#traefik docker-compose
version: '3'

services:
        traefik:
                image: traefik:v2.4.5
                container_name: traefik
                restart: unless-stopped
                security_opt:
                        - no-new-privileges:true
                networks:
                        - t2_proxy
                ports:
                        - 80:80
                        - 443:443
                volumes:
                        - /etc/localtime:/etc/localtime:ro
                        - /var/run/docker.sock:/var/run/docker.sock:ro
                        - ./data/usersfile:/usersfile:ro
                        - ./data/traefik.yml:/traefik.yml:ro
                        - ./data/acme.json:/acme.json
                        - /var/log:/var/log

                labels:
                        - "traefik.enable=true"
                        - "traefik.http.routers.traefik.entrypoints=web"
                        - "traefik.http.routers.traefik-secure.entrypoints=websecure"
                        - "traefik.http.routers.traefik-secure.tls.certresolver=http"
                          #Authelia forward auth
                        - "traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://example.com/#/"
                        - "traefik.http.middlewares.authelia.forwardauth.trustforwardheader=true"
                        - "traefik.http.middlewares.authelia.forwardauth.authresponseheaders=Remote-User, Remote-Groups"

                          #Use authelia to authenticate
                        - "traefik.http.routers.traefik-secure.middlewares=authelia@docker"
                          #- "traefik.http.routers.traefik.middlewares=authelia@docker"

                          #Dashboard disabled
                        - "traefik.http.routers.traefik-secure.service=api@internal"
                        - "traefik.http.routers.traefik-secure.rule=Host(`example.com`) && (PathPrefix(`/traefik/api`) || PathPrefix(`/traefik/dashboard`))"
                        - "traefik.http.middlewares.traefik-stripprefix.stripprefix.prefixes=/traefik"
                        - "traefik.http.middlewares.traefik-stripprefix.stripprefix.forceSlash=false"
                        - "traefik.http.routers.traefik-secure.middlewares=authelia@docker,traefik-stripprefix"
                          #
                          #No longer needed configurations
                          #- "traefik.http.middlewares.traefik-auth.basicauth.usersfile=usersfile"
                          #- "traefik.http.routers.traefik-secure.tls=true" no longer needed, static config


networks:
        t2_proxy:
                external: true

#traefik config

api:
        dashboard: true

entryPoints:
        web:
                address: ":80"
                http:
                        redirections:
                                entrypoint:
                                        to: websecure
                                        scheme: https
        websecure:
                address: ":443"
                http:
                        tls: {}

providers:
        docker:
                endpoint: "unix:///var/run/docker.sock"
                exposedByDefault: false
        file:
                directory: "rules/"

certificatesResolvers:
        http:
                acme:
                        email: [email protected]
                        storage: acme.json
                        httpChallenge:
                                entrypoint: web

log:
        filePath: "/var/log/traefik.log"
        level: WARN
accessLog:
        filePath: "var/log/access.log"
        filters:
                statusCodes:
                        - "400-499"
                retryAttempts: true


#authelia docker-compose
version: "2.4"

services:
        authelia:
                image: authelia/authelia:4.21.0
                container_name: authelia
                environment:
                        - TZ=America/Chicago
                volumes:
                        - ./authelia:/config
                        - ./authelia/secrets:/config/secrets:ro
                restart: unless-stopped
                networks:
                        - t2_proxy
                environment:
                        - AUTHELIA_JWT_SECRET_FILE=/config/secrets/jwt
                        - AUTHELIA_SESSION_SECRET_FILE=/config/secrets/session
                        - AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE=/config/secrets/email
                labels:
                        - "traefik.enable=true"
                        - "traefik.http.routers.authelia-https.rule=Host(`example.com`)"
                        - "traefik.http.routers.authelia-https.entrypoints=websecure"
                        - "traefik.http.routers.authelia-https.tls.certresolver=http"
                        - "traefik.http.routers.authelia-https.service=authelia"
                        - "traefik.http.services.authelia.loadbalancer.server.port=9091"


networks:
        t2_proxy:
                external: true

#authelia config
host: 0.0.0.0
port: 9091
log_level: trace
#jwt_secret:
default_redirection_url: https://example.com/filebot/

### TOTP Settings
totp:
        issuer: example.com
        period: 30
        skew: 1

authentication_backend:
        disable_reset_password: false
        file:
                path: /config/users_database.yml
                password:
                        algorithm: argon2id
                        iterations: 1
                        key_length: 32
                        salt_length: 16
                        memory: 512
                        parallelism: 8

access_control:
        default_policy: deny
        rules:
                #                - domain:
                #       - example.com
                #       - "*.example.com"
                #  policy: bypass
                #  networks:
                #          - 192.168.0.0/16
                #          - 172.16.0.0/12
                #          - 10.0.0.0/8
                - domain:
                        - example.com
                        - "*.example.com"
                  policy: two_factor
                  #server:
                  #        path: authelia

session:
        name: authelia_session
        #  secret:
        expiration: 1h
        inactivity: 5m
        remember_me_duration: 1M
        domain: example.com
regulation:
        max_retries: 3
        find_time: 2m
        ban_time: 1h

storage:
        local:
                path: /config/db.sqlite3
notifier:
        disable_startup_check: false
        smtp:
                username: [email protected]
                #password:  set in environment
                host: smtp.office365.com
                port: 587
                sender: [email protected]
                subject: "[Authelia] {Login Setup}"