In this Authelia setup I will be configuring Authelia to have local authentication and it enforces Smart Card authentication via WedAuthn for secure remote access

This guide is created with the help of Florian Mullers guide that can be found here and has been modified with improvements

Create Secrets and Keys

Run the below command in the UnRAID console and save the output somewhere safe, we will need these later. Put the random string/ key in a file in plain text on the first line.

Create JWT Secret and save it in /mnt/user/appdata/Authelia/secrets/jwtsecret

tr -cd '[:alnum:]' < /dev/urandom | fold -w "64" | head -n 1 | tr -d '\n' ; echo

Create Session Secret and save it in /mnt/user/appdata/Authelia/secrets/session

tr -cd '[:alnum:]' < /dev/urandom | fold -w "64" | head -n 1 | tr -d '\n' ; echo

Storage Encryption Key and save it in /mnt/user/appdata/Authelia/secrets/storage

tr -cd '[:alnum:]' < /dev/urandom | fold -w "64" | head -n 1 | tr -d '\n' ; echo

MariaDB Password and save it in /mnt/user/appdata/Authelia/secrets/mariadb

 If you already have a mariadb password, you need to write it in this file

SMTP Password and save it in /mnt/user/appdata/Authelia/secrets/smtp

 If you already have a smtp password, you need to write it in this file

OIDC HMAC Secret and save it in /mnt/user/appdata/Authelia/secrets/oidcsecret

tr -cd '[:alnum:]' < /dev/urandom | fold -w "64" | head -n 1 | tr -d '\n' ; echo

OIDC Private Key

openssl genrsa -out /mnt/user/appdata/Authelia/secrets/oidc.key 4096

openssl rsa -in /mnt/user/appdata/Authelia/secrets/oidc.key -outform PEM -pubout -out /mnt/user/appdata/Authelia/secrets/oidc.pem

Set the correct privlidges

chmod 600 -R /mnt/user/appdata/Authelia/secrets/
chmod 600 /mnt/user/appdata/Authelia/secrets

Environment Variables

We need to map each of the secret files we created above and map them to an environment variable. You can find a list of all Authelia Environment Variables here

Create the below variables on the Authelia Docker container for all the secrets required. This removes the need for them to be in your configuration.yml file for more security

# basics
AUTHELIA_JWT_SECRET_FILE=/config/secrets/jwtsecret
AUTHELIA_SESSION_SECRET_FILE=/config/secrets/session

# storage / mysql:
AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE=/config/secrets/storage
AUTHELIA_STORAGE_MYSQL_PASSWORD_FILE=/config/secrets/sql

# smtp notifications:
AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE=/config/secrets/smtp

# openid identity provider:
AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE=/config/secrets/oidcsecret
AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE=/config/secrets/oidc.pem

# if you use LDAP for users
AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE=/config/secrets/ldap

# if you user REDIS for session management
AUTHELIA_SESSION_REDIS_PASSWORD_FILE=/config/secrets/redis

# if you want to enable SSL on authelia
AUTHELIA_SERVER_TLS_KEY_FILE=/config/secrets/tlskey

Once all Environment Variables are correct, your UnRAID configuration should look like the below

Configuration.yml

This guide assumes you have Authelia, Redis and SQL already running and the site is accessible from auth.<domain-name>

We will now be doing the advanced configuration to get OpenID Connect and WebAuthn working securely. We will be utilising Docker Enviroment Variables to input our Certificates, Secrets and Tokens for this

1. Refer to the OIDC - configuration.yml page for a copy of our Authelia configuration file. Please input your Authelia domain name, SMTP server and OIDC Shared Secret NOTE: OIDC Shared Secret is not working as a Environemnt Variable in Authelia v4.37.5 and needs to be put directly into the configuration.yml file in plain text

2. Create a OIDC Shared Secret, this will be shared with Cloudflare for OIDC to function.

tr -cd '[:alnum:]' < /dev/urandom | fold -w "64" | head -n 1 | tr -d '\n' ; echo

1. Replace the <OIDC Secret> in the configuration.yml file with the string generated above

2. Authelia should now succesfully boot, if there is an error check the logs and troubleshoot

Cloudflare Zero Trust allows users to register their own Single Sign On (SSO) provider by utilising the OpenID Connect Protocol

Configuration

Login to Cloudflare Zero Trust Portal and open Settings > Authentiation > Add New

