This document serves as a get started guide for Authelia. It contains links to various sections and has some key notes in questions frequently asked by people looking to perform setup for the first time.
It’s important to note that this guide has a layout which we suggest as the best order in areas to tackle, but you may obviously choose a different path if you are so inclined.
It’s important to customize the configuration for Authelia in advance of deploying it. The configuration is static and not configured via web GUI. You can find a configuration template on GitHub which can be used as a basis for configuration.
The important sections to consider in initial configuration are as follows:
- jwt_secret which is used to sign identity verification emails
- default_redirection_url which is the default URL users will be redirected to when visiting Authelia directly
- authentication_backend which you must pick between LDAP and a YAML File and is essential for users to authenticate.
- storage which you must pick between the SQL Storage Providers, the recommended one for testing and lite deployments is SQLite3 and the recommended one for production deployments otherwise is PostgreSQL.
- session which is used to configure the session cookies, the domain and secret are the most important, and redis is recommended for production environments.
- notifier which is used to send 2FA registration emails etc, there is an option for local file delivery but the SMTP option is recommended for production.
- access_control is also important but should be configured with a very basic policy to begin with. Something like:
access_control: default_policy: deny rules: - domain: "*.example.com" policy: one_factor
There are several methods of deploying Authelia and we recommend reading the Deployment Documentation in order to perform deployment.
Moving to Production
We consider it important to do several things in moving to a production environment.
- Move all secret values out of the configuration and into secrets.
- Spend time understanding access control and granularly configure it to your requirements.
- Review the Security Measures and Threat Model documentation.
- Ensure you have reviewed the Forwarded Headers documentation to ensure your proxy is not allowing insecure headers to be passed to Authelia.
- Review the other Configuration Options.