Add Authelia

README.md

@@ -17,6 +17,7 @@ If you have a spare domain name you can configure applications to be accessible
 ## Available Applications
 
 * [Airsonic](https://airsonic.github.io/) - catalog and stream music
+* [Authelia](https://www.authelia.com/) - The Single Sign-On Multi-Factor portal for web apps
 * [Bazarr](https://github.com/morpheus65535/bazarr) - companion to Radarr and Sonarr for downloading subtitles
 * [Bitwarden_rs](https://github.com/dani-garcia/bitwarden_rs) - Self-Hosting port of password manager
 * [Booksonic](https://booksonic.org/) - The selfhosted audiobook server

nas.yml

@@ -45,6 +45,10 @@
       tags:
         - airsonic
 
+    - role: authelia
+      tags:
+        - authelia
+
     - role: bazarr
       tags:
         - bazarr

roles/authelia/defaults/main.yml

@@ -0,0 +1,20 @@
+---
+authelia_enabled: false
+authelia_available_externally: false
+
+# directories
+authelia_data_directory: "{{ docker_home }}/authelia"
+
+# network
+authelia_port: "9093"
+authelia_hostname: "authelia"
+authelia_network_name: "authelia"
+
+# specs
+authelia_memory: 1g
+
+# docker
+authelia_container_name: "authelia"
+authelia_redis_container_name: "authelia_redis"
+authelia_image: "authelia/authelia"
+authelia_tag: "latest"

roles/authelia/docs/authelia.md

@@ -0,0 +1,17 @@
+# Authelia
+
+Homepage: <https://www.authelia.com/>
+
+Authelia is an open-source authentication and authorization server and portal fulfilling the identity and access management (IAM) role of information security in providing multi-factor authentication and single sign-on (SSO) for your applications via a web portal. It acts as a companion for common reverse proxies.
+
+## Usage
+
+Set `authelia_enabled: true` in your `inventories/<your_inventory>/nas.yml` file.
+
+Set all `authelia_*` variables in `inventories/<your_inventory>/group_vars/all.yml`.
+
+The authelia web interface can be found at <http://ansible_nas_host_or_ip:9093>.
+
+## Specific Configuration
+
+This a basic working example of forward auth to Authelia. You need to adjust the config file (`roles/authelia/templates/configuration.yml`) to suit your environment (Authentication Backend, Access Control, etc).

roles/authelia/molecule/default/molecule.yml

@@ -0,0 +1,6 @@
+---
+provisioner:
+  inventory:
+    group_vars:
+      all:
+        authelia_enabled: true

roles/authelia/molecule/default/side_effect.yml

@@ -0,0 +1,10 @@
+---
+- name: Stop
+  hosts: all
+  become: true
+  tasks:
+    - name: "Include {{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }} role"
+      include_role:
+        name: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}"
+      vars:
+        authelia_enabled: false

roles/authelia/molecule/default/verify.yml

@@ -0,0 +1,40 @@
+---
+- name: Verify
+  hosts: all
+  gather_facts: false
+  tasks:
+    - name: Include vars
+      include_vars:
+        file: ../../defaults/main.yml
+
+    - name: Get authelia container state
+      docker_container_info:
+        name: "{{ authelia_container_name }}"
+      register: result
+
+    - name: Get authelia redis container state
+      docker_container_info:
+        name: "{{ authelia_redis_container_name }}"
+      register: result_redis
+
+    - name: Get authelia secure example container state
+      docker_container_info:
+        name: "authelia_secure"
+      register: result_secure
+
+    - name: Get authelia public example container state
+      docker_container_info:
+        name: "authelia_public"
+      register: result_public
+
+    - name: Check if authelia docker containers are running
+      assert:
+        that:
+          - result.container['State']['Status'] == "running"
+          - result.container['State']['Restarting'] == false
+          - result_redis.container['State']['Status'] == "running"
+          - result_redis.container['State']['Restarting'] == false
+          - result_secure.container['State']['Status'] == "running"
+          - result_secure.container['State']['Restarting'] == false
+          - result_public.container['State']['Status'] == "running"
+          - result_public.container['State']['Restarting'] == false

roles/authelia/molecule/default/verify_stopped.yml

@@ -0,0 +1,40 @@
+---
+- name: Verify
+  hosts: all
+  gather_facts: false
+  tasks:
+    - name: Include vars
+      include_vars:
+        file: ../../defaults/main.yml
+
+    - name: Try and stop and remove authelia
+      docker_container:
+        name: "{{ authelia_container_name }}"
+        state: absent
+      register: result
+
+    - name: Try and stop and remove authelia Redis
+      docker_container:
+        name: "{{ authelia_redis_container_name }}"
+        state: absent
+      register: result_redis
+
+    - name: Try and stop and remove authelia secure example
+      docker_container:
+        name: "authelia_secure"
+        state: absent
+      register: result_secure
+
+    - name: Try and stop and remove authelia public example
+      docker_container:
+        name: "authelia_public"
+        state: absent
+      register: result_public
+
+    - name: Check if authelia containers are stopped
+      assert:
+        that:
+          - not result.changed
+          - not result_redis.changed
+          - not result_secure.changed
+          - not result_public.changed

