From ca1b8cf1ba13081a1047ea5b82e84dddc0751918 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zoran=20Peri=C4=8Di=C4=87?= Date: Thu, 6 Aug 2026 22:11:01 +0200 Subject: [PATCH] Run quadlets as rootless user units Quadlet does not support User= in system units: the generated pod service writes its conmon pidfile to %t/%N.pid, which resolves to /run/authelia-pod.pid and is unwritable by the authelia user, so authelia-pod.service always failed with status 125. See podman-systemd.unit(5). - Move all quadlet files and drop-ins to the rootless search path /etc/containers/systemd/users/126; units now run in the authelia user's systemd manager, started at boot via linger - Drop the [Service] User=/HOME overrides from the quadlet files - Enable the pod via WantedBy=default.target - Make /etc/authelia authelia-owned so rootless podman can relabel the config bind mount (:z) - Replace system-unit systemd macros in the -container scriptlets with systemctl --user -M authelia@ daemon-reload / stop --- authelia-db.container | 2 - authelia-pod-enable.conf | 2 +- authelia-redis.container | 2 - authelia.container | 2 - authelia.pod | 4 -- authelia.spec | 110 +++++++++++++++++++++++++-------------- 6 files changed, 72 insertions(+), 50 deletions(-) diff --git a/authelia-db.container b/authelia-db.container index 661c04d..9b3eaea 100644 --- a/authelia-db.container +++ b/authelia-db.container @@ -15,8 +15,6 @@ HealthOnFailure=kill LogDriver=journald [Service] -User=authelia -Environment=HOME=/var/lib/authelia Restart=always RestartSec=5 TimeoutStartSec=900 diff --git a/authelia-pod-enable.conf b/authelia-pod-enable.conf index f612d8f..323bfa2 100644 --- a/authelia-pod-enable.conf +++ b/authelia-pod-enable.conf @@ -1,2 +1,2 @@ [Install] -WantedBy=multi-user.target +WantedBy=default.target diff --git a/authelia-redis.container b/authelia-redis.container index 1bb5e4b..f78aa63 100644 --- a/authelia-redis.container +++ b/authelia-redis.container @@ -15,8 +15,6 @@ HealthOnFailure=kill LogDriver=journald [Service] -User=authelia -Environment=HOME=/var/lib/authelia Restart=always RestartSec=5 TimeoutStartSec=900 diff --git a/authelia.container b/authelia.container index 26190fa..35b8dfe 100644 --- a/authelia.container +++ b/authelia.container @@ -12,8 +12,6 @@ Volume=/etc/localtime:/etc/localtime:ro LogDriver=journald [Service] -User=authelia -Environment=HOME=/var/lib/authelia Restart=always RestartSec=5 TimeoutStartSec=900 diff --git a/authelia.pod b/authelia.pod index 1f8448a..b71ba36 100644 --- a/authelia.pod +++ b/authelia.pod @@ -4,7 +4,3 @@ Description=Authelia pod [Pod] PodName=authelia-pod PublishPort=127.0.0.1:9091:9091 - -[Service] -User=authelia -Environment=HOME=/var/lib/authelia diff --git a/authelia.spec b/authelia.spec index 7d69477..3db1cc7 100644 --- a/authelia.spec +++ b/authelia.spec @@ -7,9 +7,17 @@ # Prebuilt upstream binary: no debuginfo to extract %global debug_package %{nil} +# Fixed UID/GID of the authelia user (see authelia.sysusers) +%global authelia_uid 126 +# Rootless quadlet search path for the authelia user. Quadlets do not +# support User=, so the units run in the authelia user's systemd manager +# (started at boot via linger); /usr/share/containers/systemd is only +# searched for rootful quadlets. See podman-systemd.unit(5). +%global quadletdir %{_sysconfdir}/containers/systemd/users/%{authelia_uid} + Name: authelia Version: 4.39.20 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Authelia - authentication and authorization server