# yamllint disable rule:comments-indentation

---

###############################################################################

# Authelia Configuration #

###############################################################################

## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to

## the system certificates store.

## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem.

# certificates_directory: /config/certificates

## The theme to display: light, dark, grey, auto.

theme: light

## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be

## set using a secret: https://www.authelia.com/docs/configuration/secrets.html

jwt_secret: a_very_important_secret

## Default redirection URL

##

## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end

## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use

## in such a case.

##

## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.

default_redirection_url: https://home.example.com/

##

## Server Configuration

##

server:

## The address to listen on.

host: 0.0.0.0

## The port to listen on.

port: 9091

## Set the single level path Authelia listens on.

## Must be alphanumeric chars and should not contain any slashes.

path: ""

## Buffers usually should be configured to be the same value.

## Explanation at https://www.authelia.com/docs/configuration/server.html

## Read buffer size adjusts the server's max incoming request size in bytes.

## Write buffer size does the same for outgoing responses.

read_buffer_size: 4096

write_buffer_size: 4096

## Enables the pprof endpoint.

enable_pprof: false

## Enables the expvars endpoint.

enable_expvars: false

## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0.

## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist.

disable_healthcheck: false

## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour.

tls:

## The path to the DER base64/PEM format private key.

key: ""

## The path to the DER base64/PEM format public certificate.

certificate: ""

##

## Log Configuration

##

log:

## Level of verbosity for logs: info, debug, trace.

level: debug

## Format the logs are written as: json, text.

# format: json

## File path where the logs will be written. If not set logs are written to stdout.

# file_path: /config/authelia.log

## Whether to also log to stdout when a log_file_path is defined.

# keep_stdout: false

##

## TOTP Configuration

##

## Parameters used for TOTP generation.

totp:

## The issuer name displayed in the Authenticator application of your choice

## See: https://github.com/google/google-authenticator/wiki/Key-Uri-Format for more info on issuer names

issuer: authelia.com

## The period in seconds a one-time password is current for. Changing this will require all users to register

## their TOTP applications again. Warning: before changing period read the docs link below.

period: 30

## The skew controls number of one-time passwords either side of the current one that are valid.

## Warning: before changing skew read the docs link below.

skew: 1

## See: https://www.authelia.com/docs/configuration/one-time-password.html#period-and-skew to read the documentation.

##

## Duo Push API Configuration

##

## Parameters used to contact the Duo API. Those are generated when you protect an application of type

## "Partner Auth API" in the management panel.

duo_api:

hostname: api-123456789.example.com

integration_key: ABCDEF

## Secret can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html

secret_key: 1234567890abcdefghifjkl

##

## NTP Configuration

##

## This is used to validate the servers time is accurate enough to validate TOTP.

ntp:

## NTP server address.

address: "time.cloudflare.com:123"

## NTP version.

version: 4

## Maximum allowed time offset between the host and the NTP server.

max_desync: 3s

## Disables the NTP check on startup entirely. This means Authelia will not contact a remote service at all if you

## set this to true, and can operate in a truly offline mode.

disable_startup_check: false

## The default of false will prevent startup only if we can contact the NTP server and the time is out of sync with

## the NTP server more than the configured max_desync. If you set this to true, an error will be logged but startup

## will continue regardless of results.

disable_failure: false

##

## Authentication Backend Provider Configuration

##

## Used for verifying user passwords and retrieve information such as email address and groups users belong to.

##

## The available providers are: `file`, `ldap`. You must use only one of these providers.

authentication_backend:

## Disable both the HTML element and the API for reset password functionality.

disable_reset_password: false

## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation.

## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will

## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.

## To force update on every request you can set this to '0' or 'always', this will increase processor demand.

## See the below documentation for more information.

## Duration Notation docs: https://www.authelia.com/docs/configuration/index.html#duration-notation-format

## Refresh Interval docs: https://www.authelia.com/docs/configuration/authentication/ldap.html#refresh-interval

refresh_interval: 5m

##

## LDAP (Authentication Provider)

##

## This is the recommended Authentication Provider in production

## because it allows Authelia to offload the stateful operations

## onto the LDAP service.

ldap:

## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.

