Initial authelia 4.39.20 package
- Base + service (native binary), container (rootless quadlet), postgresql and redis subpackages - Fixed UID/GID 126 for the authelia user - Rootless pod publishing 127.0.0.1:9091; db and redis join the pod (container) or publish on localhost (service) - Container images pinned by digest - Native -service subpackage built conditionally (--without service)
This commit is contained in:
@@ -0,0 +1,3 @@
|
|||||||
|
# Downloaded upstream release tarballs
|
||||||
|
authelia-v[0-9]*.[0-9]*.[0-9]*-linux-amd64.tar.gz
|
||||||
|
authelia-v[0-9]*.[0-9]*.[0-9]*-linux-arm64.tar.gz
|
||||||
@@ -0,0 +1,16 @@
|
|||||||
|
[Unit]
|
||||||
|
Wants=authelia-db.service
|
||||||
|
After=authelia-db.service
|
||||||
|
|
||||||
|
[Container]
|
||||||
|
###
|
||||||
|
# PostgreSQL storage (authelia-postgresql subpackage).
|
||||||
|
# Uncomment the environment below AND comment out the `local:` storage
|
||||||
|
# block in /etc/authelia/configuration.yml (Authelia refuses to start
|
||||||
|
# with two storage providers configured).
|
||||||
|
# 127.0.0.1 works because authelia-db shares the pod network namespace.
|
||||||
|
###
|
||||||
|
#Environment=AUTHELIA_STORAGE_POSTGRES_ADDRESS=tcp://127.0.0.1:5432
|
||||||
|
#Environment=AUTHELIA_STORAGE_POSTGRES_DATABASE=authelia
|
||||||
|
#Environment=AUTHELIA_STORAGE_POSTGRES_USERNAME=authelia
|
||||||
|
#Environment=AUTHELIA_STORAGE_POSTGRES_PASSWORD=authelia
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
[Unit]
|
||||||
|
Wants=authelia-redis.service
|
||||||
|
After=authelia-redis.service
|
||||||
|
|
||||||
|
[Container]
|
||||||
|
###
|
||||||
|
# Redis session storage (authelia-redis subpackage).
|
||||||
|
# Uncomment to store sessions in Redis instead of memory.
|
||||||
|
# 127.0.0.1 works because authelia-redis shares the pod network namespace.
|
||||||
|
###
|
||||||
|
#Environment=AUTHELIA_SESSION_REDIS_HOST=127.0.0.1
|
||||||
|
#Environment=AUTHELIA_SESSION_REDIS_PORT=6379
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
[Container]
|
||||||
|
Environment=POSTGRES_USER=authelia
|
||||||
|
Environment=POSTGRES_PASSWORD=authelia
|
||||||
|
Environment=POSTGRES_DB=authelia
|
||||||
@@ -0,0 +1,2 @@
|
|||||||
|
[Container]
|
||||||
|
Pod=authelia.pod
|
||||||
@@ -0,0 +1,2 @@
|
|||||||
|
[Container]
|
||||||
|
PublishPort=127.0.0.1:5432:5432
|
||||||
@@ -0,0 +1,22 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=Authelia PostgreSQL Database
|
||||||
|
|
||||||
|
[Container]
|
||||||
|
Image=docker.io/library/postgres:18.1-trixie@sha256:1090bc3a8ccfb0b55f78a494d76f8d603434f7e4553543d6e807bc7bd6bbd17f
