44]

Ajout de Authelia afin de ne plus avoir à passer par l'http_auth, ajout du service Authelia :

https://www.authelia.com/integration/deployment/docker/

Config exemple :

services:
  authelia:
    image: authelia/authelia
    container_name: authelia
    restart: always
    volumes:
      - ./config:/config
    environment:
      - TZ=Europe/Paris
    networks:
      - traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.authelia.rule=Host(`host.domain.cdn`)"

networks:
  traefik:
    external: true

[Sigri44]

Doc complémentaire :
https://www.authelia.com/integration/deployment/docker/
https://www.authelia.com/integration/proxies/traefik/
https://www.authelia.com/integration/trusted-header-sso/organizr/

[tblaudez]

I was able to add Authelia to my seedbox and integrate it with Traefik for seamless SSO.
I also managed to integrate Authelia with OIDC to other apps in the seedbox (nextcloud, paperless, etc..).

I share my workflow and configuration for other users that'd like to integrate Authelia as a SSO service.
I took inspiration from some of the commits of the sso branch in this repository and a lot of Authelia documentation, among the ones that @Sigri44 sent.

@jfroment I hope this'll help you for a more "permanent" integration of Authelia into the project.

1 - Installation

First of all, the Authelia service file is fairly simple :

# services/custom/authelia.yaml
services:
  authelia:
    container_name: authelia
    image: authelia/authelia
    volumes:
      - authelia-config:/config
    environment:
      PUID: ${PUID}
      PGID: ${PGID}
      TZ: ${TZ}
    restart: unless-stopped

volumes:
  authelia-config:
    driver: local-persist
    driver_opts:
      mountpoint: $HOST_CONFIG_PATH/authelia

Same for the Traefik middlewares, all of this was already in the sso branch.

This configuration assumes that Authelia will be accessible at sso.${TRAEFIK_DOMAIN} :

# traefik/custom/middlewares.yaml
# [...]
authelia:
  forwardAuth:
    address: http://authelia:9091/api/verify?rd=https://sso.{{ env "TRAEFIK_DOMAIN" }}
    trustForwardHeader: true
    authResponseHeaders:
      - "Remote-User"
      - "Remote-Groups"

chain-authelia:
  chain:
    middlewares:
      - security-headers
      - authelia

The config.yaml file needs to be updated to add this new service :

# config.yaml
# [...]
  - name: authelia
    enabled: true 
    customFile: custom/authelia.yaml
    vpn: false
    traefik:
      enabled: true
      rules:
        - host: sso.${TRAEFIK_DOMAIN}
          sso: false
          httpAuth: false
          internalPort: 9091

2 - Configuration

I - configuration.yml

This is where it get a little more complex, Authelia needs a configuration.yaml file in its config directory ; on the host machine, this directory will be $HOST_CONFIG_PATH/authelia/configuration.yaml.
You can find a template of this configuration file here.

Below is the bare minimum configuration required for Authelia to actually function as a SSO service.
⚠️ IMPORTANT : This configuration requires to fill some variables that will be used as secrets, those secrets should be at least 60+ chars alphanumerical strings

One-liner to generate a random 64bits alphanumeric string :

docker run --rm authelia/authelia:latest authelia crypto rand --length 64 --charset alphanumeric

Those values can be used for variables such as jwt_secret, session.secret, storage.encryption_key, etc..

With that in mind, here's my working configuration file (the unused commented lines have been removed) :

# $HOST_CONFIG_PATH/authelia/configuration.yaml
identity_validation:
  reset_password:
    jwt_secret: 'SUPER_LONG_ALPHANUMERIC_JWT_SECRET' # Generate a new one with the aforementioned docker command
authentication_backend:
  file:
    path: '/config/users.yml' # <-- This matches "$HOST_CONFIG_PATH/users.yml"
    # ADAPT THOSE PARAMETERS TO YOUR LIKING
    watch: false
    search:
      email: false
      case_insensitive: false
    password:
      algorithm: 'argon2'
      argon2:
        variant: 'argon2id'
        iterations: 3
        memory: 65536
        parallelism: 4
        key_length: 32
        salt_length: 16
access_control:
  default_policy: 'deny'
  rules:
    # ADAPT THOSE RULES TO YOUR LIKING
    - domain: '*.mydomain.com' # <-- This must match your $TRAEFIK_DOMAIN
      resources:
        - '^/api'
      policy: 'bypass' # <-- This rule is present first to bypass Authelia when accessing "/api" ressources (useful for external apps like NZB360)

    - domain: '*.mydomain.com' # <-- This must match your $TRAEFIK_DOMAIN
      policy: 'one_factor' # <-- Require only password to authenticate

session:
  secret: 'SUPER_LONG_ALPHANUMERIC_SESSION_SECRET' # Generate a new one with the aforementioned docker command
  name: 'authelia_session'
  same_site: 'lax'
  inactivity: '5m'
  expiration: '1h'
  remember_me: '1M'
  cookies:
    - domain: 'mydomain.com' # <-- This must match your $TRAEFIK_DOMAIN
      authelia_url: 'https://sso.mydomain.com' # <-- This must match your $TRAEFIK_DOMAIN
      default_redirection_url: 'https://mydomain.com' # <-- This must match your $TRAEFIK_DOMAIN
      name: 'authelia_session'
      same_site: 'lax'
      inactivity: '5m'
      expiration: '1h'
      remember_me: '1d'
storage:
  encryption_key: 'SUPER_LONG_ALPHANUMERIC_STORAGE_KEY' # Generate a new one with the aforementioned docker command
  local:
    path: '/config/db.sqlite3' # <-- This matches "$HOST_CONFIG_PATH/authelia/db.sqlite3"
notifier:
  disable_startup_check: false
  filesystem:
    filename: '/config/notification.txt' # <-- This matches "$HOST_CONFIG_PATH/authelia/notification.txt"

