Skip to content

Commit fe1c415

Browse files
SimpleHomelabSimpleHomelab
committed
* Several updates 2024_05_30. See full commit log.
* Added MakeMKV, MKVToolNix, to homeserver * Authelia upgraded to 4.38.8 and example configuration.yml and users.yml updated. * Jellyfin does not work on WebOS via Traefik Proxy. Created new security headers (without SAMEORIGIN) to allow Jellyfin to work * Removed obsolete shell scripts. Will reupload them as I update them. * Updated start-media-after-boot.sh.example to start media containers after Rclone mounts load. * Updated bash_aliases
1 parent 91cc8eb commit fe1c415

27 files changed

+278
-527
lines changed

‎appdata/authelia/configuration.yml.example‎

Lines changed: 86 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -2,22 +2,33 @@
22
# Authelia configuration #
33
###############################################################
44

5-
host: 0.0.0.0
6-
port: 9091
7-
log_level: warn
5+
server:
6+
address: tcp://0.0.0.0:9091/
7+
buffers:
8+
read: 4096
9+
write: 4096
10+
endpoints:
11+
enable_pprof: false
12+
enable_expvars: false
13+
disable_healthcheck: false
14+
tls:
15+
key: ""
16+
certificate: ""
817

9-
# This secret can also be set using the env variables AUTHELIA_JWT_SECRET_FILE
10-
# I used this site to generate the secret: https://www.grc.com/passwords.htm
11-
# jwt_secret: SECRET_GOES_HERE # use docker secret file instead AUTHELIA_JWT_SECRET_FILE
12-
13-
# https://docs.authelia.com/configuration/miscellaneous.html#default-redirection-url
14-
default_redirection_url: https://authelia.example.com
18+
# https://www.authelia.com/configuration/miscellaneous/logging/
19+
log:
20+
level: info
21+
format: text
22+
file_path: /config/authelia.log
23+
keep_stdout: true
1524

25+
# https://www.authelia.com/configuration/second-factor/time-based-one-time-password/
1626
totp:
17-
issuer: authelia.com
27+
issuer: example.com
1828
period: 30
1929
skew: 1
2030

31+
# AUTHELIA_DUO_PLACEHOLDER
2132
# Enable the following for Duo Push Notification support
2233
# https://www.authelia.com/docs/features/2fa/push-notifications.html
2334
#duo_api:
@@ -26,78 +37,90 @@ totp:
2637
# # This secret can also be set using the env variables AUTHELIA_DUO_API_SECRET_KEY_FILE
2738
# secret_key: # use docker secret file instead AUTHELIA_DUO_API_SECRET_KEY_FILE
2839

40+
# https://www.authelia.com/reference/guides/passwords/
2941
authentication_backend:
42+
password_reset:
43+
disable: false
44+
refresh_interval: 5m
3045
file:
31-
path: /config/users_database.yml
32-
# customize passwords based on https://docs.authelia.com/configuration/authentication/file.html
46+
path: /config/users.yml
3347
password:
3448
algorithm: argon2id
3549
iterations: 1
3650
salt_length: 16
3751
parallelism: 8
38-
memory: 1024 # blocks this much of the RAM. Tune this.
52+
memory: 256 # blocks this much of the RAM
3953

40-
# https://docs.authelia.com/configuration/access-control.html
54+
# https://www.authelia.com/overview/authorization/access-control/
4155
access_control:
4256
default_policy: deny
4357
rules:
44-
# Rules applied to everyone
45-
- domain: authelia.example.com
46-
policy: bypass
47-
# - domain: radarr.example.com
48-
# policy: bypass
49-
# subject: "group:admins"
50-
# resources:
51-
# - "^/api/.*$"
52-
# - domain: "*.example.com"
53-
# policy: one_factor
54-
- domain: "*.example.com"
55-
policy: two_factor
56-
- domain: "example.com"
58+
# - domain:
59+
# - "*.example.com"
60+
# - "example.com"
61+
# policy: bypass
62+
# networks: # bypass authentication for local networks
63+
# - 10.0.0.0/8
64+
# - 192.168.0.0/16
65+
# - 172.16.0.0/12
66+
- domain:
67+
- "*.example.com"
68+
- "example.com"
5769
policy: two_factor
5870