|
||||||
|
ContainerName=authelia-db
|
||||||
|
Volume=/var/lib/authelia/postgresql:/var/lib/postgresql:Z
|
||||||
|
Exec=postgres -c shared_buffers=128MB -c min_wal_size=80MB
|
||||||
|
HealthCmd=pg_isready -U authelia
|
||||||
|
HealthInterval=30s
|
||||||
|
HealthTimeout=10s
|
||||||
|
HealthRetries=5
|
||||||
|
HealthStartPeriod=1m
|
||||||
|
HealthOnFailure=kill
|
||||||
|
LogDriver=journald
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
User=authelia
|
||||||
|
Environment=HOME=/var/lib/authelia
|
||||||
|
Restart=always
|
||||||
|
RestartSec=5
|
||||||
|
TimeoutStartSec=900
|
||||||
@@ -0,0 +1,2 @@
|
|||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
@@ -0,0 +1,2 @@
|
|||||||
|
[Container]
|
||||||
|
Pod=authelia.pod
|
||||||
@@ -0,0 +1,2 @@
|
|||||||
|
[Container]
|
||||||
|
PublishPort=127.0.0.1:6379:6379
|
||||||
@@ -0,0 +1,22 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=Authelia Redis session store
|
||||||
|
|
||||||
|
[Container]
|
||||||
|
Image=docker.io/library/redis:8.4-alpine@sha256:bd4a0d37e7cd830117ffec9329052b4a1887afa060c265e1768f82b177ff6f43
|
||||||
|
ContainerName=authelia-redis
|
||||||
|
Volume=/var/lib/authelia/redis:/data:Z
|
||||||
|
Exec=redis-server --save 60 1
|
||||||
|
HealthCmd=redis-cli ping
|
||||||
|
HealthInterval=30s
|
||||||
|
HealthTimeout=10s
|
||||||
|
HealthRetries=5
|
||||||
|
HealthStartPeriod=30s
|
||||||
|
HealthOnFailure=kill
|
||||||
|
LogDriver=journald
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
User=authelia
|
||||||
|
Environment=HOME=/var/lib/authelia
|
||||||
|
Restart=always
|
||||||
|
RestartSec=5
|
||||||
|
TimeoutStartSec=900
|
||||||
@@ -0,0 +1,17 @@
|
|||||||
|
[Unit]
|
||||||
|
Wants=authelia-db.service
|
||||||
|
After=authelia-db.service
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
###
|
||||||
|
# PostgreSQL storage (authelia-postgresql subpackage) for the native
|
||||||
|
# authelia-service install.
|
||||||
|
# Uncomment the environment below AND comment out the `local:` storage
|
||||||
|
# block in /etc/authelia/configuration.yml (Authelia refuses to start
|
||||||
|
# with two storage providers configured).
|
||||||
|
# The authelia-db container publishes 127.0.0.1:5432 on the host.
|
||||||
|
###
|
||||||
|
#Environment=AUTHELIA_STORAGE_POSTGRES_ADDRESS=tcp://127.0.0.1:5432
|
||||||
|
#Environment=AUTHELIA_STORAGE_POSTGRES_DATABASE=authelia
|
||||||
|
#Environment=AUTHELIA_STORAGE_POSTGRES_USERNAME=authelia
|
||||||
|
#Environment=AUTHELIA_STORAGE_POSTGRES_PASSWORD=authelia
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
[Unit]
