Nix Podman Stacks

Appearance

authelia ​

SSO and OIDC provider

NOTE

If you have access_control rules configured, (e.g. when using forwardAuth), it is recommended to change the default_policy to deny:

nix
nps.stacks.authelia.settings.access_control.default_policy = "deny";

Example ​

nix
{config, ...}: {
  nps.stacks.authelia = {
    enable = true;
    jwtSecretFile = config.sops.secrets."authelia/jwt_secret".path;
    sessionSecretFile = config.sops.secrets."authelia/session_secret".path;
    storageEncryptionKeyFile = config.sops.secrets."authelia/encryption_key".path;
    oidc = {
      enable = true;
      hmacSecretFile = config.sops.secrets."authelia/oidc_hmac_secret".path;
      jwksRsaKeyFile = config.sops.secrets."authelia/oidc_rsa_pk".path;
    };
    sessionProvider = "redis";
  };
}

Stack Options ​

nps.stacks.authelia.crowdsec.enableLogCollection ​

Whether the container logs should be collected by CrowdSec. Enabling this will configure the acquis settings for CrowdSec.

Type
plaintext
boolean
Default
nix
config.nps.stacks.crowdsec.enable
Declaration
<nps/modules/authelia>

nps.stacks.authelia.defaultAllowPolicy ​

Default policy to apply for allowed access. Will be used as a default for OIDC Authorization Policies.

See

Type
plaintext
one of "one_factor", "two_factor"
Default
nix
"one_factor"
Declaration
<nps/modules/authelia>

nps.stacks.authelia.enable ​

Whether to enable authelia.

Type
plaintext
boolean
Default
nix
false
Example
nix
true
Declaration
<nps/modules/authelia>

nps.stacks.authelia.enableTraefikMiddleware ​

Wheter to register an authelia middleware for Traefik. The middleware will utilize the ForwardAuth Authz implementation.

See https://www.authelia.com/integration/proxies/traefik/#implementation

Type
plaintext
boolean
Default
nix
config.nps.stacks.traefik.enable
Declaration
<nps/modules/authelia>

nps.stacks.authelia.jwtSecretFile ​

Type
plaintext
absolute path
Declaration
<nps/modules/authelia>

nps.stacks.authelia.ldap.passwordFile ​

The password for the LDAP user that is used when connecting to the LDAP backend.

Type
plaintext
absolute path
Default
nix
config.nps.stacks.lldap.adminPasswordFile
Declaration
<nps/modules/authelia>

nps.stacks.authelia.ldap.username ​

The username that will be used when binding to the LDAP backend.

Type
plaintext
string
Default
nix
config.nps.stacks.lldap.adminUsername
Declaration
<nps/modules/authelia>

nps.stacks.authelia.oidc.clients ​

Type
plaintext
attribute set of (open submodule of (YAML 1.1 value))
Default
nix
{ }
Declaration
<nps/modules/authelia>

nps.stacks.authelia.oidc.clients.<name>.client_id ​

This option has no description.

Type
plaintext
string
Default
nix
"‹name›"
Declaration
<nps/modules/authelia>

nps.stacks.authelia.oidc.clients.<name>.client_secret ​

The client secret hash. For examples on how to generate a client secret, see

https://www.authelia.com/integration/openid-connect/frequently-asked-questions/#client-secret

The value can be passed in multiple ways:

  1. As a literal string
  2. As an absolute path to a file containing the hash (toFile)
  3. As an absolute oath to a file containing the client_secret, in which case the hash will be automatically computed (toHash)
Type
plaintext
null or string or (submodule)
Default
nix
null
Example
nix
# Literal String:
"$pbkdf2-sha512$310000$cbOAIWbfz3vCVXIPIp6d2A$J0klwULa6TvPRCU1HAfuKua/dMKTl8gbTYJz2N73ejGUu0LUGz/y3kwmJLuKuAYGg3WQOT0q9ZzVHHUvpKpgvQ"

# Client secret hash stored in a file
{ fromFile = config.sops.secrets."immich/client_secret_hash".path; }

# Client secret stored in a file: Hash will be computed dynamically
{ toHash = config.sops.secrets."immich/client_secret".path; }
Declaration
<nps/modules/authelia>

nps.stacks.authelia.oidc.defaultConsentDuration ​

Default period of how long a users choice to remember the pre-configured consent lasts. Only has an effect for OIDC clients using the consent_mode pre-configured or auto.

See

Type
plaintext
string
Default
nix
"1 month"
Declaration
<nps/modules/authelia>

nps.stacks.authelia.oidc.enable ​

Whether to enable OIDC Support.

Type
plaintext
boolean
Default
nix
false
Example
nix
true
Declaration
<nps/modules/authelia>

nps.stacks.authelia.oidc.hmacSecretFile ​

Type
plaintext
absolute path
Declaration
<nps/modules/authelia>

nps.stacks.authelia.oidc.jwksRsaKeyFile ​

Path to the file containing the JWKS RSA (RS256) private key.

For example, a keypair can be generated and printed out like this:

sh
podman run --rm authelia/authelia sh -c "authelia crypto certificate rsa generate --common-name authelia.example.com && cat public.crt && cat private.pem"

See https://www.authelia.com/configuration/identity-providers/openid-connect/provider/#key

Type
plaintext
absolute path
Declaration
<nps/modules/authelia>

nps.stacks.authelia.sessionProvider ​

'' Session provider to use.

