first commit

2025-05-29 21:55:04 +02:00
parent 3884a9f9e9
commit a4c2dca44e
70 changed files with 3373 additions and 0 deletions
@@ -0,0 +1,23 @@
+# Basic Authelia Config
+# Send a subsequent request to Authelia to verify if the user is authenticated
+# and has the right permissions to access the resource.
+auth_request /authelia;
+# Set the `target_url` variable based on the request. It will be used to build the portal
+# URL with the correct redirection parameter.
+auth_request_set $target_url $scheme://$http_host$request_uri;
+# Set the X-Forwarded-User and X-Forwarded-Groups with the headers
+# returned by Authelia for the backends which can consume them.
+# This is not safe, as the backend must make sure that they come from the
+# proxy. In the future, it's gonna be safe to just use OAuth.
+auth_request_set $user $upstream_http_remote_user;
+auth_request_set $groups $upstream_http_remote_groups;
+auth_request_set $name $upstream_http_remote_name;
+auth_request_set $email $upstream_http_remote_email;
+proxy_set_header Remote-User $user;
+proxy_set_header Remote-Groups $groups;
+proxy_set_header Remote-Name $name;
+proxy_set_header Remote-Email $email;
+# If Authelia returns 401, then nginx redirects the user to the login portal.
+# If it returns 200, then the request pass through to the backend.
+# For other type of errors, nginx will handle them as usual.
+error_page 401 =302 https://authelia.czech-tv.cz/?rd=$target_url;
@@ -0,0 +1,38 @@
+# Virtual endpoint created by nginx to forward auth requests.
+location /authelia {
+    internal;
+    set $upstream_authelia https://127.0.0.1:9091/api/verify;
+    proxy_pass_request_body off;
+    proxy_pass $upstream_authelia;
+    proxy_set_header Content-Length "";
+
+    # Timeout if the real server is dead
+    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
+
+    # [REQUIRED] Needed by Authelia to check authorizations of the resource.
+    # Provide either X-Original-URL and X-Forwarded-Proto or
+    # X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-Uri or both.
+    # Those headers will be used by Authelia to deduce the target url of the     user.
+    # Basic Proxy Config
+    client_body_buffer_size 128k;
+    proxy_set_header Host $host;
+    proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Host $http_host;
+    proxy_set_header X-Forwarded-Uri $request_uri;
+    proxy_set_header X-Forwarded-Ssl on;
+    proxy_redirect  http://  $scheme://;
+    proxy_http_version 1.1;
+    proxy_set_header Connection "";
+    proxy_cache_bypass $cookie_session;
+    proxy_no_cache $cookie_session;
+    proxy_buffers 4 32k;
+
+    # Advanced Proxy Config
+    send_timeout 5m;
+    proxy_read_timeout 240;
+    proxy_send_timeout 240;
+    proxy_connect_timeout 240;
+}
@@ -0,0 +1,53 @@
+server {
+    server_name authelia.czech-tv.cz;
+    listen 80;
+    return 301 https://$server_name$request_uri;
+}
+
+server {
+    server_name authelia.czech-tv.cz;
+    listen 443 ssl http2;
+
+
+    ssl_certificate /etc/nginx/cert/CT.crt;
+    ssl_certificate_key /etc/nginx/cert/CT.key;
+
+    location / {
+        set $upstream_authelia https://127.0.0.1:9091;
+        proxy_pass $upstream_authelia;
+
+        client_body_buffer_size 128k;
+
+        #Timeout if the real server is dead
+        proxy_next_upstream error timeout invalid_header http_500 http_502     http_503;
+
+        # Advanced Proxy Config
+        send_timeout 5m;
+        proxy_read_timeout 360;
+        proxy_send_timeout 360;
+        proxy_connect_timeout 360;
+
+        # Basic Proxy Config
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Uri $request_uri;
+        proxy_set_header X-Forwarded-Ssl on;
+        proxy_redirect  http://  $scheme://;
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
+        proxy_cache_bypass $cookie_session;
+        proxy_no_cache $cookie_session;
+        proxy_buffers 64 256k;
+
+        # If behind reverse proxy, forwards the correct IP
+        set_real_ip_from 10.0.0.0/8;
+        set_real_ip_from 172.0.0.0/8;
+        set_real_ip_from 192.168.0.0/16;
+        set_real_ip_from fc00::/7;
