updated authelia docker-compose.yml (#377)

docs/examples/docker/basic-docker-compose/docker-compose.yml

@@ -1,5 +1,6 @@
-services:
+---
 
+services:
   copyparty:
     image: copyparty/ac:latest
     container_name: copyparty

docs/examples/docker/idp-authelia-traefik/README.md

@@ -8,7 +8,7 @@ to try this out with minimal adjustments:
 * login to https://fs.example.com/ with username `authelia` password `authelia`
 
 to use this in a safe and secure manner:
-* follow a guide on setting up authelia properly (TODO:link) and use the copyparty-specific parts of this folder as inspiration for your own config; namely the `cpp` subfolder and the `copyparty` service in `docker-compose.yml`
+* follow a guide on setting up [authelia](https://www.authelia.com/integration/proxies/traefik/#docker-compose) properly and use the copyparty-specific parts of this folder as inspiration for your own config; namely the `cpp` subfolder and the `copyparty` service in `docker-compose.yml`
 
 this folder is based on:
 * https://github.com/authelia/authelia/tree/39763aaed24c4abdecd884b47357a052b235942d/examples/compose/lite
@@ -16,20 +16,18 @@ this folder is based on:
 incomplete list of modifications made:
 * support for running with podman as root on fedora (`:z` volumes, `label:disable`)
 * explicitly using authelia `v4.38.0-beta3` because config syntax changed since last stable release
-* disabled automatic letsencrypt certificate signing
 * reduced logging from debug to info
-* added a warning that traefik is given access to the docker socket (as recommended by traefik docs) which means traefik is able to break out of the container and has full root access on the host machine
+* implemented a docker socket-proxy to not bind the docker.socket directly to traefik
+* using valkey instead of redis for caching
 
 
 # security
 
 there is probably/definitely room for improvement in this example setup. Some ideas taken from [github issue #62](https://github.com/9001/copyparty/issues/62):
 
-* Add in a redis password to limit attacker lateral movement in the system
+* Move valkey to a private network shared with just authelia
-* Move redis to a private network shared with just authelia
+* Add `watchtower` to manage your image version updates
-* Pin to image hashes (or go all in on updates and add `watchtower`)
 * Drop bridge networking for just exposing traefik's public ports
-* Configure docker for non-root access to docker socket and then move traefik to use [non-root perms](https://docs.docker.com/engine/security/rootless/)
 
 if you manage to improve on any of this, especially in a way that might be useful for other people, consider sending a PR :>
 

docs/examples/docker/idp-authelia-traefik/authelia/configuration.yml

@@ -1,15 +1,14 @@
-# based on https://github.com/authelia/authelia/blob/39763aaed24c4abdecd884b47357a052b235942d/examples/compose/lite/authelia/configuration.yml
-
 # Authelia configuration
 
-# This secret can also be set using the env variables AUTHELIA_JWT_SECRET_FILE
+identity_validation:
-jwt_secret: a_very_important_secret
+  reset_password:
+    jwt_secret: 'a_very_important_secret_so_please_change_this'
 
 server:
   address: 'tcp://:9091'
 
 log:
-  level: info  # debug
+  level: info
 
 totp:
   issuer: authelia.com
@@ -21,29 +20,26 @@ authentication_backend:
 access_control:
   default_policy: deny
   rules:
-    # Rules applied to everyone
+    - domain: auth.example.com
-    - domain: traefik.example.com
+      policy: bypass  # Allow access to the login UI
-      policy: one_factor
     - domain: fs.example.com
       policy: one_factor
 
 session:
-  # This secret can also be set using the env variables AUTHELIA_SESSION_SECRET_FILE
   secret: unsecure_session_secret
-
   cookies:
     - name: authelia_session
-      domain: example.com  # Should match whatever your root protected domain is
+      domain: example.com  # this should match whatever your root protected domain is
       default_redirection_url: https://fs.example.com
       authelia_url: https://authelia.example.com/
       expiration: 3600  # 1 hour
       inactivity: 300  # 5 minutes
 
   redis:
-    host: redis
+    host: valkey
     port: 6379
-    # This secret can also be set using the env variables AUTHELIA_SESSION_REDIS_PASSWORD_FILE
+    password: your_secure_password_here
-    # password: authelia
+
 
 regulation:
   max_retries: 3
@@ -58,9 +54,7 @@ storage:
 notifier:
   disable_startup_check: true
   smtp:
-    username: test
+    address: 'smtp://127.0.0.1:25'
-    # This secret can also be set using the env variables AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE
+    username: 'test'
-    password: password
+    password: 'password'
-    host: mail.example.com
+    sender: "Authelia <admin@example.com>"
-    port: 25
-    sender: admin@example.com

docs/examples/docker/idp-authelia-traefik/docker-compose.yml

@@ -1,4 +1,4 @@
-version: '3.3'
+---
 
 networks:
   net:
@@ -6,7 +6,7 @@ networks:
 
 services:
   copyparty:
-    image: copyparty/ac
+    image: copyparty/ac:latest
     container_name: idp_copyparty
     user: "1000:1000"  # should match the user/group of your fileshare volumes
     volumes:
@@ -19,19 +19,19 @@ services:
     labels:
       - 'traefik.enable=true'
       - 'traefik.http.routers.copyparty.rule=Host(`fs.example.com`)'
-      - 'traefik.http.routers.copyparty.entrypoints=https'
+      - 'traefik.http.routers.copyparty.entrypoints=websecure'
       - 'traefik.http.routers.copyparty.tls=true'
+      - 'traefik.http.routers.copyparty.tls.certresolver=letsencrypt'  # ← THIS IS CRUCIAL
       - 'traefik.http.routers.copyparty.middlewares=authelia@docker'
     stop_grace_period: 15s  # thumbnailer is allowed to continue finishing up for 10s after the shutdown signal
     environment:
       LD_PRELOAD: /usr/lib/libmimalloc-secure.so.NOPE
       # enable mimalloc by replacing "NOPE" with "2" for a nice speed-boost (will use twice as much ram)
-
       PYTHONUNBUFFERED: 1
       # ensures log-messages are not delayed (but can reduce speed a tiny bit)
 
