Configuring Authelia w/ nginx proxy manager

### Files to be installed on nginx proxy server

#### auth.conf
##/nginx/auth.conf
#Basic Authelia Config
#Send a subsequent request to Authelia to verify if the user is authenticated
#and has the right permissions to access the resource.

auth_request /authelia;

#Set the target_url variable based on the request. It will be used to build the portal
#URL with the correct redirection parameter.

auth_request_set $target_url $scheme://$http_host$request_uri;

#Set the X-Forwarded-User and X-Forwarded-Groups with the headers
#returned by Authelia for the backends which can consume them.
#This is not safe, as the backend must make sure that they come from the
#proxy. In the future, it's gonna be safe to just use OAuth.

auth_request_set $user $upstream_http_remote_user;
auth_request_set $groups $upstream_http_remote_groups;
auth_request_set $name $upstream_http_remote_name;
auth_request_set $email $upstream_http_remote_email;
proxy_set_header Remote-User $user;
proxy_set_header Remote-Groups $groups;
proxy_set_header Remote-Name $name;
proxy_set_header Remote-Email $email;

#If Authelia returns 401, then nginx redirects the user to the login portal.
#If it returns 200, then the request pass through to the backend.
#For other type of errors, nginx will handle them as usual.

error_page 401 =302 https://auth.EXAMPLE.COM/?rd=$target_url; # Change domain to match yours

#### auth_proxy.conf
##/nginx/auth_proxy.conf
location /authelia {
internal;
set $upstream_authelia http://10.10.10.1:9091/api/verify; # Change IP & port to match Authelia server
proxy_pass_request_body off;
proxy_pass $upstream_authelia;
proxy_set_header Content-Length "";

#Timeout if the real server is dead
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
client_body_buffer_size 128k;
proxy_set_header Host $host;
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_redirect http:// $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 4 32k;

send_timeout 5m;
proxy_read_timeout 240;
proxy_send_timeout 240;
proxy_connect_timeout 240;
}

### Advanced Configs for nginx hosts

#### For Authelia Proxy Host
location / {
set $upstream_authelia http://10.10.10.1:9091; #NEEDS TO MATCH YOUR AUTHELIA SERVER IP & PORT
proxy_pass $upstream_authelia;
client_body_buffer_size 128k;

#Timeout if the real server is dead
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;

#Advanced Proxy Config
send_timeout 5m;
proxy_read_timeout 360;
proxy_send_timeout 360;
proxy_connect_timeout 360;

#Basic Proxy Config
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Uri $request_uri;
proxy_set_header X-Forwarded-Ssl on;
proxy_redirect http:// $scheme://;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_cache_bypass $cookie_session;
proxy_no_cache $cookie_session;
proxy_buffers 64 256k;

#If behind reverse proxy, forwards the correct IP
#set_real_ip_from 10.0.0.0/8;
#set_real_ip_from 172.0.0.0/8;
#set_real_ip_from 192.168.0.0/16;
#set_real_ip_from fc00::/7;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
}

#### For Protected Proxy Hosts
include /data/nginx/snippets/auth_proxy.conf;

location / {

proxy_pass http://10.10.10.20:80; #Match IP:port of destination content server
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

include /data/nginx/snippets/auth.conf; #Protect this endpoint
}

### Files to be installed on Authelia server

#### users_database.yml
##/config/users_database.yml
users:
USER:
displayname: "USER"
password: "$argon2id$v=19$m=65536,t=1,p=<INSERT ARGON HASHED PASSWORD>"
email: USER@EXAMPLE.COM
groups:
- admins

#### configuration.yml
###/config/configuration.yml
#yamllint disable rule:comments-indentation
---
#################################
#################################
# Authelia Configuration #
#################################
#################################

##Note: the container by default expects to find this file at /config/configuration.yml.

theme: dark
jwt_secret: <INSERT SUPER SECRET PASSWORD HERE>

default_redirection_url: https://LANDINGPAGE.EXAMPLE.COM

##
##Server Configuration
##
server:
host: 0.0.0.0
port: 9091
path: ""

asset_path: /config/assets/

read_buffer_size: 4096
write_buffe_size: 4096
enable_pprof: false
enable_expvars: false
disable_healthcheck: false

##Log Configuration
##
log:
level: debug
file_path: /config/authelia.log

keep_stdout: false

##
##TOTP Configuration
##
##Parameters used for TOTP generation.
totp:
issuer: EXAMPLE.COM
algorithm: sha1
digits: 6
period: 30
skew: 1

##
##NTP Configuration
##
##This is used to validate the servers time is accurate enough to validate TOTP.
ntp:
address: "pool.time.org:123"
version: 4
max_desync: 3s
disable_startup_check: false
disable_failure: false

##
##Authentication Backend Provider Configuration
##
##Used for verifying user passwords and retrieve information such as email address and groups users belong to.
##
##The available providers are: \file\\file, \ldap\\ldap. You must use only one of these providers.
authentication_backend:

disable_reset_password: false
refresh_interval: 5m

file:
path: /config/users_database.yml
password:
algorithm: argon2id
iterations: 1
key_length: 32
salt_length: 16
memory: 1024
parallelism: 8

access_control:
default_policy: deny
rules:
- domain:
- "*.pub.EXAMPLE.COM"
- "auth.EXAMPLE.COM"
policy: bypass
- domain: "*.EXAMPLE.COM"
subject: "group:admin"
policy: one_factor
- domain: "*.EXAMPLE.COM"
policy: one_factor
- domain: "*.priv.EXAMPLE.COM"
policy: two_factor

##
##Session Provider Configuration
##
##The session cookies identify the user once logged in.
##The available providers are: \memory\\memory, \redis\\redis. Memory is the provider unless redis is defined.
session:
name: authelia_session
domain: EXAMPLE.COM
same_site: lax
secret: <INSERT AUTHELIA SECRET HERE>
expiration: 1h
inactivity: 5m
remember_me_duration: 1M

##
##Regulation Configuration
##
##This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are made in a short period of time.
regulation:
max_retries: 3
find_time: 2m
ban_time: 5m

##
##Storage Provider Configuration
##
##The available providers are: \local\\, \mysql\\, \postgres\\. You must use one and only one of these providers.
storage:
encryption_key: <INSERT DATABASE KEY HERE>
local:
path: /config/db.sqlite3

##
##Notification Provider
##
##Notifications are sent to users when they require a password reset, a U2F registration or a TOTP registration.
##The available providers are: filesystem, smtp. You must use only one of these providers.
notifier:
disable_startup_check: false
filesystem:
filename: /config/notification.txt
...