feat: integrate Authelia SSO and update LLDAP routing

2026-02-27 23:04:57 +08:00
parent c676c84bc1
commit 29a9e9d881
8 changed files with 146 additions and 17 deletions
@@ -0,0 +1,71 @@
+theme: auto
+default_2fa_method: totp
+
+server:
+  address: 'tcp://0.0.0.0:9092'
+
+log:
+  level: info
+
+totp:
+  issuer: nas.jimmygan.com
+  period: 30
+  skew: 1
+
+webauthn:
+  disable: false
+  display_name: NAS Auth
+  attestation_conveyance_preference: indirect
+  user_verification: preferred
+  timeout: 60s
+
+authentication_backend:
+  ldap:
+    implementation: custom
+    address: 'ldap://localhost:3890'
+    timeout: 5s
+    start_tls: false
+    base_dn: 'dc=jimmygan,dc=com'
+    additional_users_dn: 'ou=people'
+    users_filter: '(&({username_attribute}={input})(objectClass=person))'
+    additional_groups_dn: 'ou=groups'
+    groups_filter: '(member={dn})'
+    user: 'uid=admin,ou=people,dc=jimmygan,dc=com'
+    password: '5jb6+s69t+r+OmZbizEWJA=='
+    attributes:
+      display_name: displayName
+      mail: mail
+      member_of: memberOf
+      group_name: cn
+
+access_control:
+  default_policy: two_factor
+  rules:
+    - domain: ldap.jimmygan.com
+      policy: two_factor
+
+session:
+  secret: jcpCs/bUYjC85jBDLa3jwgZfC4WyIyjS87LsvO2l3jY=
+  expiration: 1h
+  inactivity: 5m
+  remember_me: 1M
+  cookies:
+    - domain: jimmygan.com
+      authelia_url: https://auth.jimmygan.com:8443
+
+storage:
+  encryption_key: RPXltPeEWip9kJRoDRQOcUF3egeVCluOjma1TpeYbeo=
+  local:
+    path: /config/db.sqlite3
+
+notifier:
+  smtp:
+    address: 'smtp://smtp.gmail.com:587'
+    username: 'zjgump@gmail.com'
+    password: 'lkykzvfrubsgvqfv'
+    sender: 'NAS Auth <zjgump@gmail.com>'
+    subject: '[NAS Auth] {title}'
+
+identity_validation:
+  reset_password:
+    jwt_secret: HDty02r/yVwbWavqM+F0ChCgvgWE34XM1mzNFPzOrWY=