|
||||||
|
Wants=authelia-redis.service
|
||||||
|
After=authelia-redis.service
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
###
|
||||||
|
# Redis session storage (authelia-redis subpackage) for the native
|
||||||
|
# authelia-service install.
|
||||||
|
# Uncomment to store sessions in Redis instead of memory.
|
||||||
|
# The authelia-redis container publishes 127.0.0.1:6379 on the host.
|
||||||
|
###
|
||||||
|
#Environment=AUTHELIA_SESSION_REDIS_HOST=127.0.0.1
|
||||||
|
#Environment=AUTHELIA_SESSION_REDIS_PORT=6379
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=Authelia authentication and authorization server
|
||||||
|
|
||||||
|
[Container]
|
||||||
|
ContainerName=authelia
|
||||||
|
Image=docker.io/authelia/authelia:4.39.20@sha256:1b363e9279e742397966333f364e0876ae02bf5c876de73e83af6d48c57ff51b
|
||||||
|
Pod=authelia.pod
|
||||||
|
Exec=--config /etc/authelia/configuration.yml
|
||||||
|
Volume=/etc/authelia:/etc/authelia:ro,z
|
||||||
|
Volume=/var/lib/authelia/data:/var/lib/authelia/data:Z
|
||||||
|
Volume=/etc/localtime:/etc/localtime:ro
|
||||||
|
LogDriver=journald
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
User=authelia
|
||||||
|
Environment=HOME=/var/lib/authelia
|
||||||
|
Restart=always
|
||||||
|
RestartSec=5
|
||||||
|
TimeoutStartSec=900
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=Authelia pod
|
||||||
|
|
||||||
|
[Pod]
|
||||||
|
PodName=authelia-pod
|
||||||
|
PublishPort=127.0.0.1:9091:9091
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
User=authelia
|
||||||
|
Environment=HOME=/var/lib/authelia
|
||||||
@@ -0,0 +1,31 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=Authelia authentication and authorization server
|
||||||
|
Documentation=https://www.authelia.com
|
||||||
|
After=network.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
User=authelia
|
||||||
|
Group=authelia
|
||||||
|
UMask=027
|
||||||
|
Environment=AUTHELIA_SERVER_ADDRESS=tcp://127.0.0.1:9091/
|
||||||
|
Environment=AUTHELIA_SERVER_DISABLE_HEALTHCHECK=true
|
||||||
|
ExecStart=/usr/libexec/authelia --config /etc/authelia/configuration.yml
|
||||||
|
Restart=always
|
||||||
|
RestartSec=3
|
||||||
|
SyslogIdentifier=authelia
|
||||||
|
CapabilityBoundingSet=
|
||||||
|
NoNewPrivileges=yes
|
||||||
|
RestrictNamespaces=yes
|
||||||
|
ProtectHome=true
|
||||||
|
ProtectSystem=strict
|
||||||
|
ReadWritePaths=/var/lib/authelia
|
||||||
|
PrivateDevices=yes
|
||||||
|
ProtectControlGroups=yes
|
||||||
|
ProtectKernelModules=yes
|
||||||
|
ProtectKernelTunables=yes
|
||||||
|
SystemCallArchitectures=native
|
||||||
|
SystemCallFilter=@system-service
|
||||||
|
SystemCallErrorNumber=EPERM
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
+280
@@ -0,0 +1,280 @@
|
|||||||
|
# Build the native binary -service subpackage by default.
|
||||||
|
# Disable to build without the upstream release tarballs (container-only):
|
||||||
|
# rpmbuild -bb --without service authelia.spec
|
||||||
|
# mock --without=service ...
|
||||||
|
%bcond_without service
|
||||||
|
|
||||||
|
# Prebuilt upstream binary: no debuginfo to extract
|
||||||
|
%global debug_package %{nil}
|
||||||
|
|
||||||
|
Name: authelia
|
||||||
|
Version: 4.39.20
|
||||||
|
Release: 1%{?dist}
|
||||||
|
Summary: Authelia - authentication and authorization server
|
||||||
|
License: Apache-2.0
|
||||||
|
Group: System Environment/Base
|
||||||
|
URL: https://www.authelia.com
|
||||||
|
|
||||||
|
%if %{with service}
|
||||||
|
Source0: https://github.com/authelia/authelia/releases/download/v%{version}/authelia-v%{version}-linux-amd64.tar.gz
|
||||||
|
Source1: https://github.com/authelia/authelia/releases/download/v%{version}/authelia-v%{version}-linux-arm64.tar.gz
|
||||||
|
%endif
|
||||||
|
Source10: authelia.service
|
||||||
|
Source11: authelia.sysusers
|
||||||
|
Source12: configuration.yml
|
||||||
|
Source13: users_database.yml
|
||||||
|
Source14: authelia.container
|
||||||
|
Source15: authelia.pod
|
||||||
|
Source16: authelia-pod-enable.conf
|
||||||
|
Source17: authelia-db.container
|
||||||
|
Source18: authelia-db-pod.conf
|
||||||
|
Source19: authelia-db-publish.conf
|
||||||
|
Source20: authelia-db-credentials.conf
|
||||||
|
Source21: authelia-container-database.conf
|
||||||
|
Source22: authelia-service-database.conf
|
||||||
|
Source23: authelia-redis.container
|
||||||
|
Source24: authelia-redis-pod.conf
|
||||||
|
Source25: authelia-redis-publish.conf
|
||||||
|
Source26: authelia-container-session.conf
|
||||||
|
Source27: authelia-service-session.conf
|
||||||
|
|
||||||
|
%if %{with service}
|
||||||
|
ExclusiveArch: x86_64 aarch64
|
||||||
|
%else
|
||||||
|
BuildArch: noarch
|
||||||
|
%endif
|
||||||
|
|
||||||
|
BuildRequires: systemd-rpm-macros
|
||||||
|
|
||||||
|
%description
|
||||||
|
Authelia is an open-source authentication and authorization server
|
||||||
|
providing single sign-on (SSO) and two-factor authentication (2FA) for
|
||||||
|
applications behind a reverse proxy.