## Acceptable options are as follows:

## - 'activedirectory' - For Microsoft Active Directory.

## - 'custom' - For custom specifications of attributes and filters.

## This currently defaults to 'custom' to maintain existing behaviour.

##

## Depending on the option here certain other values in this section have a default value, notably all of the

## attribute mappings have a default value that this config overrides, you can read more about these default values

## at https://www.authelia.com/docs/configuration/authentication/ldap.html#defaults

implementation: custom

## The url to the ldap server. Format: <scheme>://<address>[:<port>].

## Scheme can be ldap or ldaps in the format (port optional).

url: ldap://127.0.0.1

## The dial timeout for LDAP.

timeout: 5s

## Use StartTLS with the LDAP connection.

start_tls: false

tls:

## Server Name for certificate validation (in case it's not set correctly in the URL).

# server_name: ldap.example.com

## Skip verifying the server certificate (to allow a self-signed certificate).

## In preference to setting this we strongly recommend you add the public portion of the certificate to the

## certificates directory which is defined by the `certificates_directory` option at the top of the config.

skip_verify: false

## Minimum TLS version for either Secure LDAP or LDAP StartTLS.

minimum_version: TLS1.2

## The distinguished name of the container searched for objects in the directory information tree.

## See also: additional_users_dn, additional_groups_dn.

base_dn: dc=example,dc=com

## The attribute holding the username of the user. This attribute is used to populate the username in the session

## information. It was introduced due to #561 to handle case insensitive search queries. For you information,

## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this

## attribute holds the unique identifiers for the users binding the user and the configuration stored in database.

## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user

## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also

## be used but we don't recommend using them, we instead advise to use the attributes mentioned above

## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt.

# username_attribute: uid

## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users.

## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users.

additional_users_dn: ou=users

## The users filter used in search queries to find the user profile based on input filled in login form.

## Various placeholders are available in the user filter which you can read about in the documentation which can

## be found at: https://www.authelia.com/docs/configuration/authentication/ldap.html#users-filter-replacements

##

## Recommended settings are as follows:

## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))

## - OpenLDAP:

## - (&({username_attribute}={input})(objectClass=person))

## - (&({username_attribute}={input})(objectClass=inetOrgPerson))

##

## To allow sign in both with username and email, one can use a filter like

## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))

users_filter: (&({username_attribute}={input})(objectClass=person))

## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups.

## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups.

additional_groups_dn: ou=groups

## The groups filter used in search queries to find the groups based on relevant authenticated user.

## Various placeholders are available in the groups filter which you can read about in the documentation which can

## be found at: https://www.authelia.com/docs/configuration/authentication/ldap.html#groups-filter-replacements

##

## If your groups use the `groupOfUniqueNames` structure use this instead:

## (&(uniqueMember={dn})(objectClass=groupOfUniqueNames))

groups_filter: (&(member={dn})(objectClass=groupOfNames))

## The attribute holding the name of the group.

# group_name_attribute: cn

## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the

## first one returned by the LDAP server is used.

# mail_attribute: mail

## The attribute holding the display name of the user. This will be used to greet an authenticated user.

# display_name_attribute: displayName

## The username and password of the admin user.

user: cn=admin,dc=example,dc=com

## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html

password: password

##

## File (Authentication Provider)

##

## With this backend, the users database is stored in a file which is updated when users reset their passwords.

## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia

## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security

## implications it is highly recommended you leave the default values. Before considering changing these settings

## please read the docs page below:

## https://www.authelia.com/docs/configuration/authentication/file.html#password-hash-algorithm-tuning

##

## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html

##

# file:

# path: /config/users_database.yml

# password:

# algorithm: argon2id

# iterations: 1

# key_length: 32

# salt_length: 16

# memory: 1024

# parallelism: 8

##

## Access Control Configuration

##

## Access control is a list of rules defining the authorizations applied for one resource to users or group of users.

##

## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed

## to anyone. Otherwise restrictions follow the rules defined.

##

## Note: One can use the wildcard * to match any subdomain.

## It must stand at the beginning of the pattern. (example: *.mydomain.com)

##

## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct.

##

## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'.

##

## - 'domain' defines which domain or set of domains the rule applies to.

##

## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not

## provided. If provided, the parameter represents either a user or a group. It should be of the form

## 'user:<username>' or 'group:<groupname>'.

##

## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'.

