38 lines
1.4 KiB
Bash
38 lines
1.4 KiB
Bash
# required, if missing will generate random values
|
|
# encryption key used to store sessions (static random bytes) in base64
|
|
PREAUTH_KEY=''
|
|
# TOTP (RFC 6238) secret/token (static random bytes) in base32
|
|
PREAUTH_TOKEN=''
|
|
|
|
# optional, change time-to-live, subdomain, default-redirect, text or colors
|
|
# how long a session lasts (in minutes): 43200 is 30 days
|
|
PREAUTH_TTL=43200
|
|
PREAUTH_SUBDOMAIN='preauth'
|
|
PREAUTH_SEND_TO='https://secure.example.com/'
|
|
PREAUTH_BACKGROUND='#029386'
|
|
PREAUTH_FOREGROUND='#ffffff'
|
|
PREAUTH_TITLE='Pre-Authentication System'
|
|
PREAUTH_ID_NAME='Session ID'
|
|
PREAUTH_TOKEN_NAME='Authentication Token'
|
|
PREAUTH_SUBMIT_NAME='Submit'
|
|
# how many consecutive failed login attempts before we block them (a remote-ip)
|
|
PREAUTH_RATE_LIMIT=4
|
|
# maximum time between failed login attempts to still be consecutive (in minutes): 360 is 6 hours
|
|
PREAUTH_RATE_TIMEOUT=360
|
|
# how long after last failed login will they be blocked (in minutes): 1440 is 24 hours
|
|
PREAUTH_RATE_BLOCKED=1440
|
|
# what do we show when they get rate-limited
|
|
PREAUTH_DENIED_CODE=418
|
|
PREAUTH_DENIED_TITLE="I'm a teapot"
|
|
PREAUTH_DENIED_MESSAGE='I refuse to brew coffee.'
|
|
# alternatively, you could use a more standard response
|
|
#PREAUTH_DENIED_CODE=429
|
|
#PREAUTH_DENIED_TITLE='Too Many Requests'
|
|
#PREAUTH_DENIED_MESSAGE='Try again later.'
|
|
|
|
# who owns the session files
|
|
# permissions of the volume must match
|
|
USER_ID=1000
|
|
GROUP_ID=1000
|
|
|