Authelia setup

Mostly adapted from here and the files provided: https://www.youtube.com/watch?v=4UKOh3ssQSU

Video is a tad dated but very informative, see comments and follow-up video as well

===============
compose:
This can definitely be cleaned up a bit but oh well
- "caddy" referenced here is just the docker network most of my services use, probably should've called it caddy_net or something better but oh well
- I ran into a funky issue where Authelia was "working" but throwing a ton of errors and occasional 502's. Turns out my previous venture with Authentik left some redis files lying around. Cleaning out any config folders and running "docker system prune -a" resolved that issue. That's also why the db and redis containers are named the way they are, I can probably change those back but whatever
===============
services:
  app:
    container_name: authelia
    image: authelia/authelia:latest
    restart: unless-stopped
    depends_on:
      - auth_db
      - auth_redis
    volumes:
      - ./config:/config
    environment:
      AUTHELIA_JWT_SECRET_FILE: /config/secrets/JWT_SECRET
      AUTHELIA_SESSION_SECRET_FILE: /config/secrets/SESSION_SECRET
      AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE: /config/secrets/SMTP_PASSWORD
      AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: /config/secrets/STORAGE_ENCRYPTION_KEY
      AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE: /config/secrets/STORAGE_PASSWORD
      AUTHELIA_SESSION_REDIS_PASSWORD_FILE: /config/secrets/REDIS_PASSWORD
      AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE: /config/secrets/HMAC_SECRET
    networks:
      - caddy
  auth_db:
    image: docker.io/library/postgres:16-alpine
    restart: unless-stopped
    volumes:
      - ./postgres:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: authelia
      POSTGRES_PASSWORD: POSTGRES_PASSWORD_GOES_HERE
    networks:
      - caddy
  auth_redis:
    image: docker.io/library/redis:alpine
    restart: unless-stopped
    command: redis-server --save 60 1 --loglevel warning --requirepass
      REDIS_PASSWORD_GOES_HERE
    volumes:
      - ./redis:/data
    networks:
      - caddy
networks:
  caddy:
    external: true

=====================================================
config:

# Miscellaneous https://www.authelia.com/configuration/miscellaneous/introduction/
# Set also AUTHELIA_JWT_SECRET_FILE
theme: dark
default_2fa_method: totp

# First Factor https://www.authelia.com/configuration/first-factor/file/
authentication_backend:
  file:
    path: /config/users_database.yml

# Second Factor https://www.authelia.com/configuration/second-factor/introduction/
totp:
  issuer: 'example.com'
  algorithm: 'sha1'
  digits: 6
  period: 30
  skew: 1
  secret_size: 32
  allowed_algorithms:
    - 'SHA1'
  allowed_digits:
    - 6
  allowed_periods:
    - 30
  disable_reuse_security_policy: false

webauthn:
  disable: true

# Security https://www.authelia.com/configuration/security/access-control/
# Set all your subdomain rules here. You can also do global if you want, check the docs
access_control:
  default_policy: 'deny'
  rules:
  - domain: 'sub.example.com'
    policy: 'two_factor'

# Session https://www.authelia.com/configuration/session/introduction/
# Set also AUTHELIA_SESSION_SECRET_FILE
session:
  cookies:
    - domain: 'example.com'
      authelia_url: 'https://auth.example.com'

  # https://www.authelia.com/configuration/session/redis/
  # Set also AUTHELIA_SESSION_REDIS_PASSWORD_FILE if appropriate
  redis:
    host: auth_redis
    port: 6379
    timeout: '5s'
    max_retries: 0
    database_index: 0
    maximum_active_connections: 8
    minimum_idle_connections: 0

# Storage https://www.authelia.com/configuration/storage/postgres/
# Set also AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE
# Set also AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE
storage:
  postgres:
    address: 'tcp://auth_db:5432'
    database: 'authelia'
    username: 'authelia'

# SMTP Notifier https://www.authelia.com/configuration/notifications/smtp/
# Set also AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE
notifier:
  smtp:
    address: 'submissions://yoursmtphost.com:465'
    username: 'user'
    sender: 'Admin <[email protected]>'

# Immich block
# https://www.authelia.com/integration/openid-connect/immich/
identity_providers:
  oidc:
    jwks:
      - key_id: 'authelia'
        algorithm: 'RS256'
        use: 'sig'
        certificate_chain: |
          -----BEGIN CERTIFICATE-----
          paste_contents_here
          -----END CERTIFICATE-----
        key: |
          -----BEGIN PRIVATE KEY-----
          paste_contents_here
          -----END PRIVATE KEY-----
    enable_client_debug_messages: false
    minimum_parameter_entropy: 8
    enforce_pkce: 'public_clients_only'
    enable_pkce_plain_challenge: false
    enable_jwt_access_token_stateless_introspection: false
    discovery_signed_response_alg: 'none'
    discovery_signed_response_key_id: ''
    require_pushed_authorization_requests: false
    lifespans:
      access_token: '1h'
      authorize_code: '1m'
      id_token: '1h'
      refresh_token: '90m'
    cors:
      endpoints:
        - 'authorization'
        - 'token'
        - 'revocation'
        - 'introspection'
      allowed_origins:
        - 'https://photos.example.com'
      allowed_origins_from_client_redirect_uris: false
clients:
      - client_id: immich
        client_name: Immich OIDC
        client_secret: 'secret_goes_here'
        public: false
        authorization_policy: two_factor
        consent_mode: pre-configured
        token_endpoint_auth_method: "client_secret_basic"
        pre_configured_consent_duration: 1w
        scopes:
          - openid
          - groups
          - email
          - profile
        redirect_uris:
          - https://auth.example.com/
          - https://auth.example.com/oauth2/callback
          - https://photos.example.com/oauth2/callback
          - https://photos.example.com/auth/login
          - https://photos.example.com/user-settings
          - https://photos.example.com
          - app.immich:/
          - app.immich:///oauth-callback
          - https://photos.example.com/api/oauth/mobile-redirect
        grant_types:
          - refresh_token
          - authorization_code
        response_types:
          - code
        response_modes:
          - form_post
          - query
          - fragment

=================================

users-database.yml
Most of this is autopopulated and can be set in the UI, just fill in the bare minimum
----

users:
    username:
        password: argon2_pass_goes_here
        displayname: name
        email: [email protected]
        groups:
            - admins
            - dev
        given_name: ""
        middle_name: ""
        family_name: ""
        nickname: ""
        gender: ""
        birthdate: ""
        website: ""
        profile: ""
        picture: ""
        zoneinfo: ""
        locale: ""
        phone_number: ""
        phone_extension: ""
        disabled: false
        address: null
        extra: {}

================================
Caddyfile
Obviously this is only relevant if you use caddy, otherwise refer to the documentation for your reverse proxy
----

#Authelia
(authelia) {
        forward_auth authelia:9091 {
                uri /api/verify?rd=https://auth.example.com
                copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
        }
}

auth.example.com {
        # Any other imports/shenanigans here
        reverse_proxy authelia:9091
}

sub.example.com {
        import authelia
        # Any other imports/shenanigans here
        reverse_proxy otherservice:8080
}