71+
# https://www.authelia.com/configuration/session/introduction/
5972
session:
6073
name: authelia_session
61-
# This secret can also be set using the env variables AUTHELIA_SESSION_SECRET_FILE
62-
# Used a different secret, but the same site as jwt_secret above.
63-
# secret: SECRET_GOES_HERE # use docker secret file instead AUTHELIA_SESSION_SECRET_FILE
64-
expiration: 3600 # 1 hour
65-
inactivity: 300 # 5 minutes
66-
domain: example.com # Should match whatever your root protected domain is
74+
same_site: lax
75+
expiration: 7h
76+
inactivity: 5m
77+
remember_me: 1M
78+
cookies:
79+
- domain: 'example.com'
80+
authelia_url: 'https://authelia.example.com'
81+
default_redirection_url: 'https://example.com'
82+
# AUTHELIA_REDIS_PLACEHOLDER
83+
# Optional. Can improve performance on a busy system. If not enabled, session info is stored in memory.
84+
# redis:
85+
# host: redis
86+
# port: 6379
87+
# This secret can also be set using the env variables AUTHELIA_SESSION_REDIS_PASSWORD_FILE
88+
# password: REDIS_PASSWORD
6789

68-
# Optional. Can improve performance on a busy system. If not enabled, session info is stored in memory.
69-
# redis:
70-
# host: redis
71-
# port: 6379
72-
# This secret can also be set using the env variables AUTHELIA_SESSION_REDIS_PASSWORD_FILE
73-
# password: authelia
7490

91+
# https://www.authelia.com/configuration/security/regulation/
7592
regulation:
7693
max_retries: 3
77-
find_time: 120
78-
ban_time: 300
79-
94+
find_time: 10m
95+
ban_time: 12h
96+
97+
# https://www.authelia.com/configuration/storage/introduction/
8098
storage:
81-
# For local storage, uncomment lines below and comment out mysql. https://docs.authelia.com/configuration/storage/sqlite.html
82-
# local:
83-
# path: /config/db.sqlite3
84-
mysql:
85-
# MySQL allows running multiple authelia instances. Create database and enter details below.
86-
host: MYSQL_HOST
87-
port: 3306
88-
database: authelia
89-
username: DBUSERNAME
90-
# Password can also be set using a secret: https://docs.authelia.com/configuration/secrets.html
91-
# password: use docker secret file instead AUTHELIA_STORAGE_MYSQL_PASSWORD_FILE
99+
# For local storage, uncomment lines below and comment out mysql. https://docs.authelia.com/configuration/storage/sqlite.html
100+
# This is good for the beginning. If you have a busy site then switch to other databases.
101+
local:
102+
path: /config/db.sqlite3
103+
# mysql:
104+
# # https://www.authelia.com/configuration/storage/mysql/
105+
# # MySQL allows running multiple authelia instances. Create database and enter details below.
106+
# address: 'tcp://127.0.0.1:3306'
107+
# port: 3306
108+
# database: authelia
109+
# username: DBUSERNAME
110+
# # Password can also be set using a secret: https://www.authelia.com/configuration/methods/secrets/#environment-variables
111+
# # password: DBPASSWORD
112+
# encryption_key: 'a_very_important_secret' # Can also be set using a secret: AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE
92113

114+
# https://www.authelia.com/configuration/notifications/introduction/
93115
notifier:
94-
smtp:
95-
username: SMTP_USERNAME
96-
# This secret can also be set using the env variables AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE
97-
# password: # use docker secret file instead AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE
98-
host: SMTP_HOST
99-
port: 587 #465
100-
sender: SENDER_EMAIL
101-
# For testing purpose, notifications can be sent in a file. Be sure map the volume in docker-compose.
102-
# filesystem:
103-
# filename: /tmp/authelia/notification.txt
116+
disable_startup_check: false
117+
# For testing purposes, notifications can be sent in a file. Be sure to map the volume in docker-compose.
118+
filesystem:
119+
filename: /config/notifications.txt
120+
# smtp:
121+
# username: SMTP_USERNAME
122+
# # This secret can also be set using secret: https://www.authelia.com/configuration/methods/secrets/#environment-variables
123+
# # password: SMTP_PASSWORD
124+
# host: SMTP_HOST
125+
# port: 587 #465
126+
# sender: SENDER_EMAIL

