一、准备autherlia安装包

https://github.com/authelia/authelia

image.png

二、创建配置文件

1.运行起来的大致布局（先看一下哈）

image.png

2.手动创建文件users_database.yml里面放入用户数据

格式大概如下

image.png
示例程序

1
2
3
4
5
6
7
users:
  admin: # 自定义账号
    displayname: "Admin"
    password: "$argon2id$v=19$m=65536,t=3,p=4$UC+yj8d9Vd2WjftBMi56PQ$7vBnyxZoJ4ZDseMK2fyA/OhvA9K7uFK5R0V06Ep3D+E" # 自定义密码，注意：这个密码必须是通过argon2推导函数加密后的密码可以在项目目录运行这个指令加密你的密码：./authelia crypto hash generate argon2
    email: admin@test.com # 修改密码时需要邮箱验证（可以默认）
    groups:
      - admins
3.手动创建文件configuration.yml里面放入authelia的配置文件

示例程序

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
server:
  address: 0.0.0.0:9091 # 监听端口
 
identity_validation:
  reset_password:
    jwt_secret: "9b7e4c0e4d7eddf25b3e4dfhjefdf9d8e" # 重置密码时的认证密钥一般用不到注意不要泄露可自定义32位以上
 
authentication_backend:
  file:
    path: /opt/authelia/users_database.yml # users_database.yml文件路径
 
regulation:
  max_retries: 3 # 最大登录错误次数
  find_time: 2m # 2分钟内
  ban_time: 1h # 封ip1小时
 
access_control: # 规则配置(注意：从上往下配对)
  default_policy: two_factor
  rules:
    - domain: "auth.cokey.top" # 服务网页
      policy: one_factor # 这个必须为one...
 
    - domain: "text1.cokey.top"
      resources: # 只保护单路径需要配置
        - "^/admin.*"
      policy: two_factor
 
    - domain: "text2.cokey.top"
      policy: one_factor 
 
    - domain: "*.cokey.top" # （全部子域名）
      policy: two_factor
 
 
session:
  secret: "2a6f9c0b7hfjahdudwf8b7d6e5c4a3b2f" # 自己设置32位以上
  cookies:
    - domain: "cokey.top" # 根域名（根据实际修改）
      authelia_url: "https://auth.cokey.top" # 服务部署的域名（根据实际修改）
 
storage:
  encryption_key: "6f4e3dwdjwiadidwe6d5c4b3a2f1e0d9c" # 数据库加密密钥自己设置32位以上
  local:
    path: /opt/authelia/db.sqlite3 # 数据库位置（启动后自动创建，删除后2fa要重新注册）
 
notifier:
  filesystem:
    filename: /opt/authelia/notification.txt # 注册2fa时需要验证码（在这里面）
4.启动运行注册第一个2fa

启动命令（别忘了给文件赋予运行权限）

1
./authelia --config configuration.yml
5.后面就是守护进程，nginx对接（重点）后面提供对接部分参考程序

如果是全站守护

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
location ^~ / {
    auth_request /internal/authelia/authz; 
    error_page 401 = @authelia_signin;
    proxy_pass http://127.0.0.1:5244; 
    proxy_set_header Host $host; 
    proxy_set_header X-Real-IP $remote_addr; 
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header REMOTE-HOST $remote_addr; 
    proxy_set_header Upgrade $http_upgrade; 
    proxy_set_header Connection $http_connection; 
    proxy_set_header X-Forwarded-Proto $scheme; 
    proxy_set_header X-Forwarded-Port $server_port; 
    proxy_http_version 1.1; 
    add_header X-Cache $upstream_cache_status; 
    proxy_ssl_server_name off; 
    proxy_ssl_name $proxy_host; 
 
 
 
# ......省略部分
 
 
    # ==============================
    # Authelia 官方认证接口
    # ==============================
    location = /internal/authelia/authz {
        internal; 
        proxy_pass http://127.0.0.1:9091/api/authz/auth-request; 
        proxy_pass_request_body off; 
        proxy_set_header Content-Length ""; 
        # 标准端口下直接使用 $host
        proxy_set_header X-Original-URL $scheme://$host$request_uri; 
        proxy_set_header X-Original-Method $request_method; 
        proxy_set_header X-Forwarded-Proto $scheme; 
        proxy_set_header X-Forwarded-Host $host; 
        proxy_set_header X-Forwarded-URI $request_uri; 
        # 直连防伪造 IP 传递
        proxy_set_header X-Forwarded-For $remote_addr; 
        proxy_set_header X-Real-IP $remote_addr; 
    }
    location @authelia_signin {
        return 302 https://auth.cokey.top/?rd=$scheme://$host$request_uri; 
    }

如果是单路径下全守护

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
location ^~ /admin {
    auth_request /internal/authelia/authz;
    error_page 401 = @authelia_signin;
 
    proxy_pass http://127.0.0.1:8080; 
    proxy_set_header Host $host; 
    proxy_set_header X-Real-IP $remote_addr; 
    proxy_set_header X-Forwarded-For $remote_addr; 
    proxy_set_header REMOTE-HOST $remote_addr; 
    proxy_set_header Upgrade $http_upgrade; 
    proxy_set_header Connection $http_connection; 
    proxy_set_header X-Forwarded-Proto $scheme; 
    proxy_set_header X-Forwarded-Port $server_port; 
    proxy_http_version 1.1; 
    add_header X-Cache $upstream_cache_status; 
    proxy_ssl_server_name off; 
    proxy_ssl_name $proxy_host; 
}
 
location ^~ / {
    proxy_pass http://127.0.0.1:8080; 
    proxy_set_header Host $host; 
    proxy_set_header X-Real-IP $remote_addr; 
    proxy_set_header X-Forwarded-For $remote_addr; 
    proxy_set_header REMOTE-HOST $remote_addr; 
    proxy_set_header Upgrade $http_upgrade; 
    proxy_set_header Connection $http_connection; 
    proxy_set_header X-Forwarded-Proto $scheme; 
    proxy_set_header X-Forwarded-Port $server_port; 
    proxy_http_version 1.1; 
    add_header X-Cache $upstream_cache_status; 
    proxy_ssl_server_name off; 
    proxy_ssl_name $proxy_host; 
}# ......省略部分
 
 
 
# ==============================  
# Authelia 官方认证接口
# ==============================
    location = /internal/authelia/authz {
        internal; 
        proxy_pass http://127.0.0.1:9091/api/authz/auth-request; 
        proxy_pass_request_body off; 
        proxy_set_header Content-Length ""; 
        # 标准端口下直接使用 $host
        proxy_set_header X-Original-URL $scheme://$host$request_uri; 
        proxy_set_header X-Original-Method $request_method; 
        proxy_set_header X-Forwarded-Proto $scheme; 
        proxy_set_header X-Forwarded-Host $host; 
        proxy_set_header X-Forwarded-URI $request_uri; 
        # 直连防伪造 IP 传递
        proxy_set_header X-Forwarded-For $remote_addr; 
        proxy_set_header X-Real-IP $remote_addr; 
    }
    location @authelia_signin {
        return 302 https://auth.cokey.top/?rd=$scheme://$host$request_uri; 
    }