52 lines
2.3 KiB
YAML
52 lines
2.3 KiB
YAML
##
|
|
## Access Control Configuration
|
|
##
|
|
## Access control is a list of rules defining the authorizations applied for one resource to users or group of users.
|
|
##
|
|
## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed
|
|
## to anyone. Otherwise restrictions follow the rules defined.
|
|
##
|
|
## Note: One can use the wildcard * to match any subdomain.
|
|
## It must stand at the beginning of the pattern. (example: *.example.com)
|
|
##
|
|
## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct.
|
|
##
|
|
## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'.
|
|
##
|
|
## - 'domain' defines which domain or set of domains the rule applies to.
|
|
##
|
|
## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not
|
|
## provided. If provided, the parameter represents either a user or a group. It should be of the form
|
|
## 'user:<username>' or 'group:<groupname>'.
|
|
##
|
|
## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'.
|
|
##
|
|
## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter
|
|
## is optional and matches any resource if not provided.
|
|
##
|
|
## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies.
|
|
access_control:
|
|
default_policy: deny
|
|
rules:
|
|
# Support for one factor for qbittorrent API
|
|
# Only users in "qbittorrent-basic" should be allowed to do so
|
|
- domain_regex: '^qbittorrent-api\.'
|
|
policy: one_factor
|
|
subject:
|
|
- 'group:qbittorrent-basic'
|
|
# Disable authentication on API protected by API keys.
|
|
# Note those are behind authelia, therefore external access to the API; internal access doesn't require a bypass
|
|
- domain_regex: '^(sabnzbd|prowlarr|radarr|sonarr|bazarr|readarr-audiobook|readarr-ebook)\.'
|
|
policy: bypass
|
|
resources:
|
|
- '^/api(/|\?|$)'
|
|
- domain_regex: '^prowlarr\.'
|
|
policy: bypass
|
|
resources:
|
|
- '^/[0-9]+/api\?' # Allow Torznab/Newznab access
|
|
# Effective default policy, only allow admins with two-factor
|
|
- domain_regex: '.*'
|
|
policy: two_factor
|
|
subject:
|
|
- 'group:admins'
|