Traefik + Authelia

authelia.yml

version: "3.3"
services:
  authelia:
    image: authelia/authelia:4.20.0
    volumes:
      - /home/username/authelia:/config
    networks:
      - traefik-public
    deploy:
      placement:
        constraints:
          - node.hostname == nodename
      labels:
        - traefik.enable=true
        - traefik.docker.network=traefik-public
        - traefik.http.routers.authelia-http.rule=Host(`auth.my.domain`)
        - traefik.http.routers.authelia-http.middlewares=https-redirect
        - traefik.http.routers.authelia-http.entrypoints=http
        - traefik.http.routers.authelia-https.rule=Host(`auth.my.domainh`)
        - traefik.http.routers.authelia-https.entrypoints=https
        - traefik.http.routers.authelia-https.tls=true
        - traefik.http.routers.authelia-https.tls.certresolver=le
        - traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.my.domain/
        - traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true
        - traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User, Remote-Groups, Remote-Name, Remote-Email
        - traefik.http.services.authelia.loadbalancer.server.port=9091
    environment:
      - TZ=America/New_York

networks:
  traefik-public:
    external: true

configuration.yml

host: 0.0.0.0
port: 9091

server:
  read_buffer_size: 4096
  write_buffer_size: 4096
  path: ""
log_level: debug
jwt_secret: secret
default_redirection_url: https://default.my.domain
totp:
  issuer: authelia.com
  period: 30
  skew: 1
authentication_backend:
  disable_reset_password: false
  refresh_interval: 5m
  file:
    path: /config/users_database.yml
    password:
      algorithm: argon2id
      iterations: 1
      key_length: 32
      salt_length: 16
      memory: 1024
      parallelism: 8
access_control:
  default_policy: deny
  rules:
    - domain:
      - secure1.my.domain
      - secure2.my.domain
      policy: two_factor
    - domain:
      - lesssecure.my.domain
      policy: one_factor
session:
  name: authelia_session
  secret: secret
  expiration: 1h
  inactivity: 5m
  remember_me_duration: 1M
  domain: smy.domain
regulation:
  max_retries: 3
  find_time: 2m
  ban_time: 5m
storage:
  local:
    path: /config/db.sqlite3
notifier:
  disable_startup_check: false
  smtp:
    username: username@gmail.com
  ##   # Password can also be set using a secret: https://docs.authelia.com/configuration/secrets.html
    password: *google app password*
    sender: account@my.domain
    host: smtp.gmail.com
    port: 587

users_database.yml

users:
  username:
    password: *argon2id hashed password*
    email: email@address
    groups:
      - admins
      - dev