commit 755fe4e81ea58631696d3000c80701a884be3f50 Author: Zoran Peričić Date: Thu Aug 6 17:37:21 2026 +0200 Initial authelia 4.39.20 package - Base + service (native binary), container (rootless quadlet), postgresql and redis subpackages - Fixed UID/GID 126 for the authelia user - Rootless pod publishing 127.0.0.1:9091; db and redis join the pod (container) or publish on localhost (service) - Container images pinned by digest - Native -service subpackage built conditionally (--without service) diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..ab97818 --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +# Downloaded upstream release tarballs +authelia-v[0-9]*.[0-9]*.[0-9]*-linux-amd64.tar.gz +authelia-v[0-9]*.[0-9]*.[0-9]*-linux-arm64.tar.gz diff --git a/authelia-container-database.conf b/authelia-container-database.conf new file mode 100644 index 0000000..3ebc656 --- /dev/null +++ b/authelia-container-database.conf @@ -0,0 +1,16 @@ +[Unit] +Wants=authelia-db.service +After=authelia-db.service + +[Container] +### +# PostgreSQL storage (authelia-postgresql subpackage). +# Uncomment the environment below AND comment out the `local:` storage +# block in /etc/authelia/configuration.yml (Authelia refuses to start +# with two storage providers configured). +# 127.0.0.1 works because authelia-db shares the pod network namespace. +### +#Environment=AUTHELIA_STORAGE_POSTGRES_ADDRESS=tcp://127.0.0.1:5432 +#Environment=AUTHELIA_STORAGE_POSTGRES_DATABASE=authelia +#Environment=AUTHELIA_STORAGE_POSTGRES_USERNAME=authelia +#Environment=AUTHELIA_STORAGE_POSTGRES_PASSWORD=authelia diff --git a/authelia-container-session.conf b/authelia-container-session.conf new file mode 100644 index 0000000..921d3e5 --- /dev/null +++ b/authelia-container-session.conf @@ -0,0 +1,12 @@ +[Unit] +Wants=authelia-redis.service +After=authelia-redis.service + +[Container] +### +# Redis session storage (authelia-redis subpackage). +# Uncomment to store sessions in Redis instead of memory. +# 127.0.0.1 works because authelia-redis shares the pod network namespace. +### +#Environment=AUTHELIA_SESSION_REDIS_HOST=127.0.0.1 +#Environment=AUTHELIA_SESSION_REDIS_PORT=6379 diff --git a/authelia-db-credentials.conf b/authelia-db-credentials.conf new file mode 100644 index 0000000..9669580 --- /dev/null +++ b/authelia-db-credentials.conf @@ -0,0 +1,4 @@ +[Container] +Environment=POSTGRES_USER=authelia +Environment=POSTGRES_PASSWORD=authelia +Environment=POSTGRES_DB=authelia diff --git a/authelia-db-pod.conf b/authelia-db-pod.conf new file mode 100644 index 0000000..f68ca90 --- /dev/null +++ b/authelia-db-pod.conf @@ -0,0 +1,2 @@ +[Container] +Pod=authelia.pod diff --git a/authelia-db-publish.conf b/authelia-db-publish.conf new file mode 100644 index 0000000..2e76430 --- /dev/null +++ b/authelia-db-publish.conf @@ -0,0 +1,2 @@ +[Container] +PublishPort=127.0.0.1:5432:5432 diff --git a/authelia-db.container b/authelia-db.container new file mode 100644 index 0000000..661c04d --- /dev/null +++ b/authelia-db.container @@ -0,0 +1,22 @@ +[Unit] +Description=Authelia PostgreSQL Database + +[Container] +Image=docker.io/library/postgres:18.1-trixie@sha256:1090bc3a8ccfb0b55f78a494d76f8d603434f7e4553543d6e807bc7bd6bbd17f +ContainerName=authelia-db +Volume=/var/lib/authelia/postgresql:/var/lib/postgresql:Z +Exec=postgres -c shared_buffers=128MB -c min_wal_size=80MB +HealthCmd=pg_isready -U authelia +HealthInterval=30s +HealthTimeout=10s +HealthRetries=5 +HealthStartPeriod=1m +HealthOnFailure=kill +LogDriver=journald + +[Service] +User=authelia +Environment=HOME=/var/lib/authelia +Restart=always +RestartSec=5 +TimeoutStartSec=900 diff --git a/authelia-pod-enable.conf