##

## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter

## is optional and matches any resource if not provided.

##

## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies.

access_control:

## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any

## resource if there is no policy to be applied to the user.

default_policy: deny

networks:

- name: internal

networks:

- 10.10.0.0/16

- 192.168.2.0/24

- name: VPN

networks: 10.9.0.0/16

rules:

## Rules applied to everyone

- domain: public.example.com

policy: bypass

- domain: secure.example.com

policy: one_factor

## Network based rule, if not provided any network matches.

networks:

- internal

- VPN

- 192.168.1.0/24

- 10.0.0.1

- domain:

- secure.example.com

- private.example.com

policy: two_factor

- domain: singlefactor.example.com

policy: one_factor

## Rules applied to 'admins' group

- domain: "mx2.mail.example.com"

subject: "group:admins"

policy: deny

- domain: "*.example.com"

subject:

- "group:admins"

- "group:moderators"

policy: two_factor

## Rules applied to 'dev' group

- domain: dev.example.com

resources:

- "^/groups/dev/.*$"

subject: "group:dev"

policy: two_factor

## Rules applied to user 'john'

- domain: dev.example.com

resources:

- "^/users/john/.*$"

subject: "user:john"

policy: two_factor

## Rules applied to user 'harry'

- domain: dev.example.com

resources:

- "^/users/harry/.*$"

subject: "user:harry"

policy: two_factor

## Rules applied to user 'bob'

- domain: "*.mail.example.com"

subject: "user:bob"

policy: two_factor

- domain: "dev.example.com"

resources:

- "^/users/bob/.*$"

subject: "user:bob"

policy: two_factor

##

## Session Provider Configuration

##

## The session cookies identify the user once logged in.

## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined.

session:

## The name of the session cookie.

name: authelia_session

## The domain to protect.

## Note: the authenticator must also be in that domain.

## If empty, the cookie is restricted to the subdomain of the issuer.

domain: example.com

## Sets the Cookie SameSite value. Possible options are none, lax, or strict.

## Please read https://www.authelia.com/docs/configuration/session.html#same_site

same_site: lax

## The secret to encrypt the session data. This is only used with Redis / Redis Sentinel.

## Secret can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html

secret: insecure_session_secret

## The value for expiration, inactivity, and remember_me_duration are in seconds or the duration notation format.

## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format

## All three of these values affect the cookie/session validity period. Longer periods are considered less secure

## because a stolen cookie will last longer giving attackers more time to spy or attack.

## The time before the cookie expires and the session is destroyed if remember me IS NOT selected.

expiration: 1h

## The inactivity time before the session is reset. If expiration is set to 1h, and this is set to 5m, if the user

## does not select the remember me option their session will get destroyed after 1h, or after 5m since the last time

## Authelia detected user activity.

inactivity: 5m

## The time before the cookie expires and the session is destroyed if remember me IS selected.

## Value of 0 disables remember me.

remember_me_duration: 1M

##

## Redis Provider

##

## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html

##

redis:

host: 127.0.0.1

port: 6379

## Use a unix socket instead

# host: /var/run/redis/redis.sock

## Username used for redis authentication. This is optional and a new feature in redis 6.0.

# username: authelia

## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html

password: authelia

## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).

database_index: 0

## The maximum number of concurrent active connections to Redis.

maximum_active_connections: 8

## The target number of idle connections to have open ready for work. Useful when opening connections is slow.

minimum_idle_connections: 0

## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s).

# tls:

## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).

# server_name: myredis.example.com

## Skip verifying the server certificate (to allow a self-signed certificate).

## In preference to setting this we strongly recommend you add the public portion of the certificate to the

## certificates directory which is defined by the `certificates_directory` option at the top of the config.

# skip_verify: false

## Minimum TLS version for the connection.

# minimum_version: TLS1.2

## The Redis HA configuration options.

## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).

# high_availability:

## Sentinel Name / Master Name.

# sentinel_name: mysentinel

## Specific password for Redis Sentinel. The node username and password is configured above.

# sentinel_password: sentinel_specific_pass

## The additional nodes to pre-seed the redis provider with (for sentinel).

## If the host in the above section is defined, it will be combined with this list to connect to sentinel.

## For high availability to be used you must have either defined; the host above or at least one node below.

# nodes:

# - host: sentinel-node1

# port: 6379

# - host: sentinel-node2

# port: 6379

## Choose the host with the lowest latency.

# route_by_latency: false

## Choose the host randomly.

# route_randomly: false

##

## Regulation Configuration

##

## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are made

## in a short period of time.

regulation:

## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.

max_retries: 3

## The time range during which the user can attempt login before being banned. The user is banned if the

## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.

## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format

find_time: 2m

## The length of time before a banned user can login again. Ban Time accepts duration notation.

## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format

ban_time: 5m

##

## Storage Provider Configuration

##

## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.

storage:

##

## Local (Storage Provider)

##

## This stores the data in a SQLite3 Database.

## This is only recommended for lightweight non-stateful installations.

##

## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html

##

# local:

# path: /config/db.sqlite3

##

## MySQL / MariaDB (Storage Provider)

##

mysql:

host: 127.0.0.1

port: 3306

database: authelia

username: authelia

## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html

password: mypassword

timeout: 5s

##

## PostgreSQL (Storage Provider)

##

# postgres:

# host: 127.0.0.1

# port: 5432

# database: authelia

# username: authelia

# ## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html

# password: mypassword

# timeout: 5s

# sslmode: disable

##

## Notification Provider

##

## Notifications are sent to users when they require a password reset, a U2F registration or a TOTP registration.

## The available providers are: filesystem, smtp. You must use only one of these providers.

notifier:

## You can disable the notifier startup check by setting this to true.

disable_startup_check: false

##

## File System (Notification Provider)

##

## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html

##

# filesystem:

# filename: /config/notification.txt

##

## SMTP (Notification Provider)

##

## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate.

## [Security] By default Authelia will:

## - force all SMTP connections over TLS including unauthenticated connections

## - use the disable_require_tls boolean value to disable this requirement

## (only works for unauthenticated connections)

## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates

## (configure in tls section)

smtp:

## The SMTP host to connect to.

host: 127.0.0.1

## The port to connect to the SMTP host on.

port: 1025

## The connection timeout.

timeout: 5s

## The username used for SMTP authentication.

username: test

## The password used for SMTP authentication.

## Can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html

password: password

## The address to send the email FROM.

sender: admin@example.com

## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost.

identifier: localhost

## Subject configuration of the emails sent. {title} is replaced by the text from the notifier.

subject: "[Authelia] {title}"

## This address is used during the startup check to verify the email configuration is correct.

## It's not important what it is except if your email server only allows local delivery.

startup_check_address: test@authelia.com

## By default we require some form of TLS. This disables this check though is not advised.

disable_require_tls: false

## Disables sending HTML formatted emails.

disable_html_emails: false

tls:

## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).

# server_name: smtp.example.com

## Skip verifying the server certificate (to allow a self-signed certificate).

## In preference to setting this we strongly recommend you add the public portion of the certificate to the

## certificates directory which is defined by the `certificates_directory` option at the top of the config.

skip_verify: false

## Minimum TLS version for either StartTLS or SMTPS.

minimum_version: TLS1.2

##

## Identity Providers

##

# identity_providers:

##

## OpenID Connect (Identity Provider)

##

## It's recommended you read the documentation before configuration of this section:

## https://www.authelia.com/docs/configuration/identity-providers/oidc.html

# oidc:

## The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens).

## HMAC Secret can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html

# hmac_secret: this_is_a_secret_abc123abc123abc

## The issuer_private_key is used to sign the JWT forged by OpenID Connect.

## Issuer Private Key can also be set using a secret: https://docs.authelia.com/configuration/secrets.html

# issuer_private_key: |

# --- KEY START

# --- KEY END

## The lifespans configure the expiration for these token types.

# access_token_lifespan: 1h

# authorize_code_lifespan: 1m

# id_token_lifespan: 1h

# refresh_token_lifespan: 90m

## Enables additional debug messages.

# enable_client_debug_messages: false

## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for

## security reasons.

# minimum_parameter_entropy: 8

## Clients is a list of known clients and their configuration.

# clients:

# -

## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.

# id: myapp

## The description to show to users when they end up on the consent screen. Defaults to the ID above.

# description: My Application

## The client secret is a shared secret between Authelia and the consumer of this client.

# secret: this_is_a_secret

## Sets the client to public. This should typically not be set, please see the documentation for usage.

# public: false

## The policy to require for this client; one_factor or two_factor.

# authorization_policy: two_factor

## Audience this client is allowed to request.

# audience: []

## Scopes this client is allowed to request.

# scopes:

# - openid

# - groups

# - email

# - profile

## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.

# redirect_uris:

# - https://oidc.example.com:8080/oauth2/callback

## Grant Types configures which grants this client can obtain.

## It's not recommended to define this unless you know what you're doing.

# grant_types:

# - refresh_token

# - authorization_code

## Response Types configures which responses this client can be sent.

## It's not recommended to define this unless you know what you're doing.

# response_types:

# - code

## Response Modes configures which response modes this client supports.

# response_modes:

# - form_post

# - query

# - fragment

## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.

# userinfo_signing_algorithm: none

...