image:
  repository: ghcr.io/authelia/authelia
  pullPolicy: IfNotPresent
  tag: 4.38.8@sha256:19375b10024caeef4e0b119a6247beae84cbaa02c846cfd750e92dea910d4b6a

workload:
  main:
    replicas: 2
    strategy: RollingUpdate
    podSpec:
      containers:
        main:
          command:
            - authelia
          args:
            - --config=/configuration.yaml
          envFrom:
            - configMapRef:
                name: authelia-paths
          probes:
            liveness:
              type: http
              path: "/api/health"
            readiness:
              type: http
              path: "/api/health"
            startup:
              type: http
              path: "/api/health"
service:
  main:
    ports:
      main:
        port: 9091
        targetPort: 9091
persistence:
  config:
    enabled: true
    mountPath: "/config"
cnpg:
  main:
    enabled: true
    user: authelia
    database: authelia
# Enabled redis
# ... for more options see https://github.com/tccr.io/truecharts/charts/tree/master/tccr.io/truecharts/redis
redis:
  enabled: true
  includeCommon: true
domain: example.com
##
## Server Configuration
##
server:
  ##
  ## Port sets the configured port for the daemon, service, and the probes.
  ## Default is 9091 and should not need to be changed.
  ##
  port: 9091
  ## Buffers usually should be configured to be the same value.
  ## Explanation at https://www.authelia.com/docs/configuration/server.html
  ## Read buffer size adjusts the server's max incoming request size in bytes.
  ## Write buffer size does the same for outgoing responses.
  read_buffer_size: 4096
  write_buffer_size: 4096
  ## Set the single level path Authelia listens on.
  ## Must be alphanumeric chars and should not contain any slashes.
  path: ""
log:
  ## Level of verbosity for logs: info, debug, trace.
  level: trace
  ## Format the logs are written as: json, text.
  format: text
  ## TODO: Statefulness check should check if this is set, and the configMap should enable it.
  ## File path where the logs will be written. If not set logs are written to stdout.
  # file_path: /config/authelia.log
## Default redirection URL
##
## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end
## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use
## in such a case.
##
## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
## Default is https://www.<domain> (value at the top of the values.yaml).
default_redirection_url: ""
# default_redirection_url: https://example.com

