# Stockage (fichier SQLite local) – suffisant pour commencer
storage:
    local:
        path: /config/db.sqlite3

# Base de données des utilisateurs (fichier)
authentication_backend:
    file:
        path: /config/users.yml

# Accès par défaut (à ajuster selon tes besoins)
access_control:
    default_policy: deny
    rules:
        - domain: "paperless.crenam.space"
          policy: one_factor
        - domain: "git.crenam.space"
          policy: one_factor
        - domain: "task.crenam.space"
          policy: one_factor
        - domain: "salon.home"
      

# Session et cookie
session:
    cookies:
        - name: authelia_session
          domain: crenam.space
          authelia_url: "https://auth.crenam.space"
          default_redirection_url: "https://dashboard.crenam.space"
          expiration: '16h'
# Notifications (par mail – on laisse vide pour le moment, pas de SMTP)
notifier:
    filesystem:
        filename: /config/notifications.yml

# clients
# identity_providers:
## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
## See: https://www.authelia.com/c/oidc
  # oidc:
  #   jwks:
  #     - key: {{ secret "/secrets/private.pem" | mindent 10 "|" | msquote }}
  #       certificate_chain: {{ secret "/secrets/public.crt" | mindent 10 "|" | msquote }}

  #   clients:
#########################################
#     sso configuration for vikunja     #
#########################################
      # - client_id: 'vikunja'
      #   client_name: 'Vikunja'
      #   client_secret: '$pbkdf2-sha512$310000$hPnUYU6BCaRSZYulOiWXwA$5hsAJD494cyoQ/X9JlAbsMF//yGDg009lfDe2WhGQjl5JA>
      #   public: false
      #   authorization_policy: 'one_factor'
      #   require_pkce: false
      #   pkce_challenge_method: ''
      #   redirect_uris:
      #     - 'https://task.crenam.space/auth/openid/authelia'
      #     - 'https://task.crenam.space/login?redirectToProvider=authentik'
      #   scopes:
      #     - 'openid'
      #     - 'profile'
      #     - 'email'
      #   response_types:
      #     - 'code'
      #   grant_types:
      #     - 'authorization_code'
      #   access_token_signed_response_alg: 'none'
      #   userinfo_signed_response_alg: 'none'
      #   token_endpoint_auth_method: 'client_secret_post'

#########################################
#         config sso for gitea          #
#########################################
      # - client_id: 'gitea'
      #   client_name: 'Gitea'
      #   client_secret: '$pbkdf2-sha512$310000$pJR7colZSiWF7SWIfUsoqg$IGGqIZGVqcpXpzVCBgptZ3zBMqpFk4oaIKvOZPa1fn/GIg>
      #   public: false
      #   authorization_policy: 'one_factor'
      #   require_pkce: false
      #   pkce_challenge_method: ''
      #   redirect_uris:
      #     - 'https://git.crenam.space/user/oauth2/authelia/callback'
      #   scopes:
      #     - 'openid'
      #     - 'email'
      #     - 'profile'
      #   response_types:
      #     - 'code'
      #   grant_types:
      #     - 'authorization_code'
      #   access_token_signed_response_alg: 'none'
      #   userinfo_signed_response_alg: 'none'
      #   token_endpoint_auth_method: 'client_secret_basic'