Configuration.yml

############################################################################### 
#                           Authelia Configuration                            #
###############################################################################

## The host and port to listen on.
server.host: 0.0.0.0
server.port: 9091

## The theme to display: light, dark, grey.
theme: light

## Server Configuration
server:
  ## Buffers usually should be configured to be the same value.
  ## Explanation at https://www.authelia.com/docs/configuration/server.html
  read_buffer_size: 4096
  write_buffer_size: 4096
  ## Set the single level path Authelia listens on.
  ## Must be alphanumeric chars and should not contain any slashes.
  path: ""

## Level of verbosity for logs: info, debug, trace.
log.level: debug

## Format the logs are written as: json, text.
log.format: text

## File path where the logs will be written. If not set logs are written to stdout.
log.file_path: /etc/authelia/authelia.log

## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be
## set using a secret: https://www.authelia.com/docs/configuration/secrets.html
jwt_secret: MY_PASSWORD

## Default redirection URL
## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
default_redirection_url: https://wiki.MyDomain.at

## Authentication Backend Provider Configuration
authentication_backend:
  disable_reset_password: false
  file:
    path: /etc/authelia/users_database.yml
    password:
      algorithm: argon2id
      iterations: 1
      key_length: 32
      salt_length: 16
      memory: 64
      parallelism: 8

## Access Control Configuration
access_control:
  ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
  ## resource if there is no policy to be applied to the user.
  default_policy: deny

  networks:
    - name: internal
      networks:
        - 192.168.88.0/24

  rules:
    ## Rules applied to 'admins' group
    - domain: "*.MyDomain.at"
      subject: "group:admins"
      policy: two_factor

## Session Provider Configuration
session:
  ## The name of the session cookie.
  name: authelia_session

  ## The domain to protect.
  ## Note: the authenticator must also be in that domain.
  ## If empty, the cookie is restricted to the subdomain of the issuer.
  domain: MyDomain.at

  ## Sets the Cookie SameSite value. Possible options are none, lax, or strict.
  ## Please read https://www.authelia.com/docs/configuration/session.html#same_site
  same_site: lax

  ## The secret to encrypt the session data. This is only used with Redis / Redis Sentinel.
  ## Secret can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html
  secret: MY_PASSWORD

  ## The time before the cookie expires and the session is destroyed if remember me IS NOT selected.
  expiration: 1h

  ## The inactivity time before the session is reset. If expiration is set to 1h, and this is set to 5m, if the user
  ## does not select the remember me option their session will get destroyed after 1h, or after 5m since the last time
  ## Authelia detected user activity.
  inactivity: 5m

  ## The time before the cookie expires and the session is destroyed if remember me IS selected.
  ## Value of 0 disables remember me.
  remember_me_duration: 1M

  ## Redis Provider
  redis:
    host: 127.0.0.1
    port: 6379
    ## Use a unix socket instead
    # host: /var/run/redis/redis.sock

    ## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html
    password: MY_PASSWORD

    ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
    database_index: 0

    ## The maximum number of concurrent active connections to Redis.
    maximum_active_connections: 8

    ## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
    minimum_idle_connections: 0

## Regulation Configuration
regulation:
  ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
  max_retries: 3

  ## The time range during which the user can attempt login before being banned. The user is banned if the
  ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.
  ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
  find_time: 2m

  ## The length of time before a banned user can login again. Ban Time accepts duration notation.
  ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
  ban_time: 5m

## Storage Provider Configuration
storage:
  ## MySQL / MariaDB (Storage Provider)
  mysql:
    host: 192.168.88.13
    port: 3306
    database: authelia
    username: authelia
    ## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html
    password: MY_PASSWORD

## Notification Provider
notifier:
  ## You can disable the notifier startup check by setting this to true.
  disable_startup_check: false

  ## SMTP (Notification Provider)
  smtp:
    username: authelia@MyDomain.at
    ## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html
    password: MY_PASSWORD
    host: smtp.MyDomain.com
    port: 587
    sender: authelia@MyDomain.at
    ## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost.
    identifier: localhost
    ## Subject configuration of the emails sent. {title} is replaced by the text from the notifier.
    subject: "[Authelia] {title}"
    ## This address is used during the startup check to verify the email configuration is correct.
    startup_check_address: authelia@MyDomain.at
    disable_require_tls: false
    disable_html_emails: false

    tls:
      ## Skip verifying the server certificate (to allow a self-signed certificate).
      skip_verify: false
      ## Minimum TLS version for either StartTLS or SMTPS.
      minimum_version: TLS1.2