Antoru76

Howdy , despite the excellent guide of IBRACORP, I'm struggling to getting this container even starting . I'm commenting/uncommeting stuff that I need in the .YAML , but still the logging look very frustrating . Not using DUO API, not using LDAP , I'm using redis . Thanks for the help guys . Goal is to ad 2FA in a ghost blog . time="2021-06-22T20:50:38+02:00" level=error msg="config key not expected: authentication_backend.file" time="2021-06-22T20:51:26+02:00" level=error msg="config key not expected: authentication_backend.file" time="2021-06-22T20:52:16+02:00" level=error msg="config key not expected: authentication_backend.file" time="2021-06-22T20:53:34+02:00" level=error msg="config key not expected: authentication_backend.file" time="2021-06-22T20:53:34+02:00" level=error msg="config key not expected: authentication_backend.file" time="2021-06-22T20:54:27+02:00" level=error msg="Please provide `ldap` or `file` object in `authentication_backend`" time="2021-06-22T20:54:27+02:00" level=error msg="config key not expected: duo_api.ldap.additional_users_dn" time="2021-06-22T20:54:27+02:00" level=error msg="config key not expected: duo_api.file" time="2021-06-22T20:54:27+02:00" level=error msg="config key not expected: duo_api.ldap.tls.skip_verify" time="2021-06-22T20:54:27+02:00" level=error msg="config key not expected: duo_api.ldap.start_tls" time="2021-06-22T20:54:27+02:00" level=error msg="config key not expected: duo_api.refresh_interval" time="2021-06-22T20:54:27+02:00" level=error msg="config key not expected: duo_api.ldap.groups_filter" time="2021-06-22T20:54:27+02:00" level=error msg="config key not expected: duo_api.ldap.user" time="2021-06-22T20:54:27+02:00" level=error msg="config key not expected: duo_api.ldap.url" time="2021-06-22T20:54:27+02:00" level=error msg="config key not expected: duo_api.ldap.base_dn" time="2021-06-22T20:54:27+02:00" level=error msg="config key not expected: duo_api.ldap.tls.minimum_version" time="2021-06-22T20:54:27+02:00" level=error msg="config key not expected: duo_api.ldap.implementation" time="2021-06-22T20:54:27+02:00" level=error msg="config key not expected: duo_api.ldap.users_filter" time="2021-06-22T20:54:27+02:00" level=error msg="config key not expected: duo_api.ldap.password" time="2021-06-22T20:54:27+02:00" level=error msg="config key not expected: duo_api.ldap.additional_groups_dn" time="2021-06-22T20:55:12+02:00" level=error msg="Error malformed yaml: line 120: did not find expected key" time="2021-06-22T20:55:12+02:00" level=error msg="Error malformed yaml: line 120: did not find expected key" time="2021-06-22T20:57:03+02:00" level=error msg="Please provide `ldap` or `file` object in `authentication_backend`" time="2021-06-22T20:57:03+02:00" level=error msg="config key not expected: totp.refresh_interval" time="2021-06-22T20:57:03+02:00" level=error msg="config key not expected: totp.file.path" time="2021-06-22T20:57:03+02:00" level=error msg="config key not expected: totp.file.salt_length" time="2021-06-22T20:57:03+02:00" level=error msg="config key not expected: totp.file.parallelism" time="2021-06-22T20:57:03+02:00" level=error msg="config key not expected: totp.file.password" time="2021-06-22T20:57:03+02:00" level=error msg="config key not expected: totp.file.iterations" time="2021-06-22T20:57:03+02:00" level=error msg="config key not expected: totp.file.key_length" time="2021-06-22T20:57:03+02:00" level=error msg="config key not expected: totp.file.algorithm" time="2021-06-22T20:57:03+02:00" level=error msg="config key not expected: totp.file.memory" time="2021-06-22T20:57:03+02:00" level=error msg="Please provide `ldap` or `file` object in `authentication_backend`" time="2021-06-22T20:57:03+02:00" level=error msg="config key not expected: totp.refresh_interval" time="2021-06-22T20:57:03+02:00" level=error msg="config key not expected: totp.file.path" time="2021-06-22T20:57:03+02:00" level=error msg="config key not expected: totp.file.salt_length" time="2021-06-22T20:57:03+02:00" level=error msg="config key not expected: totp.file.parallelism" time="2021-06-22T20:57:03+02:00" level=error msg="config key not expected: totp.file.password" time="2021-06-22T20:57:03+02:00" level=error msg="config key not expected: totp.file.iterations" time="2021-06-22T20:57:03+02:00" level=error msg="config key not expected: totp.file.key_length" time="2021-06-22T20:57:03+02:00" level=error msg="config key not expected: totp.file.algorithm" time="2021-06-22T20:57:03+02:00" level=error msg="config key not expected: totp.file.memory" time="2021-06-22T21:01:35+02:00" level=error msg="Please provide `ldap` or `file` object in `authentication_backend`" time="2021-06-22T21:01:35+02:00" level=error msg="config key not expected: totp.file.iterations" time="2021-06-22T21:01:35+02:00" level=error msg="config key not expected: totp.file.memory" time="2021-06-22T21:01:35+02:00" level=error msg="config key not expected: totp.file.path" time="2021-06-22T21:01:35+02:00" level=error msg="config key not expected: totp.file.password" time="2021-06-22T21:01:35+02:00" level=error msg="config key not expected: totp.file.algorithm" time="2021-06-22T21:01:35+02:00" level=error msg="config key not expected: totp.refresh_interval" time="2021-06-22T21:01:35+02:00" level=error msg="config key not expected: totp.file.parallelism" time="2021-06-22T21:01:35+02:00" level=error