User Tools

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
en:install_authelia_on_debian_without_docker [2026-08-19 13:41] – iacchien:install_authelia_on_debian_without_docker [2026-08-20 15:37] (current) – iacchi
Line 83: Line 83:
 ==== Server section ==== ==== Server section ====
  
-The server section for a normal installation is fairly simple, and you just need to specify the local address for the server. Before the server section you can also define the theme for the login website.+The server section for a normal installation is fairly simple, and you just need to specify the local address for the server. Before the server section you can also define the theme for the login website. The endpoints section and all that comes after is needed for Authelia to work behind an Nginx proxy.
  
 <code yaml> <code yaml>
Line 91: Line 91:
 server: server:
   address: 'tcp://127.0.0.1:9091/'   address: 'tcp://127.0.0.1:9091/'
 +  endpoints:
 +    authz:
 +      auth-request:
 +        implementation: 'AuthRequest'
 </code> </code>
  
Line 130: Line 134:
 identity_validation: identity_validation:
   reset_password:   reset_password:
-    jwt_secret: {{fileContent "./secrets/jwt_secret"}}+    jwt_secret: {{fileContent "/etc/authelia/secrets/jwt_secret"}}
 </code> </code>
  
Line 184: Line 188:
 <code yaml> <code yaml>
 session: session:
-  secret: {{fileContent "./secrets/session_secret"}}+  secret: {{fileContent "/etc/authelia/secrets/session_secret"}}
   name: 'mydomain.tld_session'   name: 'mydomain.tld_session'
   cookies:   cookies:
Line 215: Line 219:
 <code yaml> <code yaml>
 storage: storage:
-  encryption_key: {{fileContent "./secrets/storage_secret"}}+  encryption_key: {{fileContent "/etc/authelia/secrets/storage_secret"}}
   mysql:   mysql:
     address: 'tcp://127.0.0.1:3306'     address: 'tcp://127.0.0.1:3306'
     database: 'authelia'     database: 'authelia'
     username: 'authelia'     username: 'authelia'
-    password: {{fileContent "./secrets/mysql_password"}}+    password: {{fileContent "/etc/authelia/secrets/mysql_password"}}
 </code> </code>
  
Line 233: Line 237:
     timeout: '10s'     timeout: '10s'
     username: 'authelia@mydoman.tld'     username: 'authelia@mydoman.tld'
-    password: {{fileContent "./secrets/smtp_password"}}+    password: {{fileContent "/etc/authelia/secrets/smtp_password"}}
     sender: '"Authelia" <authelia@mydoman.tld>'     sender: '"Authelia" <authelia@mydoman.tld>'
     identifier: 'auth.mydoman.tld'     identifier: 'auth.mydoman.tld'
Line 247: Line 251:
 identity_providers: identity_providers:
   oidc:   oidc:
-    hmac_secret: {{fileContent "./secrets/hmac_secret"}}+    hmac_secret: {{fileContent "/etc/authelia/secrets/hmac_secret"}}
     jwks:     jwks:
-      - key: {{ secret "./secrets/private-RS256.pem" | mindent 10 "|" | msquote }} +      - key: {{ secret "/etc/authelia/secrets/private-RS256.pem" | mindent 10 "|" | msquote }} 
-      - key: {{ secret "./secrets/private-ES512.pem" | mindent 10 "|" | msquote }}+      - key: {{ secret "/etc/authelia/secrets/private-ES512.pem" | mindent 10 "|" | msquote }}
     authorization_policies:     authorization_policies:
       onefactor_twoadmin:       onefactor_twoadmin:
Line 280: Line 284:
         userinfo_signed_response_alg: 'none'         userinfo_signed_response_alg: 'none'
         token_endpoint_auth_method: 'client_secret_basic'         token_endpoint_auth_method: 'client_secret_basic'
 +...
 </code> </code>
  
Line 286: Line 291:
 <code yaml> <code yaml>
 authelia crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986 authelia crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986
 +</code>
 +
 +===== Test the configuration file =====
 +
 +After editing the configuration file, we can test that all the secrets parse correctly by running:
 +
 +<code bash>
 +authelia config template --config.experimental.filters=template --config=configuration.yml
 +</code>
 +
 +which should output the configuration file with all the secrets in plain text and with the correct indentation. If not, modify the configuration file to fix the issues. Before enabling Authelia as a system service, we can do a quick test run to check if it can start correctly. Run this from the command line:
 +
 +<code bash>
 +authelia --config /etc/authelia/configuration.yml --config.experimental.filters=template
 +</code>
 +
 +If it doesn't throw an error, everything should be fine. The first time you execute it you will actually see an error as the program creates the users file, but that's not a problem. Before we can start Authelia as a system service, we need to fix some file permissions so that it can run with the appropriate user:
 +
 +<code bash>
 +chown -R authelia:authelia /etc/authelia
 +chown authelia:authelia /var/log/authelia.log
 </code> </code>
  
