Initial authelia 4.39.20 package

- Base + service (native binary), container (rootless quadlet), postgresql and redis subpackages - Fixed UID/GID 126 for the authelia user - Rootless pod publishing 127.0.0.1:9091; db and redis join the pod (container) or publish on localhost (service) - Container images pinned by digest - Native -service subpackage built conditionally (--without service)
2026-08-06 17:37:21 +02:00
commit 755fe4e81e
20 changed files with 541 additions and 0 deletions
@@ -0,0 +1,3 @@
+# Downloaded upstream release tarballs
+authelia-v[0-9]*.[0-9]*.[0-9]*-linux-amd64.tar.gz
+authelia-v[0-9]*.[0-9]*.[0-9]*-linux-arm64.tar.gz
@@ -0,0 +1,16 @@
+[Unit]
+Wants=authelia-db.service
+After=authelia-db.service
+
+[Container]
+###
+# PostgreSQL storage (authelia-postgresql subpackage).
+# Uncomment the environment below AND comment out the `local:` storage
+# block in /etc/authelia/configuration.yml (Authelia refuses to start
+# with two storage providers configured).
+# 127.0.0.1 works because authelia-db shares the pod network namespace.
+###
+#Environment=AUTHELIA_STORAGE_POSTGRES_ADDRESS=tcp://127.0.0.1:5432
+#Environment=AUTHELIA_STORAGE_POSTGRES_DATABASE=authelia
+#Environment=AUTHELIA_STORAGE_POSTGRES_USERNAME=authelia
+#Environment=AUTHELIA_STORAGE_POSTGRES_PASSWORD=authelia
@@ -0,0 +1,12 @@
+[Unit]
+Wants=authelia-redis.service
+After=authelia-redis.service
+
+[Container]
+###
+# Redis session storage (authelia-redis subpackage).
+# Uncomment to store sessions in Redis instead of memory.
+# 127.0.0.1 works because authelia-redis shares the pod network namespace.
+###
+#Environment=AUTHELIA_SESSION_REDIS_HOST=127.0.0.1
+#Environment=AUTHELIA_SESSION_REDIS_PORT=6379
@@ -0,0 +1,4 @@
+[Container]
+Environment=POSTGRES_USER=authelia
+Environment=POSTGRES_PASSWORD=authelia
+Environment=POSTGRES_DB=authelia
@@ -0,0 +1,2 @@
+[Container]
+Pod=authelia.pod
@@ -0,0 +1,2 @@
+[Container]
+PublishPort=127.0.0.1:5432:5432
@@ -0,0 +1,22 @@
+[Unit]
+Description=Authelia PostgreSQL Database
+
+[Container]
+Image=docker.io/library/postgres:18.1-trixie@sha256:1090bc3a8ccfb0b55f78a494d76f8d603434f7e4553543d6e807bc7bd6bbd17f
+ContainerName=authelia-db
+Volume=/var/lib/authelia/postgresql:/var/lib/postgresql:Z
+Exec=postgres -c shared_buffers=128MB -c min_wal_size=80MB
+HealthCmd=pg_isready -U authelia
+HealthInterval=30s
+HealthTimeout=10s
+HealthRetries=5
+HealthStartPeriod=1m
+HealthOnFailure=kill
+LogDriver=journald
+
+[Service]
+User=authelia
+Environment=HOME=/var/lib/authelia
+Restart=always
+RestartSec=5
+TimeoutStartSec=900
@@ -0,0 +1,2 @@
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,2 @@
+[Container]
+Pod=authelia.pod
@@ -0,0 +1,2 @@
+[Container]
+PublishPort=127.0.0.1:6379:6379
@@ -0,0 +1,22 @@
+[Unit]
+Description=Authelia Redis session store
+
+[Container]
+Image=docker.io/library/redis:8.4-alpine@sha256:bd4a0d37e7cd830117ffec9329052b4a1887afa060c265e1768f82b177ff6f43
+ContainerName=authelia-redis
+Volume=/var/lib/authelia/redis:/data:Z
+Exec=redis-server --save 60 1
+HealthCmd=redis-cli ping
+HealthInterval=30s
+HealthTimeout=10s
+HealthRetries=5
+HealthStartPeriod=30s
+HealthOnFailure=kill
+LogDriver=journald
+
+[Service]
+User=authelia
+Environment=HOME=/var/lib/authelia
+Restart=always
+RestartSec=5
+TimeoutStartSec=900
@@ -0,0 +1,17 @@
+[Unit]
+Wants=authelia-db.service
+After=authelia-db.service
+
+[Service]
+###
+# PostgreSQL storage (authelia-postgresql subpackage) for the native
+# authelia-service install.