msg="config key not expected: totp.file.key_length" time="2021-06-22T21:01:35+02:00" level=error msg="config key not expected: totp.file.salt_length" ---------------------------------------------- YAML # yamllint disable rule:comments-indentation --- ############################################################################### # Authelia Configuration # ############################################################################### ## The host and port to listen on. host: 0.0.0.0 port: 9091 ## The TLS key and cert used with Authelia. # tls_key: /config/ssl/key.pem # tls_cert: /config/ssl/cert.pem ## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to ## the system certificates store. ## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem. # certificates_directory: /config/certificates ## The theme to display: light, dark, grey. theme: dark ## ## Server Configuration ## server: ## Buffers usually should be configured to be the same value. ## Explanation at https://www.authelia.com/docs/configuration/server.html ## Read buffer size adjusts the server's max incoming request size in bytes. ## Write buffer size does the same for outgoing responses. read_buffer_size: 4096 write_buffer_size: 4096 ## Set the single level path Authelia listens on. ## Must be alphanumeric chars and should not contain any slashes. path: "" ## Level of verbosity for logs: info, debug, trace. log_level: debug ## Format the logs are written as: json, text. # log_format: json ## File path where the logs will be written. If not set logs are written to stdout. # log_file_path: /config/authelia.log ## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be ## set using a secret: https://www.authelia.com/docs/configuration/secrets.html jwt_secret: whatever ## Default redirection URL ## ## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end ## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use ## in such a case. ## ## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication. default_redirection_url: https://united.states.of.whatever/ ## ## TOTP Configuration ## ## Parameters used for TOTP generation. totp: ## The issuer name displayed in the Authenticator application of your choice ## See: https://github.com/google/google-authenticator/wiki/Key-Uri-Format for more info on issuer names issuer: whatever.com ## The period in seconds a one-time password is current for. Changing this will require all users to register ## their TOTP applications again. Warning: before changing period read the docs link below. period: 30 ## The skew controls number of one-time passwords either side of the current one that are valid. ## Warning: before changing skew read the docs link below. skew: 1 ## See: https://www.authelia.com/docs/configuration/one-time-password.html#period-and-skew to read the documentation. ## ## Duo Push API Configuration ## ## Parameters used to contact the Duo API. Those are generated when you protect an application of type ## "Partner Auth API" in the management panel. ##duo_api: #hostname: api-123456789.example.com #integration_key: ABCDEF ## Secret can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html #secret_key: 1234567890abcdefghifjkl ## ## Authentication Backend Provider Configuration ## ## Used for verifying user passwords and retrieve information such as email address and groups users belong to. ## ## The available providers are: `file`, `ldap`. You must use only one of these providers. ##authentication_backend: ## Disable both the HTML element and the API for reset password functionality. ##disable_reset_password: false ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation. ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP. ## To force update on every request you can set this to '0' or 'always', this will increase processor demand. ## See the below documentation for more information. ## Duration Notation docs: https://www.authelia.com/docs/configuration/index.html#duration-notation-format ## Refresh Interval docs: https://www.authelia.com/docs/configuration/authentication/ldap.html#refresh-interval refresh_interval: 5m ## ## LDAP (Authentication Provider) ## ## This is the recommended Authentication Provider in production ## because it allows Authelia to offload the stateful operations ## onto the LDAP service. ##ldap: ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password. ## Acceptable options are as follows: ## - 'activedirectory' - For Microsoft Active Directory. ## - 'custom' - For custom specifications of attributes and filters. ## This currently defaults to 'custom' to maintain existing behaviour. ## ## Depending on the option here certain other values in this section have a default value, notably all of the ## attribute mappings have a default value that this config overrides, you can read more about these default values ## at https://www.authelia.com/docs/configuration/authentication/ldap.html#defaults #implementation: custom ## The url to the ldap server. Format: <scheme>://<address>[:<port>]. ## Scheme can be ldap or ldaps in the format (port optional). #url: ldap://127.0.0.1 ## Use StartTLS with the LDAP connection. #start_tls: false #tls: ## Server Name for certificate validation (in case it's not set correctly in the URL). # server_name: ldap.example.com ## Skip verifying the server certificate (to allow a