|
||||||
|
|
||||||
|
This base package ships the authelia user (UID 126), the configuration
|
||||||
|
in /etc/authelia and the data directory. Install either
|
||||||
|
authelia-service (native binary) or authelia-container (rootless Podman
|
||||||
|
quadlet) to actually run the server.
|
||||||
|
|
||||||
|
%if %{with service}
|
||||||
|
%package service
|
||||||
|
Summary: Authelia systemd service (native binary)
|
||||||
|
Requires: %{name} = %{version}-%{release}
|
||||||
|
Conflicts: %{name}-container
|
||||||
|
%{?systemd_requires}
|
||||||
|
|
||||||
|
%description service
|
||||||
|
Runs Authelia as a native binary under systemd, listening on
|
||||||
|
127.0.0.1:9091.
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%package container
|
||||||
|
Summary: Authelia container (rootless Podman quadlet)
|
||||||
|
Requires: %{name} = %{version}-%{release}
|
||||||
|
Requires: podman
|
||||||
|
Requires: containers-common
|
||||||
|
Requires: systemd-container
|
||||||
|
%if %{with service}
|
||||||
|
Conflicts: %{name}-service
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%description container
|
||||||
|
Runs Authelia as a rootless Podman container (quadlet) under the
|
||||||
|
authelia user, in a pod publishing 127.0.0.1:9091. The optional
|
||||||
|
authelia-postgresql and authelia-redis containers join the same pod.
|
||||||
|
|
||||||
|
%package postgresql
|
||||||
|
Summary: PostgreSQL storage backend for Authelia
|
||||||
|
Requires: %{name} = %{version}-%{release}
|
||||||
|
Requires: podman
|
||||||
|
Requires: containers-common
|
||||||
|
Requires: systemd-container
|
||||||
|
|
||||||
|
%description postgresql
|
||||||
|
Ships a PostgreSQL container (authelia-db) running rootless under the
|
||||||
|
authelia user. With authelia-container it joins the authelia pod; with
|
||||||
|
authelia-service it publishes 127.0.0.1:5432. Enable it by uncommenting
|
||||||
|
the AUTHELIA_STORAGE_POSTGRES_* environment in the database.conf
|
||||||
|
drop-in and commenting out the local storage block in
|
||||||
|
/etc/authelia/configuration.yml.
|
||||||
|
|
||||||
|
%package redis
|
||||||
|
Summary: Redis session storage for Authelia
|
||||||
|
Requires: %{name} = %{version}-%{release}
|
||||||
|
Requires: podman
|
||||||
|
Requires: containers-common
|
||||||
|
Requires: systemd-container
|
||||||
|
|
||||||
|
%description redis
|
||||||
|
Ships a Redis container (authelia-redis) running rootless under the
|
||||||
|
authelia user for persistent session storage. With authelia-container
|
||||||
|
it joins the authelia pod; with authelia-service it publishes
|
||||||
|
127.0.0.1:6379. Enable it by uncommenting the AUTHELIA_SESSION_REDIS_*
|
||||||
|
environment in the session.conf drop-in.
