Authelia + SQLite (Docker)

Setup minimal Authelia v4 pakai SQLite, port 9091 dibuka langsung, tanpa external network. Referensi: https://www.authelia.com/integration/deployment/docker/ (varian Secrets Volume, disederhanakan).

Struktur

.
├── compose.yml
├── config/
│   ├── configuration.yml
│   ├── users_database.yml
│   ├── db.sqlite3            # auto-create saat start pertama
│   └── notification.txt      # notifier filesystem
├── secrets/
│   ├── JWT_SECRET
│   ├── SESSION_SECRET
│   └── STORAGE_ENCRYPTION_KEY
├── log.txt         # hasil pengujian terbaru (15 langkah)
├── curl.md         # dokumentasi curl + Postman
└── README.md

Cara jalan

cd /data/Docker/authelia2
docker compose up -d
docker compose ps
docker logs authelia --tail 50
curl -sk http://127.0.0.1:9091/api/health
# -> {"status":"OK"}

Buka: http://IP-server:9091. User: admin / admin123, authelia / authelia. Login bisa pakai username ATAU email (search.email: true), via domain auth.example.com (lihat curl.md), bukan IP langsung.

Konvensi user

• username = key di bawah users: (admin, authelia) — ID login, unik, lowercase, jangan diganti setelah dipakai.
• displayname = nama penuh untuk sapaan portal. Contoh: 'Budi Santoso, S.Kom'.
• Atribut tambahan extra: {nup, bagian, jabatan} — didaftarkan di authentication_backend.file.extra_attributes (value_type: string), dipakai untuk OIDC claims / CEL, tidak muncul di /api/state.

Konfigurasi penting

• server.address: tcp://0.0.0.0:9091/ → listen semua interface, IP dinamis / 2 jaringan tetap bisa diakses. Terbukti: 192.168.1.17:200, 198.168.2.171:200.
• storage.local.path: /config/db.sqlite3 → SQLite, tanpa Postgres.
• authentication_backend.file → users_database.yml (argon2). search.email: true → login pakai username atau email. extra_attributes: nup, bagian, jabatan → data pegawai per user.
• session.cookies.domain: example.com → wajib diganti domain asli untuk SSO produksi. Akses IP langsung hanya untuk tes portal; cookie tidak persisten via IP.
• notifier.filesystem → email 2FA/reset tersimpan di notification.txt.
• ntp.disable_startup_check: true → bisa jalan offline.
• Secret via ENV _FILE → /secrets/*, bukan hardcode di YAML.
• session.remember_me: '5 years' → cookie 5 tahun bila user centang Ingat Saya (keepMeLoggedIn: true di API). Tanpa itu berlaku expiration: 1h.

Ganti password user

docker run --rm docker.io/authelia/authelia:latest authelia crypto hash generate argon2 --password 'baru'
# paste hasilnya ke config/users_database.yml -> password:

Ganti domain (wajib sebelum SSO)

Edit config/configuration.yml:

session:
  cookies:
    - domain: 'domainanda.com'
      authelia_url: 'https://auth.domainanda.com'

Validasi

docker compose config --quiet && echo VALID
docker run --rm -v ./config:/config -v ./secrets:/secrets \
  -e AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE=/secrets/JWT_SECRET \
  -e AUTHELIA_SESSION_SECRET_FILE=/secrets/SESSION_SECRET \
  -e AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE=/secrets/STORAGE_ENCRYPTION_KEY \
  docker.io/authelia/authelia:latest authelia --config /config/configuration.yml config validate

Detail hasil tes: lihat log.txt (15 langkah: compose, validate, port, health 3 IP, login username, login email, password salah, IP langsung, logs, inspect). Contoh curl / Postman: lihat curl.md.