self-signed certificate). ## In preference to setting this we strongly recommend you add the public portion of the certificate to the ## certificates directory which is defined by the `certificates_directory` option at the top of the config. #skip_verify: false ## Minimum TLS version for either Secure LDAP or LDAP StartTLS. #minimum_version: TLS1.2 ## The distinguished name of the container searched for objects in the directory information tree. ## See also: additional_users_dn, additional_groups_dn. #base_dn: dc=example,dc=com ## The attribute holding the username of the user. This attribute is used to populate the username in the session ## information. It was introduced due to #561 to handle case insensitive search queries. For you information, ## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this ## attribute holds the unique identifiers for the users binding the user and the configuration stored in database. ## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user ## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also ## be used but we don't recommend using them, we instead advise to use the attributes mentioned above ## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt. # username_attribute: uid ## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users. ## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users. #additional_users_dn: ou=users ## The users filter used in search queries to find the user profile based on input filled in login form. ## Various placeholders are available in the user filter: ## - {input} is a placeholder replaced by what the user inputs in the login form. ## - {username_attribute} is a mandatory placeholder replaced by what is configured in `username_attribute`. ## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`. ## ## Recommended settings are as follows: ## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) ## - OpenLDAP: ## - (&({username_attribute}={input})(objectClass=person)) ## - (&({username_attribute}={input})(objectClass=inetOrgPerson)) ## ## To allow sign in both with username and email, one can use a filter like ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person)) #users_filter: (&({username_attribute}={input})(objectClass=person)) ## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups. ## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups. #additional_groups_dn: ou=groups ## The groups filter used in search queries to find the groups of the user. ## - {input} is a placeholder replaced by what the user inputs in the login form. ## - {username} is a placeholder replace by the username stored in LDAP (based on `username_attribute`). ## - {dn} is a matcher replaced by the user distinguished name, aka, user DN. ## - {username_attribute} is a placeholder replaced by what is configured in `username_attribute`. ## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`. ## ## If your groups use the `groupOfUniqueNames` structure use this instead: ## (&(uniquemember={dn})(objectclass=groupOfUniqueNames)) #groups_filter: (&(member={dn})(objectclass=groupOfNames)) ## The attribute holding the name of the group. # group_name_attribute: cn ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the ## first one returned by the LDAP server is used. # mail_attribute: mail ## The attribute holding the display name of the user. This will be used to greet an authenticated user. # display_name_attribute: displayname ## The username and password of the admin user. #user: cn=admin,dc=example,dc=com ## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html #password: password ## ## File (Authentication Provider) ## ## With this backend, the users database is stored in a file which is updated when users reset their passwords. ## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia ## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security ## implications it is highly recommended you leave the default values. Before considering changing these settings ## please read the docs page below: ## https://www.authelia.com/docs/configuration/authentication/file.html#password-hash-algorithm-tuning ## ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html ## file: path: /config/users_database.yml password: algorithm: argon2id iterations: 1 key_length: 32 salt_length: 16 memory: 1024 parallelism: 8 ## ## Access Control Configuration ## ## Access control is a list of rules defining the authorizations applied for one resource to users or group of users. ## ## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed ## to anyone. Otherwise restrictions follow the rules defined. ## ## Note: One can use the wildcard * to match any subdomain. ## It must stand at the beginning of the pattern. (example: *.mydomain.com) ## ## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct. ## ## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'. ## ## - 'domain' defines which domain or set of domains the rule applies to. ## ## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not ## provided. If provided, the parameter represents either a user or a group. It should be of the form ## 'user:<username>' or 'group:<groupname>'. ## ## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'. ## ## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter ## is optional and matches any resource if not