+# Uncomment the environment below AND comment out the `local:` storage
+# block in /etc/authelia/configuration.yml (Authelia refuses to start
+# with two storage providers configured).
+# The authelia-db container publishes 127.0.0.1:5432 on the host.
+###
+#Environment=AUTHELIA_STORAGE_POSTGRES_ADDRESS=tcp://127.0.0.1:5432
+#Environment=AUTHELIA_STORAGE_POSTGRES_DATABASE=authelia
+#Environment=AUTHELIA_STORAGE_POSTGRES_USERNAME=authelia
+#Environment=AUTHELIA_STORAGE_POSTGRES_PASSWORD=authelia
@@ -0,0 +1,13 @@
+[Unit]
+Wants=authelia-redis.service
+After=authelia-redis.service
+
+[Service]
+###
+# Redis session storage (authelia-redis subpackage) for the native
+# authelia-service install.
+# Uncomment to store sessions in Redis instead of memory.
+# The authelia-redis container publishes 127.0.0.1:6379 on the host.
+###
+#Environment=AUTHELIA_SESSION_REDIS_HOST=127.0.0.1
+#Environment=AUTHELIA_SESSION_REDIS_PORT=6379
@@ -0,0 +1,19 @@
+[Unit]
+Description=Authelia authentication and authorization server
+
+[Container]
+ContainerName=authelia
+Image=docker.io/authelia/authelia:4.39.20@sha256:1b363e9279e742397966333f364e0876ae02bf5c876de73e83af6d48c57ff51b
+Pod=authelia.pod
+Exec=--config /etc/authelia/configuration.yml
+Volume=/etc/authelia:/etc/authelia:ro,z
+Volume=/var/lib/authelia/data:/var/lib/authelia/data:Z
+Volume=/etc/localtime:/etc/localtime:ro
+LogDriver=journald
+
+[Service]
+User=authelia
+Environment=HOME=/var/lib/authelia
+Restart=always
+RestartSec=5
+TimeoutStartSec=900
@@ -0,0 +1,10 @@
+[Unit]
+Description=Authelia pod
+
+[Pod]
+PodName=authelia-pod
+PublishPort=127.0.0.1:9091:9091
+
+[Service]
+User=authelia
+Environment=HOME=/var/lib/authelia
@@ -0,0 +1,31 @@
+[Unit]
+Description=Authelia authentication and authorization server
+Documentation=https://www.authelia.com
+After=network.target
+
+[Service]
+User=authelia
+Group=authelia
+UMask=027
+Environment=AUTHELIA_SERVER_ADDRESS=tcp://127.0.0.1:9091/
+Environment=AUTHELIA_SERVER_DISABLE_HEALTHCHECK=true
+ExecStart=/usr/libexec/authelia --config /etc/authelia/configuration.yml
+Restart=always
+RestartSec=3
+SyslogIdentifier=authelia
+CapabilityBoundingSet=
+NoNewPrivileges=yes
+RestrictNamespaces=yes
+ProtectHome=true
+ProtectSystem=strict
+ReadWritePaths=/var/lib/authelia
+PrivateDevices=yes
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,280 @@
+# Build the native binary -service subpackage by default.