Select OpenID Connect and input the below values

Name: Authelia

App ID: authelia

Client Secret: <OIDC Secret>

Auth URL: https://auth.<domain-name>/api/oidc/authorization

Token URL: https://auth.<domain-name>/api/oidc/token

Certificate URL: https://auth.<domain-name>/jwks.json

Once Authelia is running and Cloudflare is enabled. Click Test and attempt to login

Cloudflare Zero Trust allows users to register their own Single Sign On (SSO) provider by utilising the OpenID Connect Protocol. We can now protect our self hosted applications with Authelia

Access Configuration

To reverse proxy an application behind Cloudflare Access. We need to create an "Application" within the Cloudflare Zero Trust dashboard

Naviagate to Access > Applications > Add an Application > Self-Hosted. Enter the domain name you wish the application to have. Cloudflare will automatically create the DNS Record

Follow the Policies and Authentication pages and set the settings you would like to configure for the specific application

Click Save

Tunnel Configuration

We now need to tell Cloudflare how to route to our self-hosted application. Navigate to Access > Tunnels > Tunnel-Name > Configure > Public Hostname > Add a Public Hostname

Once saved, Cloudflare will automatically push the configuration to our Tunnel and the site should be immediatelly accessible via Cloudflare Zero Trust and protected by Authelia via OpenID Connect

To run a Cloudflare Tunnel from UnRAID you will need to manually create the docker container.

Name: Cloudflared Tunnel

Repository: cloudflare/cloudflared:latest

Post Arguments: tunnel --no-autoupdate run --token <tunnel-token>

Icon URL: Any Icon URL you like

Your Tunnel Token can be found by creating a Tunnel within Cloudflare Zero Trust > Access > Tunnels. The token is provided in the docker run command

Once the container is running it will grab it's configuration automatically from Cloudflare and also make 4x seperate TCP/443 connections outbound using the QUIC protocol. The Cloudflare Tunnel should now have a status of "HEALTHY"

Cloudflare Access

Cloudflare access is a product within Cloudflare Zero Trust. Access allows us to share HTTP, SSH and RDP session securely via the Cloudflare Tunnel

Head to Cloudflare Zero Trust > Access > Tunnels > "your tunnel" > Configure > Public Hostname and click Add a public hostname

This configuration is letting our Cloudflare Tunnel know how to route to our Authelia instance in our network. Authelia in my network is listening on https://192.168.0.2:9091 and has a self-signed SSL certificate

Subdomain: auth.<domain-name>

Service: HTTP or HTTPS

URL: IP Address & Port Authelia is listening

NoTLSVerify: Enable this if you are using a self-signed SSL certificate as Cloudflare only trust their own root certificates

Once saved Cloudflare will automatically push this configuration to your Cloudflare Tunnel and it will immediately be accessible via the specifed domain name

auth.<domain-name> is accessible via the internet and has a valid SSL certificate

We have now configured remote access to our Authelia application hosted on UnRAID

Things to note:

• auth.<domain-name> must be accessible by any device needing to authenticate via OIDC

• This is the only site not protected via Zero Trust

• We can create Cloudflare Page Rules to restrict IP Addresses, Countries and others from accessing this site

Need to know

This configuration drops the need for Traekfik or Nginx Proxy Manager and is completely managed by Cloudflare Zero Trust and their Cloudflared Tunnel (HTTPs/ QUIC Protocol)

At the end of this you will be able to securely access your HTTP, SSH and RDP session remotely via Cloudflare anywhere in the world

Prerequisites

• UnRAID

• Domain name registered with Cloudflare

• Cloudflared Tunnel running (not legacy Argo Tunnel)

• NO Traefik or Nginx Proxy Manager needed

Support Us

Our work sometimes takes months to research and develop. If you want to help support us, please consider:

• Liking and Subscribing to our YouTube channel

• Joining our Discord server

• Becoming a paid member on our IBRACORP website

• Donating via PayPal

Thank you for being part of our community!

Cloudflare Page Rules

I have enabled a few extra features in the Cloudflare Dashboard to disable the Cloudflare CDN Cache. I was noticing with cache enabled it was affecting certain applications

Cloudflare SSL

I have enforced Full (Strict) SSL Encryption. This can be done under SSL/TLS > Overview

Under SSL/TLS > Edge Certificates, I have enabled the below

Always use HTTPS: Enabled

HTTP Strict Transport Security (HSTS): Enabled

Minimum TLS Version: TLS 1.3

Automatic HTTPS Rewrites: Enabled

Cloudflare WAF

Utilising Cloudflare WAF (Web Application Firewall) I have only allowed connections originating from Australia access. This drastically reduced connections to my site and improved security