provided. ## ## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies. access_control: ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any ## resource if there is no policy to be applied to the user. default_policy: deny networks: - name: internal networks: - 10.10.0.0/16 - 192.168.2.0/24 - name: VPN networks: 10.9.0.0/16 rules: ## Rules applied to everyone - domain: public.example.com policy: bypass - domain: secure.example.com policy: one_factor ## Network based rule, if not provided any network matches. networks: - internal - VPN - 192.168.1.0/24 - 10.0.0.1 - domain: - secure.example.com - private.example.com policy: two_factor - domain: singlefactor.example.com policy: one_factor ## Rules applied to 'admins' group - domain: "mx2.mail.example.com" subject: "group:admins" policy: deny - domain: "*.example.com" subject: - "group:admins" - "group:moderators" policy: two_factor ## Rules applied to 'dev' group - domain: dev.example.com resources: - "^/groups/dev/.*$" subject: "group:dev" policy: two_factor ## Rules applied to user 'john' - domain: dev.example.com resources: - "^/users/john/.*$" subject: "user:john" policy: two_factor ## Rules applied to user 'harry' - domain: dev.example.com resources: - "^/users/harry/.*$" subject: "user:harry" policy: two_factor ## Rules applied to user 'bob' - domain: "*.mail.example.com" subject: "user:bob" policy: two_factor - domain: "dev.example.com" resources: - "^/users/bob/.*$" subject: "user:bob" policy: two_factor ## ## Session Provider Configuration ## ## The session cookies identify the user once logged in. ## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined. session: ## The name of the session cookie. name: authelia_session ## The domain to protect. ## Note: the authenticator must also be in that domain. ## If empty, the cookie is restricted to the subdomain of the issuer. domain: whatever.com ## Sets the Cookie SameSite value. Possible options are none, lax, or strict. ## Please read https://www.authelia.com/docs/configuration/session.html#same_site same_site: lax ## The secret to encrypt the session data. This is only used with Redis / Redis Sentinel. ## Secret can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html secret: whatever ## The value for expiration, inactivity, and remember_me_duration are in seconds or the duration notation format. ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure ## because a stolen cookie will last longer giving attackers more time to spy or attack. ## The time before the cookie expires and the session is destroyed if remember me IS NOT selected. expiration: 1h ## The inactivity time before the session is reset. If expiration is set to 1h, and this is set to 5m, if the user ## does not select the remember me option their session will get destroyed after 1h, or after 5m since the last time ## Authelia detected user activity. inactivity: 5m ## The time before the cookie expires and the session is destroyed if remember me IS selected. ## Value of 0 disables remember me. remember_me_duration: 1M ## ## Redis Provider ## ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html ## redis: host: whatever port: 6379 ## Use a unix socket instead # host: /var/run/redis/redis.sock ## Username used for redis authentication. This is optional and a new feature in redis 6.0. # username: authelia ## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html #password: authelia ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc). database_index: 0 ## The maximum number of concurrent active connections to Redis. maximum_active_connections: 8 ## The target number of idle connections to have open ready for work. Useful when opening connections is slow. minimum_idle_connections: 0 ## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s). # tls: ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option). # server_name: myredis.example.com ## Skip verifying the server certificate (to allow a self-signed certificate). ## In preference to setting this we strongly recommend you add the public portion of the certificate to the ## certificates directory which is defined by the `certificates_directory` option at the top of the config. # skip_verify: false ## Minimum TLS version for the connection. # minimum_version: TLS1.2 ## The Redis HA configuration options. ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name). # high_availability: ## Sentinel Name / Master Name. # sentinel_name: mysentinel ## Specific password for Redis Sentinel. The node username and password is configured above. # sentinel_password: sentinel_specific_pass ## The additional nodes to pre-seed the redis provider with (for sentinel). ## If the host in the above section is defined, it will be combined with this list to connect to sentinel. ## For high availability to be used you must have either defined; the host above or at least one node below. # nodes: # - host: sentinel-node1 # port: 6379 # - host: sentinel-node2 # port: 6379 ## Choose the host with the lowest latency. # route_by_latency: false ## Choose the host randomly. # route_randomly: false ## ## Regulation Configuration ## ## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are made ## in a short period of time. regulation: ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation. max_retries: 3 ## The time range during which the user can attempt login before being banned. The user is banned if the ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation. ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format find_time: 2m ## The length of time before a banned user can login again. Ban Time accepts duration notation. ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format ban_time: 5m ## ## Storage Provider Configuration ## ## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers. storage: ## ## Local (Storage Provider) ## ## This stores the data in a SQLite3 Database. ## This is only recommended for lightweight non-stateful installations. ## ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html ## # local: # path: /config/db.sqlite3 ## ## MySQL / MariaDB (Storage Provider) ## mysql: host: whatever port: 3306 database: autheliadb username: authelia ## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html password: xyz ## ## PostgreSQL (Storage Provider) ## # postgres: # host: 127.0.0.1 # port: 5432 # database: authelia # username: authelia # ## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html # password: mypassword # sslmode: disable ## ## Notification Provider ## ## Notifications are sent to users when they require a password reset, a U2F registration or a TOTP registration. ## The available providers are: filesystem, smtp. You must use only one of these providers. notifier: ## You can disable the notifier startup check by setting this to true. disable_startup_check: true ## ## File System (Notification Provider) ## ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html ## # filesystem: # filename: /config/notification.txt ## ## SMTP (Notification Provider) ## ## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate. ## [Security] By default Authelia will: ## - force all SMTP connections over TLS including unauthenticated connections ## - use the disable_require_tls boolean value to disable this requirement ## (only works for unauthenticated connections) ## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates ## (configure in tls section) smtp: username: test ## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html password: password host: 127.0.0.1 port: 1025 sender: [email protected] ## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost. identifier: localhost ## Subject configuration of the emails sent. {title} is replaced by the text from the notifier. subject: "[Authelia] {title}" ## This address is used during the startup check to verify the email configuration is correct. ## It's not important what it is except if your email server only allows local delivery. startup_check_address: [email protected] disable_require_tls: false disable_html_emails: false tls: ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option). # server_name: smtp.example.com ## Skip verifying the server certificate (to allow a self-signed certificate). ## In preference to setting this we strongly recommend you add the public portion of the certificate to the ## certificates directory which is defined by the `certificates_directory` option at the top of the config. skip_verify: false ## Minimum TLS version for either StartTLS or SMTPS. minimum_version: TLS1.2 ## Sending an email using a Gmail account is as simple as the next section. ## You need to create an app password by following: https://support.google.com/accounts/answer/185833?hl=en # smtp: # username: [email protected] # ## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html # password: yourapppassword # sender: [email protected] # host: smtp.gmail.com # port: 587 ## ## Identity Providers ## # identity_providers: ## ## OpenID Connect (Identity Provider) ## ## It's recommended you read the documentation before configuration of this section: ## https://www.authelia.com/docs/configuration/identity-providers/oidc.html # oidc: ## The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens). ## HMAC Secret can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html # hmac_secret: this_is_a_secret_abc123abc123abc ## The issuer_private_key is used to sign the JWT forged by OpenID Connect. ## Issuer Private Key can also be set using a secret: https://docs.authelia.com/configuration/secrets.html # issuer_private_key: | # --- KEY START # --- KEY END ## Clients is a list of known clients and their configuration. # clients: # - ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration. # id: myapp ## The description to show to users when they end up on the consent screen. Defaults to the ID above. # description: My Application ## The client secret is a shared secret between Authelia and the consumer of this client. # secret: this_is_a_secret ## The policy to require for this client; one_factor or two_factor. # authorization_policy: two_factor ## Redirect URI's specifies a list of valid case-sensitive callbacks for this client. # redirect_uris: # - https://oidc.example.com:8080/oauth2/callback ## Scopes defines the valid scopes this client can request # scopes: # - openid # - groups # - email # - profile ## Grant Types configures which grants this client can obtain. ## It's not recommended to define this unless you know what you're doing. # grant_types: # - refresh_token # - "authorization_code ## Response Types configures which responses this client can be sent. ## It's not recommended to define this unless you know what you're doing. # response_types: # - code ...