+# Disable to build without the upstream release tarballs (container-only):
+#   rpmbuild -bb --without service authelia.spec
+#   mock --without=service ...
+%bcond_without service
+
+# Prebuilt upstream binary: no debuginfo to extract
+%global debug_package %{nil}
+
+Name:           authelia
+Version:        4.39.20
+Release:        1%{?dist}
+Summary:        Authelia - authentication and authorization server
+License:        Apache-2.0
+Group:          System Environment/Base
+URL:            https://www.authelia.com
+
+%if %{with service}
+Source0:        https://github.com/authelia/authelia/releases/download/v%{version}/authelia-v%{version}-linux-amd64.tar.gz
+Source1:        https://github.com/authelia/authelia/releases/download/v%{version}/authelia-v%{version}-linux-arm64.tar.gz
+%endif
+Source10:       authelia.service
+Source11:       authelia.sysusers
+Source12:       configuration.yml
+Source13:       users_database.yml
+Source14:       authelia.container
+Source15:       authelia.pod
+Source16:       authelia-pod-enable.conf
+Source17:       authelia-db.container
+Source18:       authelia-db-pod.conf
+Source19:       authelia-db-publish.conf
+Source20:       authelia-db-credentials.conf
+Source21:       authelia-container-database.conf
+Source22:       authelia-service-database.conf
+Source23:       authelia-redis.container
+Source24:       authelia-redis-pod.conf
+Source25:       authelia-redis-publish.conf
+Source26:       authelia-container-session.conf
+Source27:       authelia-service-session.conf
+
+%if %{with service}
+ExclusiveArch:  x86_64 aarch64
+%else
+BuildArch:      noarch
+%endif
+
+BuildRequires:  systemd-rpm-macros
+
+%description
+Authelia is an open-source authentication and authorization server
+providing single sign-on (SSO) and two-factor authentication (2FA) for
+applications behind a reverse proxy.
+
+This base package ships the authelia user (UID 126), the configuration
+in /etc/authelia and the data directory. Install either
+authelia-service (native binary) or authelia-container (rootless Podman
+quadlet) to actually run the server.
+
+%if %{with service}
+%package service
+Summary:        Authelia systemd service (native binary)
+Requires:       %{name} = %{version}-%{release}
+Conflicts:      %{name}-container
+%{?systemd_requires}
+
+%description service
+Runs Authelia as a native binary under systemd, listening on
+127.0.0.1:9091.
+%endif
+
+%package container
+Summary:        Authelia container (rootless Podman quadlet)
+Requires:       %{name} = %{version}-%{release}
+Requires:       podman
+Requires:       containers-common
+Requires:       systemd-container
+%if %{with service}
+Conflicts:      %{name}-service
+%endif
+
+%description container
+Runs Authelia as a rootless Podman container (quadlet) under the
+authelia user, in a pod publishing 127.0.0.1:9091. The optional
+authelia-postgresql and authelia-redis containers join the same pod.
+
+%package postgresql
+Summary:        PostgreSQL storage backend for Authelia
+Requires:       %{name} = %{version}-%{release}
+Requires:       podman
+Requires:       containers-common
+Requires:       systemd-container
+
+%description postgresql
+Ships a PostgreSQL container (authelia-db) running rootless under the
+authelia user. With authelia-container it joins the authelia pod; with
+authelia-service it publishes 127.0.0.1:5432. Enable it by uncommenting
+the AUTHELIA_STORAGE_POSTGRES_* environment in the database.conf
+drop-in and commenting out the local storage block in
+/etc/authelia/configuration.yml.