|
||||||
|
|
||||||
|
%prep
|
||||||
|
%setup -q -c -T
|
||||||
|
%if %{with service}
|
||||||
|
%ifarch x86_64
|
||||||
|
tar -xzf %{SOURCE0} authelia
|
||||||
|
%endif
|
||||||
|
%ifarch aarch64
|
||||||
|
tar -xzf %{SOURCE1} authelia
|
||||||
|
%endif
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%install
|
||||||
|
%{__rm} -rf %{buildroot}
|
||||||
|
|
||||||
|
# Base: sysusers, config
|
||||||
|
install -p -D -m 644 %{SOURCE11} %{buildroot}%{_sysusersdir}/authelia.conf
|
||||||
|
|
||||||
|
install -d -m 750 %{buildroot}%{_sysconfdir}/authelia
|
||||||
|
install -m 640 %{SOURCE12} %{buildroot}%{_sysconfdir}/authelia/configuration.yml
|
||||||
|
install -m 640 %{SOURCE13} %{buildroot}%{_sysconfdir}/authelia/users_database.yml
|
||||||
|
|
||||||
|
# Base: data dirs. /var/lib/authelia is the authelia user's HOME and holds
|
||||||
|
# the rootless podman storage for the container variants; only data/ (and
|
||||||
|
# the db dirs) are mounted into containers, since podman refuses relabeling
|
||||||
|
# of $HOME itself.
|
||||||
|
install -d -m 750 %{buildroot}%{_sharedstatedir}/authelia
|
||||||
|
install -d -m 750 %{buildroot}%{_sharedstatedir}/authelia/data
|
||||||
|
|
||||||
|
%if %{with service}
|
||||||
|
# Service subpackage
|
||||||
|
install -p -D -m 755 authelia %{buildroot}%{_libexecdir}/authelia
|
||||||
|
install -p -D -m 644 %{SOURCE10} %{buildroot}%{_unitdir}/authelia.service
|
||||||
|
install -p -D -m 644 %{SOURCE19} %{buildroot}%{_datadir}/containers/systemd/authelia-db.container.d/publish.conf
|
||||||
|
install -p -D -m 644 %{SOURCE25} %{buildroot}%{_datadir}/containers/systemd/authelia-redis.container.d/publish.conf
|
||||||
|
%endif
|
||||||
|
|
||||||
|
# Container subpackage
|
||||||
|
install -p -D -m 644 %{SOURCE14} %{buildroot}%{_datadir}/containers/systemd/authelia.container
|
||||||
|
install -p -D -m 644 %{SOURCE15} %{buildroot}%{_datadir}/containers/systemd/authelia.pod
|
||||||
|
install -p -D -m 644 %{SOURCE16} %{buildroot}%{_sysconfdir}/containers/systemd/authelia.pod.d/enable.conf
|
||||||
|
install -p -D -m 644 %{SOURCE18} %{buildroot}%{_datadir}/containers/systemd/authelia-db.container.d/pod.conf
|
||||||
|
install -p -D -m 644 %{SOURCE24} %{buildroot}%{_datadir}/containers/systemd/authelia-redis.container.d/pod.conf
|
||||||
|
|
||||||
|
# PostgreSQL subpackage
|
||||||
|
install -d -m 750 %{buildroot}%{_sharedstatedir}/authelia/postgresql
|
||||||
|
install -p -D -m 644 %{SOURCE17} %{buildroot}%{_datadir}/containers/systemd/authelia-db.container
|
||||||
|
install -p -D -m 644 %{SOURCE20} %{buildroot}%{_sysconfdir}/containers/systemd/authelia-db.container.d/credentials.conf
|
||||||
|
install -p -D -m 644 %{SOURCE21} %{buildroot}%{_sysconfdir}/containers/systemd/authelia.container.d/database.conf
|
||||||
|
install -p -D -m 644 %{SOURCE22} %{buildroot}%{_sysconfdir}/systemd/system/authelia.service.d/database.conf
