# https://github.com/authelia/chartrepo/blob/master/charts/authelia/values.yaml image: registry: ghcr.io repository: authelia/authelia tag: 4.39.13 # renovate: docker=ghcr.io/authelia/authelia pullPolicy: IfNotPresent pod: kind: Deployment env: - name: TZ value: Europe/Oslo - name: AUTHELIA_NOTIFIER_SMTP_USERNAME valueFrom: secretKeyRef: { name: smtp-credentials, key: username } extraVolumeMounts: - name: consent mountPath: /config/assets/locales/en/consent.json subPath: consent.json extraVolumes: - name: consent configMap: defaultMode: 0644 name: consent configMap: default_2fa_method: totp theme: dark log: level: info telemetry: metrics: enabled: true port: 9959 serviceMonitor: enabled: true access_control: default_policy: deny rules: - domain_regex: ^.*\.stonegarden.dev$ policy: two_factor session: cookies: [ { domain: stonegarden.dev } ] server: asset_path: /config/assets/ storage: postgres: enabled: true deploy: false address: tcp://authelia-postgres-rw:5432 database: authelia username: authelia password: { secret_name: authelia-postgres-app } notifier: smtp: enabled: true address: smtp://smtp.mailersend.net:587 sender: Authelia disable_html_emails: false password: { secret_name: smtp-credentials } authentication_backend: ldap: enabled: true implementation: lldap address: ldaps://lldap.stonegarden.dev base_dn: DC=stonegarden,DC=dev user: UID=authelia,OU=people,DC=stonegarden,DC=dev password: { secret_name: lldap-credentials } attributes: extra: argocd: { multi_valued: true, value_type: string } audiobookshelf: { multi_valued: true, value_type: string } grafana: { multi_valued: true, value_type: string } identity_providers: oidc: ## Currently in beta stage. See https://www.authelia.com/r/openid-connect/ enabled: true jwks: - key_id: default algorithm: RS256 use: sig key: { path: /secrets/jwk-rsa/tls.key } certificate_chain: { path: /secrets/jwk-rsa/tls.crt } - key_id: ecdsa256 algorithm: ES256 use: sig key: { path: /secrets/jwk-ecdsa/tls.key } certificate_chain: { path: /secrets/jwk-ecdsa/tls.crt } cors: allowed_origins_from_client_redirect_uris: true endpoints: [ userinfo, authorization, token, revocation, introspection ] claims_policies: argocd_policy: custom_claims: { argocd_claim: { attribute: argocd } } # Argo CD requires the claims other than `groups` to be in the ID Token https://github.com/argoproj/argo-cd/issues/23768 id_token: [ email, email_verified, alt_emails, name, preferred_username, argocd_claim ] audiobookshelf: custom_claims: { audiobookshelf: { attribute: audiobookshelf } } grafana: custom_claims: { grafana: { attribute: grafana } } legacy: # https://www.authelia.com/integration/openid-connect/openid-connect-1.0-claims/#restore-functionality-prior-to-claims-parameter id_token: [ email, email_verified, alt_emails, name, preferred_username, groups ] username_email: id_token: [ email, email_verified, alt_emails, name, preferred_username ] scopes: argocd_scope: claims: [ argocd_claim ] audiobookshelf: claims: [ audiobookshelf ] grafana: claims: [ grafana ] clients: - client_id: argocd client_secret: { path: /secrets/client-argocd/client_secret.txt } client_name: Argo CD public: false authorization_policy: two_factor claims_policy: argocd_policy pre_configured_consent_duration: 3 months require_pkce: false redirect_uris: - https://argocd.stonegarden.dev/auth/callback - https://argocd.stonegarden.dev/applications scopes: [ openid, email, profile, offline_access, argocd_scope ] grant_types: [ authorization_code, refresh_token ] userinfo_signed_response_alg: none id_token_signed_response_alg: ES256 access_token_signed_response_alg: ES256 - client_id: argocd-cli client_name: Argo CD (CLI) public: true authorization_policy: two_factor claims_policy: argocd_policy pre_configured_consent_duration: 3 months redirect_uris: [ http://localhost:8085/auth/callback ] scopes: [ openid, email, profile, offline_access, argocd_scope ] id_token_signed_response_alg: ES256 access_token_signed_response_alg: ES256 revocation_endpoint_auth_method: none introspection_endpoint_auth_method: none pushed_authorization_request_endpoint_auth_method: none - client_id: audiobookshelf client_secret: { path: /secrets/client-audiobookshelf/client_secret.txt } client_name: Audiobookshelf public: false authorization_policy: one_factor claims_policy: audiobookshelf pre_configured_consent_duration: 3 months require_pkce: true redirect_uris: - https://abs.stonegarden.dev/audiobookshelf/auth/openid/callback - https://abs.stonegarden.dev/audiobookshelf/auth/openid/mobile-redirect - audiobookshelf://oauth scopes: [ openid, email, profile, offline_access, audiobookshelf ] grant_types: [ authorization_code, refresh_token ] id_token_signed_response_alg: ES256 access_token_signed_response_alg: ES256 - client_id: grafana client_secret: { path: /secrets/client-grafana/client_secret.txt } client_name: Grafana public: false authorization_policy: two_factor claims_policy: grafana pre_configured_consent_duration: 3 months require_pkce: true pkce_challenge_method: S256 redirect_uris: [ https://grafana.stonegarden.dev/login/generic_oauth ] scopes: [ openid, email, profile, offline_access, grafana ] response_types: [ code ] grant_types: [ authorization_code, refresh_token ] userinfo_signed_response_alg: none id_token_signed_response_alg: ES256 access_token_signed_response_alg: ES256 token_endpoint_auth_method: client_secret_basic - client_id: kubectl client_name: kubectl public: true authorization_policy: two_factor claims_policy: legacy pre_configured_consent_duration: 3 months require_pkce: true redirect_uris: [ http://localhost:8000, http://localhost:18000 ] scopes: [ openid, email, profile, offline_access, groups ] grant_types: [ authorization_code, refresh_token ] revocation_endpoint_auth_method: none introspection_endpoint_auth_method: none pushed_authorization_request_endpoint_auth_method: none - client_id: netbird client_secret: { path: /secrets/client-netbird/client_secret.txt } client_name: NetBird public: false authorization_policy: two_factor claims_policy: username_email pre_configured_consent_duration: 3 months require_pkce: true pkce_challenge_method: S256 audience: [ netbird ] redirect_uris: - http://localhost:53000 - https://netbird.stonegarden.dev/callback - https://netbird.stonegarden.dev/silent-callback scopes: [ openid, profile, email, offline_access ] grant_types: [ authorization_code, refresh_token ] token_endpoint_auth_method: client_secret_post secret: existingSecret: crypto additionalSecrets: authelia-postgres-app: items: [ { key: password, path: storage.postgres.password.txt } ] lldap-credentials: items: [ { key: password, path: authentication.ldap.password.txt } ] smtp-credentials: items: [ { key: password, path: notifier.smtp.password.txt } ] jwk-rsa: items: - { key: tls.key, path: tls.key } - { key: tls.crt, path: tls.crt } jwk-ecdsa: items: - { key: tls.key, path: tls.key } - { key: tls.crt, path: tls.crt } client-argocd: items: [ { key: clientSecret, path: client_secret.txt } ] client-audiobookshelf: items: [ { key: clientSecret, path: client_secret.txt } ] client-grafana: items: [ { key: clientSecret, path: client_secret.txt } ] client-netbird: items: [ { key: clientSecret, path: client_secret.txt } ]