+
+%package redis
+Summary:        Redis session storage for Authelia
+Requires:       %{name} = %{version}-%{release}
+Requires:       podman
+Requires:       containers-common
+Requires:       systemd-container
+
+%description redis
+Ships a Redis container (authelia-redis) running rootless under the
+authelia user for persistent session storage. With authelia-container
+it joins the authelia pod; with authelia-service it publishes
+127.0.0.1:6379. Enable it by uncommenting the AUTHELIA_SESSION_REDIS_*
+environment in the session.conf drop-in.
+
+%prep
+%setup -q -c -T
+%if %{with service}
+%ifarch x86_64
+tar -xzf %{SOURCE0} authelia
+%endif
+%ifarch aarch64
+tar -xzf %{SOURCE1} authelia
+%endif
+%endif
+
+%install
+%{__rm} -rf %{buildroot}
+
+# Base: sysusers, config
+install -p -D -m 644 %{SOURCE11} %{buildroot}%{_sysusersdir}/authelia.conf
+
+install -d -m 750 %{buildroot}%{_sysconfdir}/authelia
+install -m 640 %{SOURCE12} %{buildroot}%{_sysconfdir}/authelia/configuration.yml
+install -m 640 %{SOURCE13} %{buildroot}%{_sysconfdir}/authelia/users_database.yml
+
+# Base: data dirs. /var/lib/authelia is the authelia user's HOME and holds
+# the rootless podman storage for the container variants; only data/ (and
+# the db dirs) are mounted into containers, since podman refuses relabeling
+# of $HOME itself.
+install -d -m 750 %{buildroot}%{_sharedstatedir}/authelia
+install -d -m 750 %{buildroot}%{_sharedstatedir}/authelia/data
+
+%if %{with service}
+# Service subpackage
+install -p -D -m 755 authelia %{buildroot}%{_libexecdir}/authelia
+install -p -D -m 644 %{SOURCE10} %{buildroot}%{_unitdir}/authelia.service
+install -p -D -m 644 %{SOURCE19} %{buildroot}%{_datadir}/containers/systemd/authelia-db.container.d/publish.conf
+install -p -D -m 644 %{SOURCE25} %{buildroot}%{_datadir}/containers/systemd/authelia-redis.container.d/publish.conf
+%endif
+
+# Container subpackage
+install -p -D -m 644 %{SOURCE14} %{buildroot}%{_datadir}/containers/systemd/authelia.container
+install -p -D -m 644 %{SOURCE15} %{buildroot}%{_datadir}/containers/systemd/authelia.pod
+install -p -D -m 644 %{SOURCE16} %{buildroot}%{_sysconfdir}/containers/systemd/authelia.pod.d/enable.conf
+install -p -D -m 644 %{SOURCE18} %{buildroot}%{_datadir}/containers/systemd/authelia-db.container.d/pod.conf
+install -p -D -m 644 %{SOURCE24} %{buildroot}%{_datadir}/containers/systemd/authelia-redis.container.d/pod.conf
+
+# PostgreSQL subpackage
+install -d -m 750 %{buildroot}%{_sharedstatedir}/authelia/postgresql
+install -p -D -m 644 %{SOURCE17} %{buildroot}%{_datadir}/containers/systemd/authelia-db.container
+install -p -D -m 644 %{SOURCE20} %{buildroot}%{_sysconfdir}/containers/systemd/authelia-db.container.d/credentials.conf
+install -p -D -m 644 %{SOURCE21} %{buildroot}%{_sysconfdir}/containers/systemd/authelia.container.d/database.conf
+install -p -D -m 644 %{SOURCE22} %{buildroot}%{_sysconfdir}/systemd/system/authelia.service.d/database.conf
+
+# Redis subpackage
+install -d -m 750 %{buildroot}%{_sharedstatedir}/authelia/redis
+install -p -D -m 644 %{SOURCE23} %{buildroot}%{_datadir}/containers/systemd/authelia-redis.container
+install -p -D -m 644 %{SOURCE26} %{buildroot}%{_sysconfdir}/containers/systemd/authelia.container.d/session.conf
+install -p -D -m 644 %{SOURCE27} %{buildroot}%{_sysconfdir}/systemd/system/authelia.service.d/session.conf
+
+%pre
+%sysusers_create_compat %{SOURCE11}
+
+%post
+# Rootless podman under the authelia system user (container variants)
+# needs a lingering user session (/run/user/126) and a subuid/subgid
+# range for the in-container users.
