#######################################################
# Authelia Configuration — Docker combined container
# =====================================================
# Authelia v4.39.20 format (YAML).
# Mount this file to /config/configuration.yml inside
# the container, or edit the in-container copy.
#
# Reference:
#   https://www.authelia.com/configuration/
#######################################################

# --- Server ---
server:
  address: tcp://0.0.0.0:9091
  tls:
    key: /certs/key.pem          # optional, mount into /certs
    certificate: /certs/cert.pem

# --- Logging ---
log:
  level: info
  format: text

# --- Theme ---
theme: auto

# --- Identity validation (replaces jwt_secret) ---
identity_validation:
  reset_password:
    jwt_secret: change_me_to_a_random_hex_string_at_least_64_chars_long

# --- Default redirect ---
default_redirection_url: https://auth.example.com

# --- TOTP ---
totp:
  issuer: authelia.example.com
  period: 30
  skew: 1

# --- Authentication backend: file-based ---
authentication_backend:
  file:
    path: /config/users_database.yml
    password:
      algorithm: argon2id
      iterations: 1
      salt_length: 16
      parallelism: 8
      memory: 64

# --- Access Control (at least one rule required) ---
access_control:
  default_policy: two_factor
  rules:
    - domain: auth.example.com
      policy: bypass
      resources:
        - "^/api/health$"

# --- Session ---
session:
  name: authelia_session
  secret: change_me_to_a_random_hex_string_at_least_64_chars_long
  expiration: 1h
  inactivity: 5m
  remember_me: 1M
  domain: example.com

# --- Regulation (login rate limiting) ---
regulation:
  max_retries: 5
  find_time: 2m
  ban_time: 5m

# --- Storage: local SQLite ---
storage:
  encryption_key: change_me_to_a_random_hex_string_at_least_64_chars_long
  local:
    path: /config/db.sqlite3

# --- Notifier ---
notifier:
  filesystem:
    filename: /config/notifications.yml

# --- WebAuthn (optional) ---
# webauthn:
#   disable: false
#   display_name: Authelia
#   attestation_conveyance_preference: indirect
#   user_verification: preferred
#   timeout: 60s

# --- OIDC (optional) ---
# identity_providers:
#   oidc:
#     hmac_secret: change_me_to_a_random_hex_string
#     issuers: []