|
||||||
|
|
||||||
|
# Redis subpackage
|
||||||
|
install -d -m 750 %{buildroot}%{_sharedstatedir}/authelia/redis
|
||||||
|
install -p -D -m 644 %{SOURCE23} %{buildroot}%{_datadir}/containers/systemd/authelia-redis.container
|
||||||
|
install -p -D -m 644 %{SOURCE26} %{buildroot}%{_sysconfdir}/containers/systemd/authelia.container.d/session.conf
|
||||||
|
install -p -D -m 644 %{SOURCE27} %{buildroot}%{_sysconfdir}/systemd/system/authelia.service.d/session.conf
|
||||||
|
|
||||||
|
%pre
|
||||||
|
%sysusers_create_compat %{SOURCE11}
|
||||||
|
|
||||||
|
%post
|
||||||
|
# Rootless podman under the authelia system user (container variants)
|
||||||
|
# needs a lingering user session (/run/user/126) and a subuid/subgid
|
||||||
|
# range for the in-container users.
|
||||||
|
if [ $1 -eq 1 ]; then
|
||||||
|
loginctl enable-linger authelia || :
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! grep -q "^authelia:" /etc/subuid 2>/dev/null; then
|
||||||
|
NEXT=$(awk -F: '{n=$2+$3} END{print n+0}' /etc/subuid 2>/dev/null)
|
||||||
|
[ "$NEXT" -lt 524288 ] && NEXT=524288
|
||||||
|
END=$((NEXT + 65535))
|
||||||
|
usermod --add-subuids "$NEXT-$END" --add-subgids "$NEXT-$END" authelia 2>/dev/null || :
|
||||||
|
fi
|
||||||
|
|
||||||
|
%if %{with service}
|
||||||
|
%post service
|
||||||
|
%systemd_post authelia.service
|
||||||
|
|
||||||
|
%posttrans service
|
||||||
|
ln -sf %{_libexecdir}/authelia %{_bindir}/authelia
|
||||||
|
|
||||||
|
%preun service
|
||||||
|
%systemd_preun authelia.service
|
||||||
|
|
||||||
|
%postun service
|
||||||
|
%systemd_postun_with_restart authelia.service
|
||||||
|
if [ $1 -eq 0 ]; then
|
||||||
|
rm -f %{_bindir}/authelia
|
||||||
|
fi
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%post container
|
||||||
|
%systemd_post authelia.service
|
||||||
|
|
||||||
|
%preun container
|
||||||
|
%systemd_preun authelia.service
|
||||||
|
|
||||||
|
%postun container
|
||||||
|
%systemd_postun authelia.service
|
||||||
|
|
||||||
|
%clean
|
||||||
|
%{__rm} -rf %{buildroot}
|
||||||
|
|
||||||
|
%files
|
||||||
|
%defattr(-,root,root,-)
|
||||||
|
%{_sysusersdir}/authelia.conf
|
||||||
|
|
||||||
|
%dir %attr(0750,root,authelia) %{_sysconfdir}/authelia
|
||||||
|
%config(noreplace) %attr(0640,root,authelia) %{_sysconfdir}/authelia/configuration.yml
|
||||||
|
%config(noreplace) %attr(0640,root,authelia) %{_sysconfdir}/authelia/users_database.yml
|
||||||
|
|
||||||
|
%dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia
|
||||||
|
%dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia/data
|
||||||
|
|
||||||
|
%if %{with service}
|
||||||
|
%files service
|
||||||
|
%defattr(-,root,root,-)
|
||||||
|
%{_libexecdir}/authelia
|
||||||
|
%ghost %{_bindir}/authelia
|
||||||
|
%attr(0644,root,root) %{_unitdir}/authelia.service
|
||||||
|
