Axel Verne → Junk Drawer kit → Chapter 12

Chapter 12 — Fortress III: Network Hygiene

13 blocks to copy, in the order they appear in the chapter. Nothing here is required to be typed by hand.

The mDNS gotcha

12.1 · bash

# On OpenWrt:
opkg install avahi avahi-daemon
# Configure in Luci or SSH to forward mDNS across VLANs

Step 1: Create the Authelia compose

12.2 · bash

mkdir -p /srv/lab/compose/authelia && cd /srv/lab/compose/authelia

12.3 · yaml

services:
  authelia:
    image: authelia/authelia:latest
    container_name: authelia
    ports:
      - "9091:9091"
    environment:
      AUTHELIA_JWT_SECRET: "use-a-long-random-string-here"
      TZ: "Pacific/Honolulu"
    volumes:
      - /srv/lab/data/authelia:/config
      - /srv/lab/data/authelia/users_database.yml:/config/users_database.yml
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    container_name: authelia-redis
    volumes:
      - /srv/lab/data/authelia/redis:/data
    restart: unless-stopped

12.4 · yaml

theme: dark
jwt_secret: "use-a-long-random-string-here"
default_redirection_url: "http://localhost:9091"

server:
  listen: "0.0.0.0:9091"
  disable_healthcheck: false

authentication_backend:
  file:
    path: /config/users_database.yml

session:
  redis:
    host: authelia-redis
    port: 6379
  secret: "use-a-long-random-string-here"

regulation:
  max_retries: 5
  find_time: 10m
  ban_time: 30m

storage:
  encryption_key: "use-a-long-random-string-here"
  local:
    path: /config/db.sqlite3

notifier:
  disable_startup_check: true
  file_path: /config/notification.txt

12.5 · yaml

users:
  mom:
    displayname: "Mom"
    password: "$argon2id$v=19$m=65540,t=3,p=4$hash-here"  # use `docker compose exec authelia authelia crypto hash-password <password>`
    email: "mom@example.com"
    groups:
      - admins
  
  kid:
    displayname: "Kid"
    password: "$argon2id$v=19$m=65540,t=3,p=4$hash-here"
    email: "kid@example.com"
    groups:
      - users

12.6 · bash

docker compose up -d
docker compose exec authelia authelia crypto hash-password mypassword
docker compose down

Step 2: Connect Caddy as a reverse proxy

12.7 · caddy

jellyfin.lab:8096 {
  forward_auth localhost:9091 {
    uri /api/authz/forward-auth
    copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
  }
  reverse_proxy localhost:8096
}

immich.lab:2283 {
  forward_auth localhost:9091 {
    uri /api/authz/forward-auth
    copy_headers Remote-User
  }
  reverse_proxy localhost:2283
}

vaultwarden.lab:8000 {
  reverse_proxy localhost:8000
}

12.8 · bash

docker compose -f /srv/lab/compose/caddy/compose.yaml down
docker compose -f /srv/lab/compose/caddy/compose.yaml up -d

Step 3: Run Authelia (or Authentik)

12.9 · bash

cd /srv/lab/compose/authelia
docker compose up -d
docker compose logs -f     # watch startup

The build — Authentik path (alternative)

12.10 · bash

mkdir -p /srv/lab/compose/authentik && cd /srv/lab/compose/authentik

12.11 · bash

curl -sL https://goauthentik.io/docker-compose.yml > compose.yaml

12.12 · bash

cat > .env << 'EOF'
AUTHENTIK_POSTGRESQL__PASSWORD=choose-a-password
AUTHENTIK_SECRET_KEY=use-a-long-random-string
PG_PASS=choose-a-password
PG_USER=authentik
PG_DB=authentik
EOF

12.13 · bash

docker compose up -d
docker compose logs -f

← Chapter 11Chapter 13 →