feat: add Redis for Authelia session storage

.vscode/extensions.json

@@ -1,3 +1,7 @@
 {
-  "recommendations": ["hashicorp.terraform", "esbenp.prettier-vscode"]
+  "recommendations": [
+    "esbenp.prettier-vscode",
+    "hashicorp.terraform",
+    "redis.redis-for-vscode"
+  ]
 }

files/authelia.configuration.yml

@@ -54,6 +54,11 @@ session:
       domain: '{{ env "SERVER_DOMAIN" }}'
       authelia_url: 'https://auth.{{ env "SERVER_DOMAIN" }}'
       same_site: lax
+  redis:
+    host: "redis"
+    port: 6379
+    username: "jeremy"
+    password: '{{ secret "/run/secrets/authelia-redis-password" }}'
 
 # Regulation Configuration
 regulation:

files/docker-compose.yml

@@ -153,6 +153,7 @@ services:
         "storage-encryption-key",
         "hmac-secret",
         "authelia-oidc-signing-key",
+        "authelia-redis-password",
       ]
 
   wg-easy:
@@ -173,6 +174,24 @@ services:
     ports:
       - 51820:51820/udp
 
+  redis:
+    container_name: redis
+    image: redis:8
+    restart: unless-stopped
+    command: redis-server /usr/local/etc/redis/redis.conf
+    volumes:
+      - /mnt/oraclevdb/redis/:/data/
+    configs:
+      - source: redis-config
+        target: /usr/local/etc/redis/redis.conf
+        uid: "999"
+        gid: "999"
+    secrets:
+      - source: redis-users-acl
+        target: /usr/local/etc/redis/users.acl
+        uid: "999"
+        gid: "999"
+
 configs:
   rclone-config:
     file: ./rclone.conf
@@ -193,6 +212,8 @@ configs:
     file: ./fah.config.xml
   authelia-config:
     file: ./authelia.configuration.yml
+  redis-config:
+    file: ./redis.conf
 
 secrets:
   vaultwarden-database-url:
@@ -211,3 +232,7 @@ secrets:
     file: "./storage-encryption-key"
   authelia-oidc-signing-key:
     file: "./authelia-oidc-signing-key"
+  authelia-redis-password:
+    file: "./authelia-redis-password"
+  redis-users-acl:
+    file: "./redis.users.acl"

files/redis.conf

@@ -0,0 +1,26 @@
+# Network
+bind 0.0.0.0
+protected-mode no
+port 6379
+tcp-keepalive 300
+
+# Snapshotting
+save 900 1
+save 300 10
+save 60 10000
+
+# Security
+aclfile /usr/local/etc/redis/users.acl
+
+# Memory management
+maxmemory 256mb
+maxmemory-policy allkeys-lru
+
+# Append only Mode
+appendonly yes
+appendfsync everysec
+auto-aof-rewrite-percentage 100
+auto-aof-rewrite-min-size 64mb
+
+# General
+loglevel notice

main.tf

@@ -79,7 +79,7 @@ resource "oci_vault_secret" "authelia_oidc_signing_key" {
 }
 
 locals {
-  authelia_secrets = ["hmac_secret", "jwt_secret", "session_secret", "storage_encryption_key"]
+  authelia_secrets = ["hmac_secret", "jwt_secret", "session_secret", "storage_encryption_key", "redis_password"]
 }
 
 resource "oci_vault_secret" "authelia" {
@@ -372,6 +372,10 @@ locals {
           path    = "/home/jeremy/storage-encryption-key",
           content = local.authelia.storage_encryption_key
         },
+        {
+          path    = "/home/jeremy/authelia-redis-password",
+          content = local.authelia.redis_password
+        },
         {
           path    = "/home/jeremy/htpasswd",
           content = "${var.rclone_config.username}:${bcrypt(var.rclone_config.password)}",
@@ -426,6 +430,18 @@ locals {
             }
           }))
         },
+        {
+          encoding = "gzip+base64"
+          path     = "/home/jeremy/redis.conf",
+          content  = base64gzip(file("${path.module}/files/redis.conf"))
+        },
+        {
+          encoding = "gzip+base64"
+          path     = "/home/jeremy/redis.users.acl",
+          content = base64gzip(templatefile("${path.module}/templates/redis.users.acl.tftpl", {
+            password = sha256(local.authelia.redis_password)
+          }))
+        },
         {
           encoding = "gzip+base64",
           path     = "/home/jeremy/gatus-config.yaml",

templates/redis.users.acl.tftpl

@@ -0,0 +1,2 @@
+user default off sanitize-payload resetchannels -@all
+user jeremy on sanitize-payload #${password} ~* &* +@all