b/authelia-pod-enable.conf new file mode 100644 index 0000000..f612d8f --- /dev/null +++ b/authelia-pod-enable.conf @@ -0,0 +1,2 @@ +[Install] +WantedBy=multi-user.target diff --git a/authelia-redis-pod.conf b/authelia-redis-pod.conf new file mode 100644 index 0000000..f68ca90 --- /dev/null +++ b/authelia-redis-pod.conf @@ -0,0 +1,2 @@ +[Container] +Pod=authelia.pod diff --git a/authelia-redis-publish.conf b/authelia-redis-publish.conf new file mode 100644 index 0000000..7f4d0ac --- /dev/null +++ b/authelia-redis-publish.conf @@ -0,0 +1,2 @@ +[Container] +PublishPort=127.0.0.1:6379:6379 diff --git a/authelia-redis.container b/authelia-redis.container new file mode 100644 index 0000000..1bb5e4b --- /dev/null +++ b/authelia-redis.container @@ -0,0 +1,22 @@ +[Unit] +Description=Authelia Redis session store + +[Container] +Image=docker.io/library/redis:8.4-alpine@sha256:bd4a0d37e7cd830117ffec9329052b4a1887afa060c265e1768f82b177ff6f43 +ContainerName=authelia-redis +Volume=/var/lib/authelia/redis:/data:Z +Exec=redis-server --save 60 1 +HealthCmd=redis-cli ping +HealthInterval=30s +HealthTimeout=10s +HealthRetries=5 +HealthStartPeriod=30s +HealthOnFailure=kill +LogDriver=journald + +[Service] +User=authelia +Environment=HOME=/var/lib/authelia +Restart=always +RestartSec=5 +TimeoutStartSec=900 diff --git a/authelia-service-database.conf b/authelia-service-database.conf new file mode 100644 index 0000000..a18f2f5 --- /dev/null +++ b/authelia-service-database.conf @@ -0,0 +1,17 @@ +[Unit] +Wants=authelia-db.service +After=authelia-db.service + +[Service] +### +# PostgreSQL storage (authelia-postgresql subpackage) for the native +# authelia-service install. +# Uncomment the environment below AND comment out the `local:` storage +# block in /etc/authelia/configuration.yml (Authelia refuses to start +# with two storage providers configured). +# The authelia-db container publishes 127.0.0.1:5432 on the host. +### +#Environment=AUTHELIA_STORAGE_POSTGRES_ADDRESS=tcp://127.0.0.1:5432 +#Environment=AUTHELIA_STORAGE_POSTGRES_DATABASE=authelia +#Environment=AUTHELIA_STORAGE_POSTGRES_USERNAME=authelia +#Environment=AUTHELIA_STORAGE_POSTGRES_PASSWORD=authelia diff --git a/authelia-service-session.conf b/authelia-service-session.conf new file mode 100644 index 0000000..6545885 --- /dev/null +++ b/authelia-service-session.conf @@ -0,0 +1,13 @@ +[Unit] +Wants=authelia-redis.service +After=authelia-redis.service + +[Service] +### +# Redis session storage (authelia-redis subpackage) for the native +# authelia-service install. +# Uncomment to store sessions in Redis instead of memory. +# The authelia-redis container publishes 127.0.0.1:6379 on the host. +### +#Environment=AUTHELIA_SESSION_REDIS_HOST=127.0.0.1 +#Environment=AUTHELIA_SESSION_REDIS_PORT=6379 diff --git a/authelia.container b/authelia.container new file mode 100644 index 0000000..26190fa --- /dev/null +++ b/authelia.container @@ -0,0 +1,19 @@ +[Unit] +Description=Authelia authentication and authorization server + +[Container] +ContainerName=authelia +Image=docker.io/authelia/authelia:4.39.20@sha256:1b363e9279e742397966333f364e0876ae02bf5c876de73e83af6d48c57ff51b +Pod=authelia.pod +Exec=--config /etc/authelia/configuration.yml +Volume=/etc/authelia:/etc/authelia:ro,z +Volume=/var/lib/authelia/data:/var/lib/authelia/data:Z +Volume=/etc/localtime:/etc/localtime:ro +LogDriver=journald + +[Service] +User=authelia +Environment=HOME=/var/lib/authelia +Restart=always +RestartSec=5 +TimeoutStartSec=900 diff --git a/authelia.pod b/authelia.pod new file mode 100644 index 0000000..1f8448a --- /dev/null +++ b/authelia.pod @@ -0,0 +1,10 @@ +[Unit] +Description=Authelia pod + +[Pod] +PodName=authelia-pod +PublishPort=127.0.0.1:9091:9091 + +[Service] +User=authelia +Environment=HOME=/var/lib/authelia diff --git a/authelia.service b/authelia.service new file mode 100644 index 0000000..6b44d66 --- /dev/null +++ b/authelia.service @@ -0,0 +1,31 @@ +[Unit] +Description=Authelia authentication and authorization server +Documentation=https://www.authelia.com +After=network.target + +[Service] +User=authelia +Group=authelia +UMask=027 +Environment=AUTHELIA_SERVER_ADDRESS=tcp://127.0.0.1:9091/ +Environment=AUTHELIA_SERVER_DISABLE_HEALTHCHECK=true +ExecStart=/usr/libexec/authelia --config /etc/authelia/configuration.yml +Restart=always +RestartSec=3 +SyslogIdentifier=authelia +CapabilityBoundingSet= +NoNewPrivileges=yes +RestrictNamespaces=yes +ProtectHome=true +ProtectSystem=strict +ReadWritePaths=/var/lib/authelia +PrivateDevices=yes +ProtectControlGroups=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +SystemCallArchitectures=native +SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM + +[Install] +WantedBy=multi-user.target diff --git a/authelia.spec b/authelia.spec new file mode 100644 index 0000000..7d69477 --- /dev/null +++ b/authelia.spec @@ -0,0 +1,280 @@ +# Build the native binary -service subpackage by default. +# Disable to build without the upstream release tarballs (container-only): +# rpmbuild -bb --without service authelia.spec +# mock --without=service ... +%bcond_without service + +# Prebuilt upstream binary: no debuginfo to extract +%global debug_package %{nil} + +Name: authelia +Version: 4.39.20 +Release: 1%{?dist} +Summary: Authelia - authentication and authorization server +License: Apache-2.0 +Group: System Environment/Base +URL: https://www.authelia.com + +%if %{with service} +Source0: https://github.com/authelia/authelia/releases/download/v%{version}/authelia-v%{version}-linux-amd64.tar.gz +Source1: https://github.com/authelia/authelia/releases/download/v%{version}/authelia-v%{version}-linux-arm64.tar.gz +%endif +Source10: authelia.service +Source11: authelia.sysusers +Source12: configuration.yml +Source13: users_database.yml +Source14: authelia.container +Source15: authelia.pod +Source16: authelia-pod-enable.conf +Source17: authelia-db.container +Source18: authelia-db-pod.conf +Source19: authelia-db-publish.conf +Source20: authelia-db-credentials.conf +Source21: authelia-container-database.conf +Source22: authelia-service-database.conf +Source23: authelia-redis.container +Source24: authelia-redis-pod.conf +Source25: authelia-redis-publish.conf +Source26: authelia-container-session.conf +Source27: authelia-service-session.conf + +%if %{with service} +ExclusiveArch: x86_64 aarch64 +%else +BuildArch: noarch +%endif + +BuildRequires: systemd-rpm-macros + +%description +Authelia is an open-source authentication and authorization server +providing single sign-on (SSO) and two-factor authentication (2FA) for +applications behind a reverse proxy. + +This base package ships the authelia user (UID 126), the configuration +in /etc/authelia and the data directory. Install either +authelia-service (native binary) or authelia-container (rootless Podman +quadlet) to actually run the server. + +%if %{with service} +%package service +Summary: Authelia systemd service (native binary) +Requires: %{name} = %{version}-%{release} +Conflicts: %{name}-container +%{?systemd_requires} + +%description service +Runs Authelia as a native binary under systemd, listening on +127.0.0.1:9091. +%endif + +%package container +Summary: Authelia container (rootless Podman quadlet) +Requires: %{name} = %{version}-%{release} +Requires: podman +Requires: containers-common +Requires: systemd-container +%if %{with