+        real_ip_header X-Forwarded-For;
+        real_ip_recursive on;
+    }
+}
@@ -0,0 +1,130 @@
+---
+theme: dark
+jwt_secret: tHJQyNgBaULdQDQEAMFeduKa
+default_redirection_url: https://ceskatelevize.cz/
+default_2fa_method: "totp"
+server:
+  host: 0.0.0.0
+#  port: 9091
+  port: 443
+  tls:
+    key: "/home/ct/CT.key"
+    certificate: "/home/ct/CT.pem"
+    client_certificates: []
+log:
+  level: info
+  file_path: /var/log/authelia.log
+telemetry:
+  metrics:
+    enabled: true
+    address: tcp://172.30.29.119:9902
+totp:
+  disable: false
+  issuer: authelia.com
+  algorithm: sha1
+  digits: 6
+  period: 30
+  skew: 1
+  secret_size: 32
+webauthn:
+  disable: false
+  timeout: 60s
+  display_name: Authelia
+  attestation_conveyance_preference: indirect
+  user_verification: preferred
+ntp:
+  address: "time.czech-tv.cz:123"
+  version: 4
+  max_desync: 3s
+  disable_startup_check: false
+  disable_failure: false
+authentication_backend:
+  password_reset:
+    disable: true
+  refresh_interval: 5m
+  ldap:
+    implementation: custom
+    url: ldap://ct.czech-tv.cz
+    timeout: 5s
+    start_tls: false
+    base_dn: DC=ct,DC=czech-tv,DC=cz
+    username_attribute: sAMAccountName
+    users_filter: (&({username_attribute}={input})(objectClass=person))
+    groups_filter: (&(member={dn})(objectClass=groupOfNames))
+    group_name_attribute: cn
+    mail_attribute: mail
+    display_name_attribute: displayName
+    user: "CN=Ldap ADReader,OU=ServisniUzivatele,OU=Admins,DC=ct,DC=czech-tv,DC=cz"
+    password: Buchtickyses0do
+password_policy:
+  standard:
+    enabled: false
+    min_length: 8
+    max_length: 0
+    require_uppercase: true
+    require_lowercase: true
+    require_number: true
+    require_special: true
+  zxcvbn:
+    enabled: false
+    min_score: 3
+access_control:
+  default_policy: deny
+  rules:
+  - domain: 'authelia.czech-tv.cz'
+    policy: bypass
+  - domain:
+      - 'ctcloud1.czech-tv.cz'
+    policy: two_factor
+  - domain:
+      - 'secure.czech-tv.cz'
+    policy: two_factor
+  - domain:
+      - 'ctcloud2.czech-tv.cz'
+    policy: two_factor
+  - domain:
+      - 'zabbix.czech-tv.cz'
+    policy: two_factor
+  - domain:
+      - 'public.czech-tv.cz'
+    policy: one_factor
+  - domain:
+      - 'ctclouduit.czech-tv.cz'
+    policy: two_factor
+  - domain:
+      - 'pha-mail1.ct.czech-tv.cz'
+    policy: two_factor
+
+session:
+  name: authelia_session
+  domain: czech-tv.cz
+  same_site: lax
+  secret: dCdvLKWytdP66qqHpycVk6TuGK5m
+  expiration: 1h
+  inactivity: 1m
+  remember_me_duration: 1M
+
+regulation:
+  max_retries: 3
+  find_time: 2m
+  ban_time: 10m
+
+storage:
+  encryption_key: dCdvLKWytdP66qqHpycVk6TuGK5m
+  mysql:
+    host: 172.30.29.119
+    port: 3306
+    database: authelia
+    username: authelia
+    password: sojka123
+    timeout: 5s
+
+notifier:
+  disable_startup_check: false
+  smtp:
+    host: mail.czech-tv.cz
+    port: 25
+    sender: "Authelia <authelia@czech-tv.cz>"
+    subject: "[Authelia] {title}"
+    disable_require_tls: true
+...
@@ -0,0 +1,50 @@
+server {
+    listen 443;
+    server_name ctclouduit.czech-tv.cz;
+
+    ssl on;
+    ssl_session_cache  builtin:1000  shared:SSL:10m;
+    ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
+
+    client_max_body_size 10240M;
+
+    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
+    ssl_prefer_server_ciphers on;
+
+
+    ssl_certificate /etc/nginx/cert/CT.crt;
+    ssl_certificate_key /etc/nginx/cert/CT.key;
+
+    access_log  /var/log/nginx/ctclouduit_access.log;
+    error_log   /var/log/nginx/ctclouduit_error.log;
+
+    include snippets/authelia.conf; # Authelia auth endpoint
+
+    location / {
+            proxy_pass https://172.30.26.252;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+            include snippets/auth.conf; # Protect this endpoint
+        proxy_http_version 1.1;
+    }
+
+
+}
+
+
+server {
+    if ($host = ctclouduit.czech-tv.cz) {
+        return 301 https://$host$request_uri;
+    }
+
+
+
+listen 80;
+
+server_name ctclouduit.czech-tv.cz;
+    return 404;
+
+
+}