###############################################################
#                   Authelia configuration                    #
###############################################################
host: 0.0.0.0
port: 9091

log:
  level: info

theme: dark

jwt_secret: {JWT_SECRET}

default_redirection_url: https://app.{DOMAIN}/

totp:
  issuer: nextworkspace

access_control:
  default_policy: deny
  rules:
    # Auth and public pages — no auth required
    - domain: "auth.{DOMAIN}"
      policy: bypass
    - domain: "www.{DOMAIN}"
      policy: bypass

    # Admin panel — admins only
    - domain: "app.{DOMAIN}"
      resources:
        - "^/config(/.*)?$"
      subject:
        - "group:admins"
      policy: one_factor

    # Everything else — any authenticated user
    - domain: "app.{DOMAIN}"
      policy: one_factor

authentication_backend:
  file:
    path: /config/users_database.yml

session:
  name: nextworkspace_session
  secret: {SESSION_SECRET}
  domain: {DOMAIN}
  same_site: lax
  expiration: 1h
  inactivity: 5m
  remember_me_duration: 1M

regulation:
  max_retries: 5
  find_time: 2m
  ban_time: 5m

storage:
  encryption_key: {STORAGE_ENCRYPTION_KEY}
  local:
    path: /data/db.sqlite

notifier:
  smtp:
    host: "{SMTP_HOST}"
    port: {SMTP_PORT}
    username: "{SMTP_USER}"
    password: "{SMTP_PASS}"
    sender: "{SMTP_USER}"
    subject: "NextWorkspace - {DOMAIN}"
    disable_require_tls: false
    disable_starttls: false
    tls:
      skip_verify: false