theme: light
##
## TOTP Configuration
##
## Parameters used for TOTP generation
totp:
  ## The issuer name displayed in the Authenticator application of your choice
  ## See: https://github.com/google/google-authenticator/wiki/Key-Uri-Format for more info on issuer names
  ## Defaults to <domain>.
  issuer: ""
  ## The period in seconds a one-time password is current for. Changing this will require all users to register
  ## their TOTP applications again. Warning: before changing period read the docs link below.
  period: 30
  ## The skew controls number of one-time passwords either side of the current one that are valid.
  ## Warning: before changing skew read the docs link below.
  ## See: https://www.authelia.com/docs/configuration/one-time-password.html#period-and-skew to read the documentation.
  skew: 1
##
## Password Policy Config
##
## Parameters used for Password Policies
password_policy:
  ## See: https://www.authelia.com/configuration/security/password-policy/
  standard:
    enabled: false
    min_length: 8
    max_length: 0
    require_uppercase: false
    require_lowercase: false
    require_number: false
    require_special: false
  zxcvbn:
    ## See https://www.authelia.com/configuration/security/password-policy/#zxcvbn for more info
    enabled: false
    min_score: 3
##
## Duo Push API Configuration
##
## Parameters used to contact the Duo API. Those are generated when you protect an application of type
## "Partner Auth API" in the management panel.
duo_api:
  enabled: false
  hostname: api-123456789.example.com
  integration_key: ABCDEF
  plain_api_key: ""
## NTP settings
ntp:
  address: "time.cloudflare.com:123"
  version: 4
  max_desync: 3s
  disable_startup_check: false
  disable_failure: true
##
## Authentication Backend Provider Configuration
##
## Used for verifying user passwords and retrieve information such as email address and groups users belong to.
##
## The available providers are: `file`, `ldap`. You must use one and only one of these providers.
authentication_backend:
  ## Disable both the HTML element and the API for reset password functionality
  disable_reset_password: false
  ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation.
  ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
  ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
  ## To force update on every request you can set this to '0' or 'always', this will increase processor demand.
  ## See the below documentation for more information.
  ## Duration Notation docs:  https://www.authelia.com/docs/configuration/index.html#duration-notation-format
  ## Refresh Interval docs: https://www.authelia.com/docs/configuration/authentication/ldap.html#refresh-interval
  refresh_interval: 5m
  ## LDAP backend configuration.
  ##
  ## This backend allows Authelia to be scaled to more
  ## than one instance and therefore is recommended for
  ## production.
  ldap:
    ## Enable LDAP Backend.
    enabled: false
    ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
    ## Acceptable options are as follows:
    ## - 'activedirectory' - For Microsoft Active Directory.
    ## - 'custom' - For custom specifications of attributes and filters.
    ## This currently defaults to 'custom' to maintain existing behaviour.
    ##
    ## Depending on the option here certain other values in this section have a default value, notably all of the
    ## attribute mappings have a default value that this config overrides, you can read more about these default values
    ## at https://www.authelia.com/docs/configuration/authentication/ldap.html#defaults
    implementation: activedirectory
    ## The url to the ldap server. Format: <scheme>://<address>[:<port>].
    ## Scheme can be ldap or ldaps in the format (port optional).
    url: ldap://openldap.default.svc.cluster.local
    ## Connection Timeout.
    timeout: 5s
    ## Use StartTLS with the LDAP connection.
    start_tls: false
    tls:
      ## Server Name for certificate validation (in case it's not set correctly in the URL).
      server_name: ""
      ## Skip verifying the server certificate (to allow a self-signed certificate).
      ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
      ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
      skip_verify: false
      ## Minimum TLS version for either Secure LDAP or LDAP StartTLS.
      minimum_version: TLS1.2
    ## The base dn for every LDAP query.
    base_dn: DC=example,DC=com
    ## The attribute holding the username of the user. This attribute is used to populate the username in the session
    ## information. It was introduced due to #561 to handle case insensitive search queries. For you information,
    ## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this
    ## attribute holds the unique identifiers for the users binding the user and the configuration stored in database.
    ## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user
    ## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also
    ## be used but we don't recommend using them, we instead advise to use the attributes mentioned above
    ## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt.
    username_attribute: "uid"
    ## An additional dn to define the scope to all users.
    additional_users_dn: OU=Users
    ## The users filter used in search queries to find the user profile based on input filled in login form.
    ## Various placeholders are available in the user filter:
    ## - {input} is a placeholder replaced by what the user inputs in the login form.
    ## - {username_attribute} is a mandatory placeholder replaced by what is configured in `username_attribute`.
    ## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`.
    ## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later
    ##   versions, so please don't use it.
    ##
    ## Recommended settings are as follows:
    ## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
    ## - OpenLDAP:
    ##   - (&({username_attribute}={input})(objectClass=person))
    ##   - (&({username_attribute}={input})(objectClass=inetOrgPerson))
    ##
    ## To allow sign in both with username and email, one can use a filter like
    ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
    users_filter: ""
    ## An additional dn to define the scope of groups.
    additional_groups_dn: OU=Groups
    ## The groups filter used in search queries to find the groups of the user.
    ## - {input} is a placeholder replaced by what the user inputs in the login form.
    ## - {username} is a placeholder replace by the username stored in LDAP (based on `username_attribute`).
    ## - {dn} is a matcher replaced by the user distinguished name, aka, user DN.
    ## - {username_attribute} is a placeholder replaced by what is configured in `username_attribute`.
    ## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`.
    ## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later
    ##   versions, so please don't use it.
    ## - DON'T USE - {1} is an alias for {username} supported for backward compatibility but it will be deprecated in
    ##   later version, so please don't use it.
    ##
    ## If your groups use the `groupOfUniqueNames` structure use this instead:
    ##    (&(uniquemember={dn})(objectclass=groupOfUniqueNames))
    groups_filter: ""
    ## The attribute holding the name of the group
    group_name_attribute: "cn"
    ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
    ## first one returned by the LDAP server is used.
    mail_attribute: "mail"
    ## The attribute holding the display name of the user. This will be used to greet an authenticated user.
    display_name_attribute: "displayname"
    ## The username of the admin user.
    user: CN=admin,DC=example,DC=com
    plain_password: ""
  ##
  ## File (Authentication Provider)
  ##
  ## With this backend, the users database is stored in a file which is updated when users reset their passwords.
  ## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia
  ## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security
  ## implications it is highly recommended you leave the default values. Before considering changing these settings
  ## please read the docs page below:
  ## https://www.authelia.com/docs/configuration/authentication/file.html#password-hash-algorithm-tuning
  ##
  ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
  ##
  file:
    enabled: true
    path: /config/users_database.yml
    password:
      algorithm: argon2id
      iterations: 1
      key_length: 32
      salt_length: 16
      memory: 1024
      parallelism: 8
##
## Access Control Configuration
##
## Access control is a list of rules defining the authorizations applied for one resource to users or group of users.
##
## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed
## to anyone. Otherwise restrictions follow the rules defined.
##
## Note: One can use the wildcard * to match any subdomain.
## It must stand at the beginning of the pattern. (example: *.mydomain.com)
##
## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct.
##
## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'.
##
## - 'domain' defines which domain or set of domains the rule applies to.
##
## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not
##    provided. If provided, the parameter represents either a user or a group. It should be of the form
##    'user:<username>' or 'group:<groupname>'.
##
## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'.
##
## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter
##   is optional and matches any resource if not provided.
##
## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies.
access_control:
  ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
  ## resource if there is no policy to be applied to the user.
  default_policy: deny
  networks_access_control: []
  # networks_access_control:
  # - name: private
  #   networks:
  #   - 10.0.0.0/8
  #   - 172.16.0.0/12
  #   - 192.168.0.0/16
  # - name: vpn
  #   networks:
  #   - 10.9.0.0/16