+if [ $1 -eq 1 ]; then
+    loginctl enable-linger authelia || :
+fi
+
+if ! grep -q "^authelia:" /etc/subuid 2>/dev/null; then
+    NEXT=$(awk -F: '{n=$2+$3} END{print n+0}' /etc/subuid 2>/dev/null)
+    [ "$NEXT" -lt 524288 ] && NEXT=524288
+    END=$((NEXT + 65535))
+    usermod --add-subuids "$NEXT-$END" --add-subgids "$NEXT-$END" authelia 2>/dev/null || :
+fi
+
+%if %{with service}
+%post service
+%systemd_post authelia.service
+
+%posttrans service
+ln -sf %{_libexecdir}/authelia %{_bindir}/authelia
+
+%preun service
+%systemd_preun authelia.service
+
+%postun service
+%systemd_postun_with_restart authelia.service
+if [ $1 -eq 0 ]; then
+    rm -f %{_bindir}/authelia
+fi
+%endif
+
+%post container
+%systemd_post authelia.service
+
+%preun container
+%systemd_preun authelia.service
+
+%postun container
+%systemd_postun authelia.service
+
+%clean
+%{__rm} -rf %{buildroot}
+
+%files
+%defattr(-,root,root,-)
+%{_sysusersdir}/authelia.conf
+
+%dir %attr(0750,root,authelia) %{_sysconfdir}/authelia
+%config(noreplace) %attr(0640,root,authelia) %{_sysconfdir}/authelia/configuration.yml
+%config(noreplace) %attr(0640,root,authelia) %{_sysconfdir}/authelia/users_database.yml
+
+%dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia
+%dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia/data
+
+%if %{with service}
+%files service
+%defattr(-,root,root,-)
+%{_libexecdir}/authelia
+%ghost %{_bindir}/authelia
+%attr(0644,root,root) %{_unitdir}/authelia.service
+%dir %{_datadir}/containers/systemd/authelia-db.container.d
+%{_datadir}/containers/systemd/authelia-db.container.d/publish.conf
+%dir %{_datadir}/containers/systemd/authelia-redis.container.d
+%{_datadir}/containers/systemd/authelia-redis.container.d/publish.conf
+%endif
+
+%files container
+%defattr(-,root,root,-)
+%{_datadir}/containers/systemd/authelia.container
+%{_datadir}/containers/systemd/authelia.pod
+%dir %{_sysconfdir}/containers/systemd/authelia.pod.d
+%config(noreplace) %{_sysconfdir}/containers/systemd/authelia.pod.d/enable.conf
+%dir %{_datadir}/containers/systemd/authelia-db.container.d
+%{_datadir}/containers/systemd/authelia-db.container.d/pod.conf
+%dir %{_datadir}/containers/systemd/authelia-redis.container.d
+%{_datadir}/containers/systemd/authelia-redis.container.d/pod.conf
+
+%files postgresql
+%defattr(-,root,root,-)
+%dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia/postgresql
+%{_datadir}/containers/systemd/authelia-db.container
+%dir %{_sysconfdir}/containers/systemd/authelia-db.container.d
+%config(noreplace) %{_sysconfdir}/containers/systemd/authelia-db.container.d/credentials.conf
+%dir %{_sysconfdir}/containers/systemd/authelia.container.d
+%config(noreplace) %{_sysconfdir}/containers/systemd/authelia.container.d/database.conf
+%dir %{_sysconfdir}/systemd/system/authelia.service.d
+%config(noreplace) %{_sysconfdir}/systemd/system/authelia.service.d/database.conf
+
+%files redis
+%defattr(-,root,root,-)
+%dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia/redis
+%{_datadir}/containers/systemd/authelia-redis.container
+%dir %{_sysconfdir}/containers/systemd/authelia.container.d