‎appdata/authelia/users.yml.example‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
###############################################################
2+
# Users Database #
3+
###############################################################
4+
5+
# This file can be used if you do not have an LDAP set up.
6+
7+
# CREATE NEW HASHED PASSWORD
8+
# sudo docker run -it authelia/authelia:latest authelia crypto hash generate argon2 --password 'STRONG_PASSWORD'
9+
# https://www.authelia.com/reference/guides/passwords/
10+
11+
# List of users
12+
users:
13+
user1:
14+
displayname: "John_Doe_1"
15+
password: "HASHED_PASSWORD"
16+
email: USER_EMAIL
17+
groups:
18+
- admins
19+
# user2:
20+
# displayname: "John_Doe_2"
21+
# password: "HASHED_PASSWORD"
22+
# email: USER_EMAIL
23+
# groups:
24+
# - users

‎appdata/authelia/users_database.yml.example‎

Lines changed: 0 additions & 25 deletions
This file was deleted.

‎appdata/traefik3/rules/hs/chain-no-auth-webos.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
http:
2+
middlewares:
3+
chain-no-auth-webos:
4+
chain:
5+
middlewares:
6+
#- middlewares-traefik-bouncer # leave this out if you are not using CrowdSec
7+
- middlewares-rate-limit
8+
- middlewares-secure-headers-webos

‎appdata/traefik3/rules/hs/middlewares-secure-headers-webos.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
http:
2+
middlewares:
3+
middlewares-secure-headers-webos:
4+
headers:
5+
accessControlAllowMethods:
6+
- GET
7+
- OPTIONS
8+
- PUT
9+
accessControlMaxAge: 100
10+
hostsProxyHeaders:
11+
- "X-Forwarded-Host"
12+
stsSeconds: 63072000
13+
stsIncludeSubdomains: true
14+
stsPreload: true
15+
# forceSTSHeader: true # This is a good thing but it can be tricky. Enable after everything works.
16+
# X-Frame-Options interferes with Jellyfin on WebOS
17+
# customFrameOptionsValue: SAMEORIGIN # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
18+
contentTypeNosniff: true
19+
browserXssFilter: true
20+
referrerPolicy: "same-origin"
21+
permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=(), usb=(), vr=()"
22+
customResponseHeaders:
23+
X-Robots-Tag: "none,noarchive,nosnippet,notranslate,noimageindex," # disable search engines from indexing home server
24+
server: "" # hide server info from visitors

‎compose/hs/authelia.yml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ services:
22
# Authelia (Lite) - Self-Hosted Single Sign-On and Two-Factor Authentication
33
authelia:
44
container_name: authelia
5-
image: authelia/authelia:4.37.5
5+
image: authelia/authelia:4.38.8
66
security_opt:
77
- no-new-privileges:true
88
restart: unless-stopped
@@ -16,9 +16,14 @@ services:
1616
- $DOCKERDIR/appdata/authelia:/config
1717
environment:
1818
- TZ=$TZ
19-
- AUTHELIA_JWT_SECRET_FILE=/run/secrets/authelia_jwt_secret
20-
- AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE=/run/secrets/authelia_storage_encryption_key
19+
- PUID=$PUID
20+
- PGID=$PGID
21+
- AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE=/run/secrets/authelia_jwt_secret
2122
- AUTHELIA_SESSION_SECRET_FILE=/run/secrets/authelia_session_secret
23+
- AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE=/run/secrets/authelia_storage_encryption_key
24+
# - AUTHELIA_STORAGE_MYSQL_PASSWORD_FILE=/run/secrets/authelia_storage_mysql_password
25+
# - AUTHELIA_SESSION_REDIS_PASSWORD_FILE=/run/secrets/authelia_session_redis_password
26+
# - AUTHELIA_DUO_API_SECRET_KEY_FILE=/run/secrets/authelia_duo_api_secret_key
2227
secrets:
2328
- authelia_jwt_secret
2429
- authelia_storage_encryption_key