roles/authelia/tasks/main.yml

@@ -0,0 +1,129 @@
+---
+- name: Start Authelia
+  block:
+    - name: Create Authelia Directory
+      file:
+        path: "{{ item }}"
+        state: directory
+      with_items:
+        - "{{ authelia_data_directory }}"
+
+    - name: Create Authelia config file
+      template:
+        src: configuration.yml
+        dest: "{{ authelia_data_directory }}/configuration.yml"
+        owner: "root"
+        group: "root"
+        mode: u=rw
+
+    - name: Create authelia network
+      community.docker.docker_network:
+        name: "{{ authelia_network_name }}"
+
+    - name: Authelia Docker Container
+      community.docker.docker_container:
+        name: "{{ authelia_container_name }}"
+        image: "{{ authelia_image }}:{{ authelia_tag }}"
+        pull: true
+        volumes:
+          - "{{ authelia_data_directory }}:/config:rw"
+        networks:
+          - name: "{{ authelia_network_name }}"
+        ports:
+          - "{{ authelia_port }}:9091"
+        env:
+        labels:
+          traefik.enable: "{{ authelia_available_externally | string }}"
+          traefik.http.routers.authelia.rule: "Host(`{{ authelia_hostname }}.{{ ansible_nas_domain }}`)"
+          traefik.http.routers.authelia.entrypoints: "websecure"
+          traefik.http.routers.authelia.tls: "true"
+          traefik.http.routers.authelia.tls.certresolver: "letsencrypt"
+          traefik.http.routers.authelia.tls.domains[0].main: "{{ ansible_nas_domain }}"
+          traefik.http.routers.authelia.tls.domains[0].sans: "*.{{ ansible_nas_domain }}"
+          traefik.http.routers.authelia.middlewares: "authelia-whitelist"
+          traefik.http.middlewares.authelia-whitelist.ipwhitelist.ipstrategy.depth: "1"
+          traefik.http.middlewares.authelia-whitelist.ipwhitelist.sourcerange: "127.0.0.1/32, 192.168.0.0/16"
+          traefik.http.middlewares.authelia.forwardauth.address: "http://authelia:9091/api/verify?rd=https://{{ authelia_hostname }}.{{ ansible_nas_domain }}"  # yamllint disable-line rule:line-length
+          traefik.http.middlewares.authelia.forwardauth.trustForwardHeader: "true"
+          traefik.http.middlewares.authelia.forwardauth.authResponseHeaders: "Remote-User,Remote-Groups,Remote-Name,Remote-Email"  # yamllint disable-line rule:line-length
+          traefik.http.services.authelia.loadbalancer.server.port: "9091"
+        restart_policy: unless-stopped
+        memory: "{{ authelia_memory }}"
+
+    - name: Authelia Redis Docker Container
+      community.docker.docker_container:
+        name: "{{ authelia_redis_container_name }}"
+        image: docker.io/library/redis:alpine
+        pull: true
+        command: --save 60 1 --loglevel warning
+        volumes:
+          - "{{ authelia_data_directory }}/redis:/data:rw"
+        networks:
+          - name: "{{ authelia_network_name }}"
+        expose: "6379"
+        env:
+          TZ: "{{ ansible_nas_timezone }}"
+        labels:
+          traefik.enable: "false"
+        restart_policy: unless-stopped
+        memory: "{{ authelia_memory }}"
+        healthcheck:
+          test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
+          start_period: 20s
+          interval: 30s
+          retries: 5
+          timeout: 3s
+
+    - name: Authelia Example Secure Container
+      community.docker.docker_container:
+        image: traefik/whoami
+        name: authelia_secure
+        networks:
+          - name: "{{ authelia_network_name }}"
+        labels:
+          traefik.enable: "true"
+          traefik.http.routers.secure.rule: "Host(`secure.{{ ansible_nas_domain }}`)"
+          traefik.http.routers.secure.tls: "true"
+          traefik.http.routers.secure.tls.certresolver: "letsencrypt"
+          traefik.http.routers.secure.middlewares: "authelia@docker"
+        expose: "80"
+        restart_policy: unless-stopped
+
+    - name: Authelia Example Container
+      community.docker.docker_container:
+        image: traefik/whoami
+        name: authelia_public
+        networks:
+          - name: "{{ authelia_network_name }}"
+        labels:
+          traefik.enable: "true"
+          traefik.http.routers.public.rule: "Host(`public.{{ ansible_nas_domain }}`)"
+          traefik.http.routers.public.tls: "true"
+          traefik.http.routers.public.tls.certresolver: "letsencrypt"
+          traefik.http.routers.public.middlewares: "authelia@docker"
+        expose: "80"
+        restart_policy: unless-stopped
+  when: authelia_enabled is true
+
+- name: Stop authelia
+  block:
+    - name: Stop authelia
+      community.docker.docker_container:
+        name: "{{ authelia_container_name }}"
+        state: absent
+
+    - name: Stop authelia Redis
+      community.docker.docker_container:
+        name: "{{ authelia_redis_container_name }}"
+        state: absent
+
+    - name: Stop authelia Example Secure Container
+      community.docker.docker_container:
+        name: authelia_secure
+        state: absent
+
+    - name: Stop authelia Example Container
+      community.docker.docker_container:
+        name: authelia_public
+        state: absent
+  when: authelia_enabled is false