II - users.yml

The users.yml file must also be filled with the Authelia users for the SSO.
This file also contains the argon2 hashed version of the users' password (because we configured Authelia to use argon2 in the config file)

One-liner to encrypt a plaintext password using argon2

docker run --rm -it authelia/authelia:latest authelia crypto hash generate argon2

Enter your plaintext password (there's no output, that's normal) and note the $argon2... digest

# $HOST_CONFIG_PATH/users.yml
users:
  thisismyusername: # <-- Edit username here
    disabled: false
    displayname: 'thisismyusername' # <-- Edit username here
    password: 'ARGON2_ENCRYPTED_PASSWORD'
    email: 'thisismyusername@mydomain.com' # <-- Edit email address here
    groups: []

The $HOST_CONFIG_PATH/authelia/db.sqlite3 and $HOST_CONFIG_PATH/authelia/notification.txt will be automatically generated when the Authelia service starts

2 - Setup

The last step is to integrate @jfroment's work in the sso branch to add support for sso in the run-seedbox.sh file :

# run-seedbox.sh
# [...]

# Check if some services have authelia enabled, that authelia itself is enabled
nb_sso=$(cat config.json | jq '[.services[] | select(.enabled==true and .traefik.rules[].sso==true)] | length')
authelia_enabled=$(cat config.json | jq '[.services[] | select(.name=="authelia" and .enabled==true)] | length')
if [[ ${nb_sso} -gt 0 && ${authelia_enabled} == 0 ]]; then
  echo "[$0] ERROR. ${nb_sso} Authelia-enabled services have been enabled BUT authelia itself has not been enabled. Please check your config.yaml file."
  echo "[$0] ******* Exiting *******"
  exit 1
fi

# Check that for a same rule, httpAuth and authelia are not both enabled
# TODO: fix the condition to allow multiple auth on multiple Traefik rules for a service
nb_both_auth=$(cat config.json | jq '[.services[] | select(.traefik.rules[].httpAuth==true and .traefik.rules[].sso==true)] | length')
if [[ ${nb_both_auth} -gt 0 ]]; then
  echo "[$0] ERROR. ${nb_both_auth} services have both SSO/Authelia and HTTP Authentication enabled. Please choose only one for a rule."
  echo "[$0] ******* Exiting *******"
  exit 1
fi

# [...]

host=$(echo $rule | jq -r .host)
internalPort=$(echo $rule | jq -r .internalPort)
httpAuth=$(echo $rule | jq -r .httpAuth)
sso=$(echo $rule | jq -r .sso)
echo-debug "[$0]      Host => ${host}"
echo-debug "[$0]      Internal Port => ${internalPort}"
echo-debug "[$0]      Http Authentication => ${httpAuth}"
echo-debug "[$0]      SSO => ${sso}"

# [...]

middlewareCount=0
if [[ ${httpAuth} == "true" ]]; then
  echo "http.routers.${ruleId}.middlewares.${middlewareCount}: common-auth@file" >> rules.props
  ((middlewareCount=middlewareCount+1))
fi

if [[ ${sso} == "true" ]]; then
  echo "http.routers.${ruleId}.middlewares.${middlewareCount}: chain-authelia@file" >> rules.props
  ((middlewareCount=middlewareCount+1))
fi

Finally, we need to add a new option to each of our services in the config.yaml file to enable/disable SSO :

- name: sonarr
  enabled: true
  vpn: false
  traefik:
    enabled: true
    rules:
      - host: sonarr.${TRAEFIK_DOMAIN}
        sso: true # <-- ADD THIS LINE TO CONFIGURE SSO FOR THE SERVICE
        httpAuth: false
        internalPort: 8989

3 - OIDC

Some more configuration is required in order to handle OIDC and enabling SSO for apps that support it, such as Paperless, Nextcloud, Immich, Audiobookshelf, etc...

I won't be covering it here, but the base documentation for OIDC can be found here

Once OIDC is configured, look at the documentation regarding the integration of each specific application (documentation example is for Paperless).

More documentation on this blog post (example for Immich)

4 - Integration to the project

All of this is working great for my use-case (single user & static configuration), but this is far from an optimal setup.

The next steps would be to integrate this example as a new service with the same "plug & play" philosophy that @jfroment aimed for with this project.
This means to find a way to integrate some of the configuration above as environment variables in the Authelia container, this way it all could be configured via the .env.custom file.

[Sigri44]

[...]

Wow very big thanks @tblaudez, good use case, working fine !

@jfroment can you prepare to integrate that, all steps are goods, just need to include env domain into authelia/configuration.yaml ?

[tblaudez]

Thanks @Sigri44, I hope this'll help other people as well !

Here's the documentation regarding environment variables for Authelia.

It is however limited :

Maybe we'll be better off using configuration through secrets and integrate them with Docker