Interesting. I got suddenly DNS resolution issues too in Unraid . And I did a firewall upgrade too . However I have restored my FW configuration and even tested with a basic consumer router , no joy in DNS resolution on Unraid (but I do have internet connectivity) . I will keep researching .

Did all the network troubleshooting. Even set a TMP router to test this behavior but not luck . This must be a sort of bug related to hardware (CPU) overclocking since I do have connectivity on Unraid but not name resolution . I will cool down my overclock and test again . No big deal . This case can be considered solved . Thanks for the support .

Thanks Squid , I force via FW rule , to let the clients only use OPNsense as DNS server (which has cloudflare upstream) . Clients can't override it . However OPNsense work with Unbound which might be tricky . I have also disabled the rule and set manually 1.1.1.1 in Unraid netowrk settings. States have been reset but no changes in Unraid behavior. I can only think the fact that I got Realtek but it is supported currently in Unraid . With this configuration , Unraid always worked and the rest of the clients can resolve . So a bit of weird situation but I will double check that too . cheers ,

Hello beautiful peoples , The fix common problems plugin , asked me to check via mcelog some hardware events . As well the tool recommend to contact the community support , so I'm here This is what I got : Apr 28 19:29:47 BlackHole kernel: mce: [Hardware Error]: Machine check events logged Apr 28 19:29:47 BlackHole kernel: [Hardware Error]: Corrected error, no action required. Apr 28 19:29:47 BlackHole kernel: [Hardware Error]: CPU:8 (17:71:0) MC3_STATUS[-|CE|MiscV|-|-|-|SyndV|-|-|-]: 0x9820000000010150 Apr 28 19:29:47 BlackHole kernel: [Hardware Error]: IPID: 0x000300b000000000, Syndrome: 0x000000001a000202 Apr 28 19:29:47 BlackHole kernel: [Hardware Error]: Decode Unit Ext. Error Code: 1, Micro-op cache data parity error. Apr 28 19:29:47 BlackHole kernel: [Hardware Error]: cache level: RESV, tx: INSN, mem-tx: IRD Apr 28 19:34:00 BlackHole root: Fix Common Problems Version 2021.04.25a Apr 28 19:34:05 BlackHole root: Fix Common Problems: Error: Machine Check Events detected on your server Seems that is something related with my Ryzen CPU , which is OC up to 42.00 from the base 36.00 Mhz clock . So far with my CPU overclocked , I never had a complain , but this error, somehow, is affecting name resolution (DNS) services . Seems to me a coincidence , but as per now, I got internet connectivity on my Unraid, but I can't resolve GitHub for Dockers purposes. So the community plugin (which I have the latest) , can't resolve the repo . Strange things and really seems not related . Attached the log dump and thanks for the help . Maybe there is something in the log that I'm missing . blackhole-diagnostics-20210428-2031.zip

Hi All , in case you own the firewall in the subject and (like me) are currently going crazy with certbot (SWAG and similar) failing the verification challenge, be aware that on the Netgate forum users are indeed reporting that NAT (pure or reflection) is currently broken . Just FYI in case you are sweating like me :) Cheers, PFsense CE 2.5.1 NAT broken on interface != default WAN | Netgate Forum

Thanks champ , I'm up and running. In general , Realtek is no longer niche and should be set as standard in kernel build .

Hello All , just got a new build an I really want to try hard Unraid. My bad I forgot to check the NIC on my Motherboard (https://www.gigabyte.com/Motherboard/B550I-AORUS-PRO-AX-rev-10/sp#sp) , yes realtek :( . If possible I would like to request to integrate the drivers for this NIC , otherwise can't set a fix IP or get one from my DHCP (PfSense) . Should be this: https://www.realtek.com/en/component/zoo/category/network-interface-controllers-10-100-1000m-gigabit-ethernet-pci-express-software Thank you so much in advance . Looking forward to try Unraid ! (please don't let me go FreeBSD :) )