Line 292: Line 318:
 Authelia comes with a systemd service file that needs to be enabled and then edited to allow for the secrets templating that we used in the configuration file to work. Rather than editing the file directly (which would get overwritten in subsequent updates), we'll use systemd tools to do it properly. First, let's enable the service: Authelia comes with a systemd service file that needs to be enabled and then edited to allow for the secrets templating that we used in the configuration file to work. Rather than editing the file directly (which would get overwritten in subsequent updates), we'll use systemd tools to do it properly. First, let's enable the service:
  
-<code yaml>+<code bash>
 cd /usr/lib/systemd/system cd /usr/lib/systemd/system
 systemctl enable authelia.service systemctl enable authelia.service
Line 300: Line 326:
 Your default cli text editor will open at this point. We'll need to put our modifications at the top, between the first and the second comment block. This is what to add: Your default cli text editor will open at this point. We'll need to put our modifications at the top, between the first and the second comment block. This is what to add:
  
-<code>+<code ini>
 [Service] [Service]
 Environment=X_AUTHELIA_CONFIG_FILTERS=template Environment=X_AUTHELIA_CONFIG_FILTERS=template
 </code> </code>
 +
 +After you're done editing the override line, you can refresh systemd (not always necessary, but it doesn't hurt) and restart the service:
 +
 +<code bash>
 +systemctl daemon-reload
 +systemctl restart authelia
 +</code>
 +
 +Authelia should be up and running now on port 9091, listening on localhost.
 +
 +===== Nginx configuration =====
 +
 +Now that Authelia is active, it's time to let it talk to the internet. Go to ''/etc/nginx/sites-available/'' and create an entry for Authelia:
 +
 +<code bash>
 +cd /etc/nginx/sites-available/
 +nano authelia
 +</code>
 +
 +This is the content of the Nginx configuration file, with extra settings for ssl security:
 +
 +<code nginx>
 +server {
 +    listen 443 ssl;
 +    listen [::]:443 ssl;
 +    http2 on;
 +    ssl_certificate     /path/to/cert.crt;
 +    ssl_certificate_key /path/to/cert.key;
 +    server_name auth.mydomain.tld;
 +    access_log /var/log/nginx/authelia-access.log;
 +    error_log  /var/log/nginx/authelia-error.log;
 +
 +    ssl_protocols TLSv1.2 TLSv1.3;
 +    ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1:secp384r1;
 +    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
 +    ssl_prefer_server_ciphers off;
 +    
 +    add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
 +    add_header X-Content-Type-Options nosniff;
 +    add_header X-XSS-Protection "1; mode=block";
 +    add_header X-Robots-Tag none;
 +    add_header X-Download-Options noopen;
 +    add_header X-Permitted-Cross-Domain-Policies none;
 +    
 +    set $upstream http://127.0.0.1:9091;
 +
 +    location / {
 +        # Headers
 +        proxy_set_header Host $host;
 +        proxy_set_header X-Original-URL $scheme://$host$request_uri;
 +        proxy_set_header X-Forwarded-Proto $scheme;
 +        proxy_set_header X-Forwarded-Host $host;
 +        proxy_set_header X-Forwarded-URI $request_uri;
 +        proxy_set_header X-Forwarded-Ssl on;
 +        proxy_set_header X-Forwarded-For $remote_addr;
 +        proxy_set_header X-Real-IP $remote_addr;
 +        ## Basic Proxy Configuration
 +        client_body_buffer_size 128k;
 +        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; ## Timeout if the real server is dead.
 +        proxy_redirect  http://  $scheme://;
 +        proxy_http_version 1.1;
 +        proxy_cache_bypass $cookie_session;
 +        proxy_no_cache $cookie_session;
 +        proxy_buffers 64 256k;
 +        # Trusted Proxies Configuration
 +        real_ip_header X-Forwarded-For;
 +        real_ip_recursive on;
 +        # Advanced Proxy Configuration
 +        send_timeout 5m;
 +        proxy_read_timeout 360;
 +        proxy_send_timeout 360;
 +        proxy_connect_timeout 360;
 +        proxy_pass $upstream;
 +    }
 +}
 +</code>
 +
 +After saving the file, you need to enable the configuration and restart the web server:
 +
 +<code bash>
 +ln -s /etc/nginx/sites-available/authelia /etc/nginx/sites-enabled/
 +systemctl restart nginx
 +</code>
 +
 +Authelia should now be available at https://auth.mydomain.tld