  rules: []
  # rules:
  # - domain: public.example.com
  #   policy: bypass
  # - domain: "*.example.com"
  #   policy: bypass
  #   methods:
  #   - OPTIONS
  # - domain: secure.example.com
  #   policy: one_factor
  #   networks:
  #   - private
  #   - vpn
  #   - 192.168.1.0/24
  #   - 10.0.0.1
  # - domain:
  #   - secure.example.com
  #   - private.example.com
  #   policy: two_factor
  # - domain: singlefactor.example.com
  #   policy: one_factor
  # - domain: "mx2.mail.example.com"
  #   subject: "group:admins"
  #   policy: deny
  # - domain: "*.example.com"
  #   subject:
  #   - "group:admins"
  #   - "group:moderators"
  #   policy: two_factor
  # - domain: dev.example.com
  #   resources:
  #   - "^/groups/dev/.*$"
  #   subject: "group:dev"
  #   policy: two_factor
  # - domain: dev.example.com
  #   resources:
  #   - "^/users/john/.*$"
  #   subject:
  #   - ["group:dev", "user:john"]
  #   - "group:admins"
  #   policy: two_factor
  # - domain: "{user}.example.com"
  #   policy: bypass
##
## Session Provider Configuration
##
## The session cookies identify the user once logged in.
## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined.
session:
  ## The name of the session cookie. (default: authelia_session).
  name: authelia_session
  ## Sets the Cookie SameSite value. Possible options are none, lax, or strict.
  ## Please read https://www.authelia.com/docs/configuration/session.html#same_site
  same_site: lax
  ## The time in seconds before the cookie expires and session is reset.
  expiration: 1h
  ## The inactivity time in seconds before the session is reset.
  inactivity: 5m
  ## The remember me duration.
  ## Value is in seconds, or duration notation. Value of 0 disables remember me.
  ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
  ## Longer periods are considered less secure because a stolen cookie will last longer giving attackers more time to
  ## spy or attack. Currently the default is 1M or 1 month.
  remember_me_duration: 1M
##
## Redis Provider
##
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
##
## The redis connection details
redisProvider:
  port: 6379
  ## Optional username to be used with authentication.
  # username: authelia
  username: ""
  ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
  database_index: 0
  ## The maximum number of concurrent active connections to Redis.
  maximum_active_connections: 8
  ## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
  minimum_idle_connections: 0
  ## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s).
  tls:
    enabled: false
    ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
    server_name: ""
    ## Skip verifying the server certificate (to allow a self-signed certificate).
    ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
    ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
    skip_verify: false
    ## Minimum TLS version for the connection.
    minimum_version: TLS1.2
  ## The Redis HA configuration options.
  ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
  high_availability:
    enabled: false
    enabledSecret: false
    ## Sentinel Name / Master Name
    sentinel_name: mysentinel
    ## The additional nodes to pre-seed the redis provider with (for sentinel).
    ## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
    ## For high availability to be used you must have either defined; the host above or at least one node below.
    nodes: []
    # nodes:
    #   - host: sentinel-0.databases.svc.cluster.local
    #     port: 26379
    #   - host: sentinel-1.databases.svc.cluster.local
    #     port: 26379