   authelia:
-    image: authelia/authelia:v4.38.0-beta3  # the config files in the authelia folder use the new syntax
+    image: authelia/authelia:4.39.5@sha256:023e02e5203dfa0ebaee7a48b5bae34f393d1f9cada4a9df7fbf87eb1759c671
     container_name: idp_authelia
     volumes:
       - ./authelia:/config:z
@@ -40,25 +40,23 @@ services:
     labels:
       - 'traefik.enable=true'
       - 'traefik.http.routers.authelia.rule=Host(`authelia.example.com`)'
-      - 'traefik.http.routers.authelia.entrypoints=https'
+      - 'traefik.http.routers.authelia.entrypoints=websecure'
       - 'traefik.http.routers.authelia.tls=true'
-      #- 'traefik.http.routers.authelia.tls.certresolver=letsencrypt'  # uncomment this to enable automatic certificate signing (1/2)
+      - 'traefik.http.routers.authelia.tls.certresolver=letsencrypt'
       - 'traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/authz/forward-auth?authelia_url=https://authelia.example.com'
       - 'traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true'
       - 'traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email'
     expose:
       - 9091
     restart: unless-stopped
-    healthcheck:
-      disable: true
     environment:
       - TZ=Etc/UTC
 
-  redis:
+  valkey:
-    image: redis:7.2.4-alpine3.19
+    image: valkey/valkey:8.1.3-alpine3.22@sha256:0d27f0bca0249f61d060029a6aaf2e16b2c417d68d02a508e1dfb763fa2948b4
-    container_name: idp_redis
+    container_name: idp_valkey
     volumes:
-      - ./redis:/data:z
+      - ./valkey:/data:z
     networks:
       - net
     expose:
@@ -66,40 +64,55 @@ services:
     restart: unless-stopped
     environment:
       - TZ=Etc/UTC
+      - VALKEY_EXTRA_FLAGS=--requirepass your_secure_password_here
+
+  socket-proxy:
+    image: lscr.io/linuxserver/socket-proxy:3.2.3@sha256:63d2e0ce6bb0d12dfdbde5c3af31d08fee343ec3801a050c8197a3f5ffae8bed
+    container_name: idp_socket_proxy
+    environment:
+      - CONTAINERS=1
+      - NETWORKS=1
+      - EVENTS=1
+      - PING=1
+      - VERSION=1
+      - LOG_LEVEL=warning
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    security_opt:
+      - no-new-privileges:true
+    read_only: true
+    tmpfs:
+      - /run
+    networks:
+      - net
+    restart: unless-stopped
+    expose:
+      - 2375
 
   traefik:
-    image: traefik:2.11.0
+    image: traefik:3.5.0@sha256:4e7175cfe19be83c6b928cae49dde2f2788fb307189a4dc9550b67acf30c11a5
     container_name: idp_traefik
     volumes:
       - ./traefik:/etc/traefik:z
-      - /var/run/docker.sock:/var/run/docker.sock  # WARNING: this gives traefik full root-access to the host OS, but is recommended/required(?) by traefik
-    security_opt:
-      - label:disable  # disable selinux because it (rightly) blocks access to docker.sock
     networks:
       - net
     labels:
       - 'traefik.enable=true'
-      - 'traefik.http.routers.api.rule=Host(`traefik.example.com`)'
-      - 'traefik.http.routers.api.entrypoints=https'
-      - 'traefik.http.routers.api.service=api@internal'
-      - 'traefik.http.routers.api.tls=true'
-      #- 'traefik.http.routers.api.tls.certresolver=letsencrypt'  # uncomment this to enable automatic certificate signing (2/2)
       - 'traefik.http.routers.api.middlewares=authelia@docker'
     ports:
       - '80:80'
       - '443:443'
     command:
-      - '--api'
+      - '--global.sendAnonymousUsage=false'
-      - '--providers.docker=true'
+      - '--providers.docker.endpoint=tcp://socket-proxy:2375'
       - '--providers.docker.exposedByDefault=false'
-      - '--entrypoints.http=true'
+      - '--entrypoints.web.address=:80'
-      - '--entrypoints.http.address=:80'
+      - '--entrypoints.web.http.redirections.entrypoint.to=websecure'
-      - '--entrypoints.http.http.redirections.entrypoint.to=https'
+      - '--entrypoints.web.http.redirections.entrypoint.scheme=https'
-      - '--entrypoints.http.http.redirections.entrypoint.scheme=https'
+      - '--entrypoints.websecure.address=:443'
-      - '--entrypoints.https=true'
-      - '--entrypoints.https.address=:443'
       - '--certificatesResolvers.letsencrypt.acme.email=your-email@your-domain.com'
       - '--certificatesResolvers.letsencrypt.acme.storage=/etc/traefik/acme.json'
-      - '--certificatesResolvers.letsencrypt.acme.httpChallenge.entryPoint=http'
+      - '--certificatesResolvers.letsencrypt.acme.httpChallenge.entryPoint=web'
-      - '--log=true'
+      - '--log.level=INFO'
-      - '--log.level=WARNING'  # DEBUG
+    depends_on:
+      - socket-proxy