    See <https://www.authelia.com/configuration/session/introduction/>
  ''
Type
plaintext
one of "memory", "redis"
Default
nix
"memory"
Declaration
<nps/modules/authelia>

nps.stacks.authelia.sessionSecretFile ​

Path to the file containing the session secret. See https://www.authelia.com/configuration/session/introduction/#secret

Type
plaintext
absolute path
Declaration
<nps/modules/authelia>

nps.stacks.authelia.settings ​

Additional Authelia settings. Will be provided in the configuration.yml.

Type
plaintext
YAML 1.1 value
Default
nix
null
Declaration
<nps/modules/authelia>

nps.stacks.authelia.storageEncryptionKeyFile ​

Path to the file containing the storage encryption key. See https://www.authelia.com/configuration/storage/introduction/#encryption_key

Type
plaintext
absolute path
Declaration
<nps/modules/authelia>

Container Extension ​

Authelia adds several container extension options to the existing services.podman.containers.<name> options. These allow you to easily configure forward auth - for example for services that don't offer any built-in authentication.

Example:

nix
{config, ...}: {
  nps.stacks.spliit.containers.spliit = {
    forwardAuth = {
      enable = true;
      rules = [
        {
          # For a full list of available rule options see <https://www.authelia.com/configuration/security/access-control/>
          policy = "two_factor";
        }
      ];
    };
  };
}

services.podman.containers.<name>.forwardAuth.enable ​

Whether to enable forward auth. This will enable the authelia Traefik middleware for this container. Every request will be forwarded to be authorized by Authelia first.

Optionally, access control rules for this container can be specified in the settings. They will be added to the Authelia settings.

See https://www.authelia.com/configuration/security/access-control/

Type
plaintext
boolean
Default
nix
false
Declaration
<nps/modules/authelia/extension.nix>

services.podman.containers.<name>.forwardAuth.middlewareOrder ​

Order of the authelia middleware. Multiple middlewares will be called in order by Traefik, with lower orders being called first.

Type
plaintext
signed integer
Default
nix
1000
Declaration
<nps/modules/authelia/extension.nix>

services.podman.containers.<name>.forwardAuth.rules ​

Rules matching a request. When all criteria of a rule match the request, the defined policy is applied.

See https://www.authelia.com/configuration/security/access-control/#rules

Type
plaintext
list of (submodule)
Default
nix
[ ]
Declaration
<nps/modules/authelia/extension.nix>

services.podman.containers.<name>.forwardAuth.rules.*.domain ​

Domain(s) that will be matched for the rule. Defaults to the servie domain registered in Traefik. Either this, or the domain_regex options has to be set.

See https://www.authelia.com/configuration/security/access-control/#domain

Type
plaintext
list of string
Default
nix
[ containerCfg.traefik.serviceHost ]
Declaration
<nps/modules/authelia/extension.nix>

services.podman.containers.<name>.forwardAuth.rules.*.domain_regex ​

Regex(es) criteria matching the domain. Defaults to the servie domain registered in Traefik. Has to be set if the domain is unset.

See https://www.authelia.com/configuration/security/access-control/#domain_regex

Type
plaintext
list of string
Default
nix
[ ]
Declaration
<nps/modules/authelia/extension.nix>

services.podman.containers.<name>.forwardAuth.rules.*.methods ​

Type
plaintext
list of string
Default
nix
[ ]
Declaration
<nps/modules/authelia/extension.nix>

services.podman.containers.<name>.forwardAuth.rules.*.networks ​

Critera matching the network. Can be a list of IP addresses, CIDR ranges or named network definitions.

See https://www.authelia.com/configuration/security/access-control/#networks

Type
plaintext
list of string
Default
nix
[ ]
Declaration
<nps/modules/authelia/extension.nix>

services.podman.containers.<name>.forwardAuth.rules.*.policy ​

The specific policy to apply to the selected rule. This is not criteria for a match, this is the action to take when a match is made.

See https://www.authelia.com/configuration/security/access-control/#policy

Type
plaintext
one of "", "deny", "bypass", "one_factor", "two_factor"
Default
nix
""
Declaration
<nps/modules/authelia/extension.nix>

services.podman.containers.<name>.forwardAuth.rules.*.resources ​

Critera matching the path and query parameter using regular expressions.

See https://www.authelia.com/configuration/security/access-control/#resources

Type
plaintext
list of string
Default
nix
[ ]
Declaration
<nps/modules/authelia/extension.nix>

services.podman.containers.<name>.forwardAuth.rules.*.subject ​

Type
plaintext
list of (string or list of string)
Default
nix
[ ]
Declaration
<nps/modules/authelia/extension.nix>

services.podman.containers.<name>.forwardAuth.rulesOrder ​

Order of rules when merged into the authelia settings. The order will be applied using lib.mkOrder <order> when applying the rules in the Authelia settings. Lower numbers mean the rules will appear earlier in the access_control.rules list, which give them a higher priority.

See https://www.authelia.com/configuration/security/access-control/#rule-matching-concept-1-sequential-order

Type
plaintext
signed integer
Default
nix
1000
Declaration
<nps/modules/authelia/extension.nix>

Container Aliases ​

nps.stacks.authelia.containers.authelia ​

Alias of {option}services.podman.containers.authelia.

Type
plaintext
submodule
Declaration
<nps/modules/authelia>

nps.stacks.authelia.containers.authelia-redis ​

Alias of {option}services.podman.containers.authelia-redis.

Type
plaintext
submodule
Declaration
<nps/modules/authelia>