service} +Conflicts: %{name}-service +%endif + +%description container +Runs Authelia as a rootless Podman container (quadlet) under the +authelia user, in a pod publishing 127.0.0.1:9091. The optional +authelia-postgresql and authelia-redis containers join the same pod. + +%package postgresql +Summary: PostgreSQL storage backend for Authelia +Requires: %{name} = %{version}-%{release} +Requires: podman +Requires: containers-common +Requires: systemd-container + +%description postgresql +Ships a PostgreSQL container (authelia-db) running rootless under the +authelia user. With authelia-container it joins the authelia pod; with +authelia-service it publishes 127.0.0.1:5432. Enable it by uncommenting +the AUTHELIA_STORAGE_POSTGRES_* environment in the database.conf +drop-in and commenting out the local storage block in +/etc/authelia/configuration.yml. + +%package redis +Summary: Redis session storage for Authelia +Requires: %{name} = %{version}-%{release} +Requires: podman +Requires: containers-common +Requires: systemd-container + +%description redis +Ships a Redis container (authelia-redis) running rootless under the +authelia user for persistent session storage. With authelia-container +it joins the authelia pod; with authelia-service it publishes +127.0.0.1:6379. Enable it by uncommenting the AUTHELIA_SESSION_REDIS_* +environment in the session.conf drop-in. + +%prep +%setup -q -c -T +%if %{with service} +%ifarch x86_64 +tar -xzf %{SOURCE0} authelia +%endif +%ifarch aarch64 +tar -xzf %{SOURCE1} authelia +%endif +%endif + +%install +%{__rm} -rf %{buildroot} + +# Base: sysusers, config +install -p -D -m 644 %{SOURCE11} %{buildroot}%{_sysusersdir}/authelia.conf + +install -d -m 750 %{buildroot}%{_sysconfdir}/authelia +install -m 640 %{SOURCE12} %{buildroot}%{_sysconfdir}/authelia/configuration.yml +install -m 640 %{SOURCE13} %{buildroot}%{_sysconfdir}/authelia/users_database.yml + +# Base: data dirs. /var/lib/authelia is the authelia user's HOME and holds +# the rootless podman storage for the container variants; only data/ (and +# the db dirs) are mounted into containers, since podman refuses relabeling +# of $HOME itself. +install -d -m 750 %{buildroot}%{_sharedstatedir}/authelia +install -d -m 750 %{buildroot}%{_sharedstatedir}/authelia/data + +%if %{with service} +# Service subpackage +install -p -D -m 755 authelia %{buildroot}%{_libexecdir}/authelia +install -p -D -m 644 %{SOURCE10} %{buildroot}%{_unitdir}/authelia.service +install -p -D -m 644 %{SOURCE19} %{buildroot}%{_datadir}/containers/systemd/authelia-db.container.d/publish.conf +install -p -D -m 644 %{SOURCE25} %{buildroot}%{_datadir}/containers/systemd/authelia-redis.container.d/publish.conf +%endif + +# Container subpackage +install -p -D -m 644 %{SOURCE14} %{buildroot}%{_datadir}/containers/systemd/authelia.container +install -p -D -m 644 %{SOURCE15} %{buildroot}%{_datadir}/containers/systemd/authelia.pod +install -p -D -m 644 %{SOURCE16} %{buildroot}%{_sysconfdir}/containers/systemd/authelia.pod.d/enable.conf +install -p -D -m 644 %{SOURCE18} %{buildroot}%{_datadir}/containers/systemd/authelia-db.container.d/pod.conf +install -p -D -m 644 %{SOURCE24} %{buildroot}%{_datadir}/containers/systemd/authelia-redis.container.d/pod.conf + +# PostgreSQL subpackage +install -d -m 750 %{buildroot}%{_sharedstatedir}/authelia/postgresql +install -p -D -m 644 %{SOURCE17} %{buildroot}%{_datadir}/containers/systemd/authelia-db.container +install -p -D -m 644 %{SOURCE20} %{buildroot}%{_sysconfdir}/containers/systemd/authelia-db.container.d/credentials.conf +install -p -D -m 644 %{SOURCE21} %{buildroot}%{_sysconfdir}/containers/systemd/authelia.container.d/database.conf +install -p -D -m 644 %{SOURCE22} %{buildroot}%{_sysconfdir}/systemd/system/authelia.service.d/database.conf + +# Redis subpackage +install -d -m 750 %{buildroot}%{_sharedstatedir}/authelia/redis +install -p -D -m 644 %{SOURCE23} %{buildroot}%{_datadir}/containers/systemd/authelia-redis.container +install -p -D -m 644 %{SOURCE26} %{buildroot}%{_sysconfdir}/containers/systemd/authelia.container.d/session.conf +install -p -D -m 644 %{SOURCE27} %{buildroot}%{_sysconfdir}/systemd/system/authelia.service.d/session.conf + +%pre +%sysusers_create_compat %{SOURCE11} + +%post +# Rootless podman under the authelia system user (container variants) +# needs a lingering user session (/run/user/126) and a subuid/subgid +# range for the in-container users. +if [ $1 -eq 1 ]; then + loginctl enable-linger authelia || : +fi + +if ! grep -q "^authelia:" /etc/subuid 2>/dev/null; then + NEXT=$(awk -F: '{n=$2+$3} END{print n+0}' /etc/subuid 2>/dev/null) + [ "$NEXT" -lt 524288 ] && NEXT=524288 + END=$((NEXT + 65535)) + usermod --add-subuids "$NEXT-$END" --add-subgids "$NEXT-$END" authelia 2>/dev/null || : +fi + +%if %{with service} +%post service +%systemd_post authelia.service + +%posttrans service +ln -sf %{_libexecdir}/authelia %{_bindir}/authelia + +%preun service +%systemd_preun authelia.service + +%postun service +%systemd_postun_with_restart authelia.service +if [ $1 -eq 0 ]; then + rm -f %{_bindir}/authelia +fi +%endif + +%post container +%systemd_post authelia.service + +%preun container +%systemd_preun authelia.service + +%postun container +%systemd_postun authelia.service + +%clean +%{__rm} -rf %{buildroot} + +%files +%defattr(-,root,root,-) +%{_sysusersdir}/authelia.conf + +%dir %attr(0750,root,authelia) %{_sysconfdir}/authelia +%config(noreplace) %attr(0640,root,authelia) %{_sysconfdir}/authelia/configuration.yml +%config(noreplace) %attr(0640,root,authelia) %{_sysconfdir}/authelia/users_database.yml + +%dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia +%dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia/data + +%if %{with service} +%files service +%defattr(-,root,root,-) +%{_libexecdir}/authelia +%ghost %{_bindir}/authelia +%attr(0644,root,root) %{_unitdir}/authelia.service +%dir %{_datadir}/containers/systemd/authelia-db.container.d +%{_datadir}/containers/systemd/authelia-db.container.d/publish.conf +%dir %{_datadir}/containers/systemd/authelia-redis.container.d +%{_datadir}/containers/systemd/authelia-redis.container.d/publish.conf +%endif + +%files container +%defattr(-,root,root,-) +%{_datadir}/containers/systemd/authelia.container +%{_datadir}/containers/systemd/authelia.pod +%dir %{_sysconfdir}/containers/systemd/authelia.pod.d +%config(noreplace) %{_sysconfdir}/containers/systemd/authelia.pod.d/enable.conf +%dir %{_datadir}/containers/systemd/authelia-db.container.d +%{_datadir}/containers/systemd/authelia-db.container.d/pod.conf +%dir %{_datadir}/containers/systemd/authelia-redis.container.d +%{_datadir}/containers/systemd/authelia-redis.container.d/pod.conf + +%files postgresql +%defattr(-,root,root,-) +%dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia/postgresql +%{_datadir}/containers/systemd/authelia-db.container +%dir %{_sysconfdir}/containers/systemd/authelia-db.container.d +%config(noreplace) %{_sysconfdir}/containers/systemd/authelia-db.container.d/credentials.conf +%dir %{_sysconfdir}/containers/systemd/authelia.container.d +%config(noreplace) %{_sysconfdir}/containers/systemd/authelia.container.d/database.conf +%dir %{_sysconfdir}/systemd/system/authelia.service.d +%config(noreplace) %{_sysconfdir}/systemd/system/authelia.service.d/database.conf + +%files redis +%defattr(-,root,root,-) +%dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia/redis +%{_datadir}/containers/systemd/authelia-redis.container +%dir %{_sysconfdir}/containers/systemd/authelia.container.d +%config(noreplace) %{_sysconfdir}/containers/systemd/authelia.container.d/session.conf +%dir %{_sysconfdir}/systemd/system/authelia.service.d +%config(noreplace) %{_sysconfdir}/systemd/system/authelia.service.d/session.conf + +%changelog +* Thu Aug 06 2026 Zoran Pericic - 4.39.20-1 +- Initial package with service, container, postgresql and redis + subpackages +- Fixed UID/GID 126 for the authelia user +- Rootless quadlet (vaultwarden style) with an authelia pod publishing + 127.0.0.1:9091; db and redis containers join the pod +- Container images pinned by digest +- Native -service subpackage built conditionally (--without service) diff --git a/authelia.sysusers b/authelia.sysusers new file mode 100644 index 0000000..a5bc271 --- /dev/null +++ b/authelia.sysusers @@ -0,0 +1,2 @@ +g authelia 126 +u authelia 126:126 "Authelia authentication server" /var/lib/authelia /sbin/nologin diff --git a/configuration.yml b/configuration.yml new file mode 100644 index 0000000..d2f974f --- /dev/null +++ b/configuration.yml @@ -0,0 +1,63 @@ +### +# Authelia configuration +# https://www.authelia.com/configuration/prologue/introduction/ +# +# This file ships with placeholder secrets. Authelia will NOT start until +# the CHANGE_ME values, the session cookie domain and the user database +# are configured. +# +# Generate secrets with: +# authelia crypto rand --length 64 --charset alphanumeric +# (container install: +# sudo -u authelia podman exec authelia authelia crypto rand --length 64 --charset alphanumeric) +### + +theme: 'auto' + +server: + ## Bind address. The container publishes only 127.0.0.1:9091 on the host; + ## the native service overrides this to 127.0.0.1 via AUTHELIA_SERVER_ADDRESS + ## in authelia.service. + address: 'tcp://0.0.0.0:9091/' + +log: + level: 'info' + +identity_validation: + reset_password: + jwt_secret: 'CHANGE_ME_jwt_secret' + +authentication_backend: + file: + path: '/etc/authelia/users_database.yml' + +access_control: + default_policy: 'one_factor' + +session: + secret: 'CHANGE_ME_session_secret' + cookies: + - domain: 'example.com' + authelia_url: 'https://auth.example.com' + +regulation: + max_retries: 3 + find_time: '2m' + ban_time: '5m' + +storage: + encryption_key: 'CHANGE_ME_storage_encryption_key' + ## SQLite (default). When using the authelia-postgresql subpackage, + ## comment out the `local:` block below and uncomment the + ## AUTHELIA_STORAGE_POSTGRES_* environment in the database.conf drop-in + ## (/etc/containers/systemd/authelia.container.d/database.conf for the + ## container, /etc/systemd/system/authelia.service.d/database.conf for + ## the native service). + local: + path: '/var/lib/authelia/data/db.sqlite3' + +notifier: + ## File-based notifier for initial setup. Replace with `smtp:` in + ## production so users receive password reset / identity emails. + filesystem: + filename: '/var/lib/authelia/data/notification.txt' diff --git a/users_database.yml b/users_database.yml new file mode 100644 index 0000000..542eec0 --- /dev/null +++ b/users_database.yml @@ -0,0 +1,17 @@ +### +# File-based user database. +# https://www.authelia.com/reference/guides/passwords/ +# +# Generate password hashes with: +# authelia crypto hash generate argon2 +# (container install: +# sudo -u authelia podman exec -it authelia authelia crypto hash generate argon2) +### + +users: {} +# admin: +# displayname: 'Administrator' +# password: '$argon2id$v=19$m=65536,t=3,p=4$CHANGE_ME' +# email: 'admin@example.com' +# groups: +# - 'admins'