‎compose/hs/makemkv.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
services:
2+
# MakeMKV - Video Editing (Ripping from Disks)
3+
makemkv:
4+
image: jlesage/makemkv:latest
5+
container_name: makemkv
6+
security_opt:
7+
- no-new-privileges:true
8+
restart: "no"
9+
profiles: ["media","all"]
10+
networks:
11+
- t3_proxy
12+
# ports:
13+
# - "$MAKEMKV_PORT:5800"
14+
volumes:
15+
- $DOWNLOADSDIR:/data/downloads
16+
- $DOCKERDIR/appdata/makemkv/config:/config
17+
- /dev/shm:/dev/shm
18+
environment:
19+
USER_ID: $PUID
20+
GROUP_ID: $PGID
21+
UMASK: 002
22+
TZ: $TZ
23+
KEEP_APP_RUNNING: 1
24+
CLEAN_TMP_DIR: 1
25+
DISPLAY_WIDTH: 1600
26+
DISPLAY_HEIGHT: 960
27+
# VNC_PASSWORD: $MAKEMKV_VNC_PASSWD
28+
labels:
29+
- "traefik.enable=true"
30+
# HTTP Routers
31+
- "traefik.http.routers.makemkv-rtr.entrypoints=websecure"
32+
- "traefik.http.routers.makemkv-rtr.rule=Host(`makemkv.$DOMAINNAME_HS`)"
33+
# Middlewares
34+
- "traefik.http.routers.makemkv-rtr.middlewares=chain-oauth@file"
35+
# HTTP Services
36+
- "traefik.http.routers.makemkv-rtr.service=makemkv-svc"
37+
- "traefik.http.services.makemkv-svc.loadbalancer.server.port=5800"

‎compose/hs/mkvtoolnix.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
services:
2+
# MKVToolNix - Video Editing (Remuxing - changing media container while keeping original source quality)
3+
mkvtoolnix:
4+
image: jlesage/mkvtoolnix:latest
5+
container_name: mkvtoolnix
6+
security_opt:
7+
- no-new-privileges:true
8+
restart: "no"
9+
profiles: ["media","all"]
10+
networks:
11+
- t3_proxy
12+
# ports:
13+
# - "$MKVTOOLNIX_PORT:5800"
14+
volumes:
15+
- $DOWNLOADSDIR:/data/downloads
16+
- $DOCKERDIR/appdata/mkvtoolnix/config:/config:rw
17+
environment:
18+
USER_ID: $PUID
19+
GROUP_ID: $PGID
20+
UMASK: 002
21+
TZ: $TZ
22+
KEEP_APP_RUNNING: 1
23+
CLEAN_TMP_DIR: 1
24+
DISPLAY_WIDTH: 1600
25+
DISPLAY_HEIGHT: 960
26+
# VNC_PASSWORD: $MKVTOOLNIX_VNC_PASSWD
27+
labels:
28+
- "traefik.enable=true"
29+
# HTTP Routers
30+
- "traefik.http.routers.mkvtoolnix-rtr.entrypoints=websecure"
31+
- "traefik.http.routers.mkvtoolnix-rtr.rule=Host(`mkvtoolnix.$DOMAINNAME_HS`)"
32+
# Middlewares
33+
- "traefik.http.routers.mkvtoolnix-rtr.middlewares=chain-oauth@file"
34+
# HTTP Services
35+
- "traefik.http.routers.mkvtoolnix-rtr.service=mkvtoolnix-svc"
36+
- "traefik.http.services.mkvtoolnix-svc.loadbalancer.server.port=5800"

0 commit comments

Comments
 (0)