jack
aa9706bbc4
Traefik: - Enable access logs → /var/log/traefik/access.log (needed for CrowdSec) - Add global security headers middleware: HSTS, X-Frame-Options, CSP, nosniff, XSS filter, referrer policy, permissions policy - Add rate limiting: default 100/s, API 30/s, admin 10/s (strict) - Add Authelia ForwardAuth middleware for SSO integration CrowdSec (new service): - Analyzes Traefik access logs + auth.log in real time - Community IP reputation blocklist (crowdsecurity/traefik + http-cve) - Firewall bouncer: bans malicious IPs at kernel level (iptables) Authelia (new service, auth.csrx.ru): - 2FA/SSO portal with TOTP (Google Authenticator) - Protects: traefik.csrx.ru, sync.csrx.ru, /god-mode/ in Plane - Session: 12h expiry, 30m inactivity, Redis backend - argon2id password hashing Container security: - Add security_opt: no-new-privileges to traefik, vaultwarden, forgejo, grafana, authelia CI/CD security: - Remove hardcoded server IP 87.249.49.32 from workflow - Use SSH_KNOWN_HOSTS secret instead of ssh-keyscan (prevents MITM) - Added SSH_KNOWN_HOSTS secret to Forgejo Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
77 lines
1.6 KiB
Django/Jinja
77 lines
1.6 KiB
Django/Jinja
# Generated by Ansible — do not edit manually
|
|
# Authelia v4 configuration
|
|
|
|
theme: dark
|
|
|
|
server:
|
|
host: 0.0.0.0
|
|
port: 9091
|
|
|
|
log:
|
|
level: warn
|
|
|
|
jwt_secret: "{{ authelia_jwt_secret }}"
|
|
|
|
default_redirection_url: "https://{{ domain_auth }}"
|
|
|
|
session:
|
|
name: authelia_session
|
|
secret: "{{ authelia_session_secret }}"
|
|
expiration: 12h
|
|
inactivity: 30m
|
|
domain: "{{ domain_base }}"
|
|
redis:
|
|
host: authelia-redis
|
|
port: 6379
|
|
|
|
regulation:
|
|
max_retries: 3
|
|
find_time: 2m
|
|
ban_time: 10m
|
|
|
|
storage:
|
|
encryption_key: "{{ authelia_storage_key }}"
|
|
local:
|
|
path: /config/db.sqlite3
|
|
|
|
notifier:
|
|
disable_startup_check: true
|
|
filesystem:
|
|
filename: /config/notifications.txt
|
|
|
|
authentication_backend:
|
|
password_reset:
|
|
disable: false
|
|
file:
|
|
path: /config/users.yml
|
|
password:
|
|
algorithm: argon2id
|
|
iterations: 3
|
|
memory: 65536
|
|
parallelism: 4
|
|
key_length: 32
|
|
salt_length: 16
|
|
|
|
access_control:
|
|
default_policy: deny
|
|
rules:
|
|
# Authelia portal itself — всегда доступен
|
|
- domain: "{{ domain_auth }}"
|
|
policy: bypass
|
|
|
|
# Traefik dashboard — только admin, требует 2FA
|
|
- domain: "{{ domain_traefik }}"
|
|
policy: two_factor
|
|
subject: "group:admins"
|
|
|
|
# Syncthing — только admin, требует 2FA
|
|
- domain: "{{ domain_sync }}"
|
|
policy: two_factor
|
|
subject: "group:admins"
|
|
|
|
# Plane god-mode — только admin, требует 2FA
|
|
- domain: "{{ domain_plane }}"
|
|
resources:
|
|
- "^/god-mode/.*$"
|
|
policy: two_factor
|
|
subject: "group:admins"
|