%dir %{_datadir}/containers/systemd/authelia-db.container.d
|
||||||
|
%{_datadir}/containers/systemd/authelia-db.container.d/publish.conf
|
||||||
|
%dir %{_datadir}/containers/systemd/authelia-redis.container.d
|
||||||
|
%{_datadir}/containers/systemd/authelia-redis.container.d/publish.conf
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%files container
|
||||||
|
%defattr(-,root,root,-)
|
||||||
|
%{_datadir}/containers/systemd/authelia.container
|
||||||
|
%{_datadir}/containers/systemd/authelia.pod
|
||||||
|
%dir %{_sysconfdir}/containers/systemd/authelia.pod.d
|
||||||
|
%config(noreplace) %{_sysconfdir}/containers/systemd/authelia.pod.d/enable.conf
|
||||||
|
%dir %{_datadir}/containers/systemd/authelia-db.container.d
|
||||||
|
%{_datadir}/containers/systemd/authelia-db.container.d/pod.conf
|
||||||
|
%dir %{_datadir}/containers/systemd/authelia-redis.container.d
|
||||||
|
%{_datadir}/containers/systemd/authelia-redis.container.d/pod.conf
|
||||||
|
|
||||||
|
%files postgresql
|
||||||
|
%defattr(-,root,root,-)
|
||||||
|
%dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia/postgresql
|
||||||
|
%{_datadir}/containers/systemd/authelia-db.container
|
||||||
|
%dir %{_sysconfdir}/containers/systemd/authelia-db.container.d
|
||||||
|
%config(noreplace) %{_sysconfdir}/containers/systemd/authelia-db.container.d/credentials.conf
|
||||||
|
%dir %{_sysconfdir}/containers/systemd/authelia.container.d
|
||||||
|
%config(noreplace) %{_sysconfdir}/containers/systemd/authelia.container.d/database.conf
|
||||||
|
%dir %{_sysconfdir}/systemd/system/authelia.service.d
|
||||||
|
%config(noreplace) %{_sysconfdir}/systemd/system/authelia.service.d/database.conf
|
||||||
|
|
||||||
|
%files redis
|
||||||
|
%defattr(-,root,root,-)
|
||||||
|
%dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia/redis
|
||||||
|
%{_datadir}/containers/systemd/authelia-redis.container
|
||||||
|
%dir %{_sysconfdir}/containers/systemd/authelia.container.d
|
||||||
|
%config(noreplace) %{_sysconfdir}/containers/systemd/authelia.container.d/session.conf
|
||||||
|
%dir %{_sysconfdir}/systemd/system/authelia.service.d
|
||||||
|
%config(noreplace) %{_sysconfdir}/systemd/system/authelia.service.d/session.conf
|
||||||
|
|
||||||
|
%changelog
|
||||||
|
* Thu Aug 06 2026 Zoran Pericic <zpericic@netst.org> - 4.39.20-1
|
||||||
|
- Initial package with service, container, postgresql and redis
|
||||||
|
subpackages
|
||||||
|
- Fixed UID/GID 126 for the authelia user
|
||||||
|
- Rootless quadlet (vaultwarden style) with an authelia pod publishing
|
||||||
|
127.0.0.1:9091; db and redis containers join the pod
|
||||||
|
- Container images pinned by digest
|
||||||
|
- Native -service subpackage built conditionally (--without service)
|
||||||
@@ -0,0 +1,2 @@
|
|||||||
|
g authelia 126
|
||||||
|
u authelia 126:126 "Authelia authentication server" /var/lib/authelia /sbin/nologin