+%config(noreplace) %{_sysconfdir}/containers/systemd/authelia.container.d/session.conf
+%dir %{_sysconfdir}/systemd/system/authelia.service.d
+%config(noreplace) %{_sysconfdir}/systemd/system/authelia.service.d/session.conf
+
+%changelog
+* Thu Aug 06 2026 Zoran Pericic <zpericic@netst.org> - 4.39.20-1
+- Initial package with service, container, postgresql and redis
+  subpackages
+- Fixed UID/GID 126 for the authelia user
+- Rootless quadlet (vaultwarden style) with an authelia pod publishing
+  127.0.0.1:9091; db and redis containers join the pod
+- Container images pinned by digest
+- Native -service subpackage built conditionally (--without service)
@@ -0,0 +1,2 @@
+g authelia 126
+u authelia 126:126 "Authelia authentication server" /var/lib/authelia /sbin/nologin
@@ -0,0 +1,63 @@
+###
+# Authelia configuration
+# https://www.authelia.com/configuration/prologue/introduction/
+#
+# This file ships with placeholder secrets. Authelia will NOT start until
+# the CHANGE_ME values, the session cookie domain and the user database
+# are configured.
+#
+# Generate secrets with:
+#   authelia crypto rand --length 64 --charset alphanumeric
+# (container install:
+#   sudo -u authelia podman exec authelia authelia crypto rand --length 64 --charset alphanumeric)
+###
+
+theme: 'auto'
+
+server:
+  ## Bind address. The container publishes only 127.0.0.1:9091 on the host;
+  ## the native service overrides this to 127.0.0.1 via AUTHELIA_SERVER_ADDRESS
+  ## in authelia.service.
+  address: 'tcp://0.0.0.0:9091/'
+
+log:
+  level: 'info'
+
+identity_validation:
+  reset_password:
+    jwt_secret: 'CHANGE_ME_jwt_secret'
+
+authentication_backend:
+  file:
+    path: '/etc/authelia/users_database.yml'
+
+access_control:
+  default_policy: 'one_factor'
+
+session:
+  secret: 'CHANGE_ME_session_secret'
+  cookies:
+    - domain: 'example.com'
+      authelia_url: 'https://auth.example.com'
+
+regulation:
+  max_retries: 3
+  find_time: '2m'
+  ban_time: '5m'
+
+storage:
+  encryption_key: 'CHANGE_ME_storage_encryption_key'
+  ## SQLite (default). When using the authelia-postgresql subpackage,
+  ## comment out the `local:` block below and uncomment the
+  ## AUTHELIA_STORAGE_POSTGRES_* environment in the database.conf drop-in
+  ## (/etc/containers/systemd/authelia.container.d/database.conf for the
+  ## container, /etc/systemd/system/authelia.service.d/database.conf for
+  ## the native service).
+  local:
+    path: '/var/lib/authelia/data/db.sqlite3'
+
+notifier:
+  ## File-based notifier for initial setup. Replace with `smtp:` in
+  ## production so users receive password reset / identity emails.
+  filesystem:
+    filename: '/var/lib/authelia/data/notification.txt'
@@ -0,0 +1,17 @@
+###
+# File-based user database.
+# https://www.authelia.com/reference/guides/passwords/
+#
+# Generate password hashes with:
+#   authelia crypto hash generate argon2
+# (container install:
+#   sudo -u authelia podman exec -it authelia authelia crypto hash generate argon2)
+###
+
+users: {}
+#  admin:
+#    displayname: 'Administrator'
+#    password: '$argon2id$v=19$m=65536,t=3,p=4$CHANGE_ME'
+#    email: 'admin@example.com'
+#    groups:
+#      - 'admins'