    ## Choose the host with the lowest latency.
    route_by_latency: false
    ## Choose the host randomly.
    route_randomly: false
##
## Regulation Configuration
##
## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are done
## in a short period of time.
regulation:
  ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
  max_retries: 3
  ## The time range during which the user can attempt login before being banned. The user is banned if the
  ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.
  ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
  find_time: 2m
  ## The length of time before a banned user can login again. Ban Time accepts duration notation.
  ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
  ban_time: 5m
##
## Storage Provider Configuration
##
## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.
storage:
  ##
  ## PostgreSQL (Storage Provider)
  ##
  postgres:
    port: 5432
    database: authelia
    username: authelia
    sslmode: disable
    timeout: 5s
##
## Notification Provider
##
##
## Notifications are sent to users when they require a password reset, a u2f registration or a TOTP registration.
## The available providers are: filesystem, smtp. You must use one and only one of these providers.
notifier:
  ## You can disable the notifier startup check by setting this to true.
  disable_startup_check: false
  ##
  ## File System (Notification Provider)
  ##
  ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
  ##
  filesystem:
    enabled: true
    filename: /config/notification.txt
  ##
  ## SMTP (Notification Provider)
  ##
  ## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate.
  ## [Security] By default Authelia will:
  ##   - force all SMTP connections over TLS including unauthenticated connections
  ##      - use the disable_require_tls boolean value to disable this requirement
  ##        (only works for unauthenticated connections)
  ##   - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates
  ##     (configure in tls section)
  smtp:
    enabled: false
    enabledSecret: false
    host: smtp.mail.svc.cluster.local
    port: 25
    timeout: 5s
    username: test
    plain_password: test
    sender: admin@example.com
    ## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost.
    identifier: localhost
    ## Subject configuration of the emails sent.
    ## {title} is replaced by the text from the notifier
    subject: "[Authelia] {title}"
    ## This address is used during the startup check to verify the email configuration is correct.
    ## It's not important what it is except if your email server only allows local delivery.
    startup_check_address: test@authelia.com
    disable_require_tls: false
    disable_html_emails: false
    tls:
      ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
      server_name: ""
      ## Skip verifying the server certificate (to allow a self-signed certificate).
      ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
      ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
      skip_verify: false
      ## Minimum TLS version for either StartTLS or SMTPS.
      minimum_version: TLS1.2
identity_providers:
  oidc:
    ## Enables this in the config map. Currently in beta stage.
    ## See https://www.authelia.com/docs/configuration/identity-providers/oidc.html#roadmap
    enabled: false
    access_token_lifespan: 1h
    authorize_code_lifespan: 1m
    id_token_lifespan: 1h
    refresh_token_lifespan: 90m
    enable_client_debug_messages: false
    ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for
    ## security reasons.
    minimum_parameter_entropy: 8
    clients: []
    # clients:
    # -
    ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
    # id: myapp
## The description to show to users when they end up on the consent screen. Defaults to the ID above.
# description: My Application

## The client secret is a shared secret between Authelia and the consumer of this client.
# secret: apple123

## Sets the client to public. This should typically not be set, please see the documentation for usage.
# public: false

## The policy to require for this client; one_factor or two_factor.
# authorization_policy: two_factor

## Configures the consent mode; auto, explicit or implicit
# consent_mode: auto

## Audience this client is allowed to request.
# audience: []

## Scopes this client is allowed to request.
# scopes:
#   - openid
#   - profile
#   - email
#   - groups

## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
# redirect_uris:
#   - https://oidc.example.com/oauth2/callback

## Grant Types configures which grants this client can obtain.
## It's not recommended to configure this unless you know what you're doing.
# grant_types:
#   - refresh_token
#   - authorization_code

## Response Types configures which responses this client can be sent.
## It's not recommended to configure this unless you know what you're doing.
# response_types:
#   - code

## Response Modes configures which response modes this client supports.
## It's not recommended to configure this unless you know what you're doing.
# response_modes:
#   - form_post
#   - query
#   - fragment

## Client Authentication Method configures which client authentication methods this client supports.
## It's not recommended to configure this unless you know what you're doing.
# token_endpoint_auth_method: client_secret_basic

## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
# userinfo_signing_algorithm: none

## This configuration option enforces the use of PKCE for this registered client.
# require_pkce: false

## This setting enforces the use of the specified PKCE challenge method for this individual client.
# pkce_challange_method: S256

portal:
  open:
    enabled: true

ingress:
  main:
    required: true