|
||||||
@@ -0,0 +1,63 @@
|
|||||||
|
###
|
||||||
|
# Authelia configuration
|
||||||
|
# https://www.authelia.com/configuration/prologue/introduction/
|
||||||
|
#
|
||||||
|
# This file ships with placeholder secrets. Authelia will NOT start until
|
||||||
|
# the CHANGE_ME values, the session cookie domain and the user database
|
||||||
|
# are configured.
|
||||||
|
#
|
||||||
|
# Generate secrets with:
|
||||||
|
# authelia crypto rand --length 64 --charset alphanumeric
|
||||||
|
# (container install:
|
||||||
|
# sudo -u authelia podman exec authelia authelia crypto rand --length 64 --charset alphanumeric)
|
||||||
|
###
|
||||||
|
|
||||||
|
theme: 'auto'
|
||||||
|
|
||||||
|
server:
|
||||||
|
## Bind address. The container publishes only 127.0.0.1:9091 on the host;
|
||||||
|
## the native service overrides this to 127.0.0.1 via AUTHELIA_SERVER_ADDRESS
|
||||||
|
## in authelia.service.
|
||||||
|
address: 'tcp://0.0.0.0:9091/'
|
||||||
|
|
||||||
|
log:
|
||||||
|
level: 'info'
|
||||||
|
|
||||||
|
identity_validation:
|
||||||
|
reset_password:
|
||||||
|
jwt_secret: 'CHANGE_ME_jwt_secret'
|
||||||
|
|
||||||
|
authentication_backend:
|
||||||
|
file:
|
||||||
|
path: '/etc/authelia/users_database.yml'
|
||||||
|
|
||||||
|
access_control:
|
||||||
|
default_policy: 'one_factor'
|
||||||
|
|
||||||
|
session:
|
||||||
|
secret: 'CHANGE_ME_session_secret'
|
||||||
|
cookies:
|
||||||
|
- domain: 'example.com'
|
||||||
|
authelia_url: 'https://auth.example.com'
|
||||||
|
|
||||||
|
regulation:
|
||||||
|
max_retries: 3
|
||||||
|
find_time: '2m'
|
||||||
|
ban_time: '5m'
|
||||||
|
|
||||||
|
storage:
|
||||||
|
encryption_key: 'CHANGE_ME_storage_encryption_key'
|
||||||
|
## SQLite (default). When using the authelia-postgresql subpackage,
|
||||||
|
## comment out the `local:` block below and uncomment the
|
||||||
|
## AUTHELIA_STORAGE_POSTGRES_* environment in the database.conf drop-in
|
||||||
|
## (/etc/containers/systemd/authelia.container.d/database.conf for the
|
||||||
|
## container, /etc/systemd/system/authelia.service.d/database.conf for
|
||||||
|
## the native service).
|
||||||
|
local:
|
||||||
|
path: '/var/lib/authelia/data/db.sqlite3'
|
||||||
|
|
||||||
|
notifier:
|
||||||
|
## File-based notifier for initial setup. Replace with `smtp:` in
|
||||||
|
## production so users receive password reset / identity emails.
|
||||||
|
filesystem:
|
||||||
|
filename: '/var/lib/authelia/data/notification.txt'
|
||||||
@@ -0,0 +1,17 @@
|
|||||||
|
###
|
||||||
|
# File-based user database.
|
||||||
|
# https://www.authelia.com/reference/guides/passwords/
|
||||||
|
#
|
||||||
|
# Generate password hashes with:
|
||||||
|
# authelia crypto hash generate argon2
|
||||||
|
# (container install:
|
||||||
|
# sudo -u authelia podman exec -it authelia authelia crypto hash generate argon2)
|
||||||
|
###
|
||||||
|
|
||||||
|
users: {}
|
||||||
|
# admin:
|
||||||
|
# displayname: 'Administrator'
|
||||||
|
# password: '$argon2id$v=19$m=65536,t=3,p=4$CHANGE_ME'
|
||||||
|
# email: 'admin@example.com'
|
||||||
|
# groups:
|
||||||
|
# - 'admins'
|
||||||
Reference in New Issue
Block a user