License: Apache-2.0 Group: System Environment/Base @@ -144,28 +152,28 @@ install -d -m 750 %{buildroot}%{_sharedstatedir}/authelia/data # Service subpackage install -p -D -m 755 authelia %{buildroot}%{_libexecdir}/authelia install -p -D -m 644 %{SOURCE10} %{buildroot}%{_unitdir}/authelia.service -install -p -D -m 644 %{SOURCE19} %{buildroot}%{_datadir}/containers/systemd/authelia-db.container.d/publish.conf -install -p -D -m 644 %{SOURCE25} %{buildroot}%{_datadir}/containers/systemd/authelia-redis.container.d/publish.conf +install -p -D -m 644 %{SOURCE19} %{buildroot}%{quadletdir}/authelia-db.container.d/publish.conf +install -p -D -m 644 %{SOURCE25} %{buildroot}%{quadletdir}/authelia-redis.container.d/publish.conf %endif # Container subpackage -install -p -D -m 644 %{SOURCE14} %{buildroot}%{_datadir}/containers/systemd/authelia.container -install -p -D -m 644 %{SOURCE15} %{buildroot}%{_datadir}/containers/systemd/authelia.pod -install -p -D -m 644 %{SOURCE16} %{buildroot}%{_sysconfdir}/containers/systemd/authelia.pod.d/enable.conf -install -p -D -m 644 %{SOURCE18} %{buildroot}%{_datadir}/containers/systemd/authelia-db.container.d/pod.conf -install -p -D -m 644 %{SOURCE24} %{buildroot}%{_datadir}/containers/systemd/authelia-redis.container.d/pod.conf +install -p -D -m 644 %{SOURCE14} %{buildroot}%{quadletdir}/authelia.container +install -p -D -m 644 %{SOURCE15} %{buildroot}%{quadletdir}/authelia.pod +install -p -D -m 644 %{SOURCE16} %{buildroot}%{quadletdir}/authelia.pod.d/enable.conf +install -p -D -m 644 %{SOURCE18} %{buildroot}%{quadletdir}/authelia-db.container.d/pod.conf +install -p -D -m 644 %{SOURCE24} %{buildroot}%{quadletdir}/authelia-redis.container.d/pod.conf # PostgreSQL subpackage install -d -m 750 %{buildroot}%{_sharedstatedir}/authelia/postgresql -install -p -D -m 644 %{SOURCE17} %{buildroot}%{_datadir}/containers/systemd/authelia-db.container -install -p -D -m 644 %{SOURCE20} %{buildroot}%{_sysconfdir}/containers/systemd/authelia-db.container.d/credentials.conf -install -p -D -m 644 %{SOURCE21} %{buildroot}%{_sysconfdir}/containers/systemd/authelia.container.d/database.conf +install -p -D -m 644 %{SOURCE17} %{buildroot}%{quadletdir}/authelia-db.container +install -p -D -m 644 %{SOURCE20} %{buildroot}%{quadletdir}/authelia-db.container.d/credentials.conf +install -p -D -m 644 %{SOURCE21} %{buildroot}%{quadletdir}/authelia.container.d/database.conf install -p -D -m 644 %{SOURCE22} %{buildroot}%{_sysconfdir}/systemd/system/authelia.service.d/database.conf # Redis subpackage install -d -m 750 %{buildroot}%{_sharedstatedir}/authelia/redis -install -p -D -m 644 %{SOURCE23} %{buildroot}%{_datadir}/containers/systemd/authelia-redis.container -install -p -D -m 644 %{SOURCE26} %{buildroot}%{_sysconfdir}/containers/systemd/authelia.container.d/session.conf +install -p -D -m 644 %{SOURCE23} %{buildroot}%{quadletdir}/authelia-redis.container +install -p -D -m 644 %{SOURCE26} %{buildroot}%{quadletdir}/authelia.container.d/session.conf install -p -D -m 644 %{SOURCE27} %{buildroot}%{_sysconfdir}/systemd/system/authelia.service.d/session.conf %pre @@ -204,13 +212,18 @@ fi %endif %post container -%systemd_post authelia.service +# Quadlets run in the authelia user's systemd manager (started via +# linger). Reload it so the units appear without a reboot; if the +# manager is not running yet this is a no-op until next boot. +systemctl --user -M authelia@ daemon-reload >/dev/null 2>&1 || : %preun container -%systemd_preun authelia.service +if [ $1 -eq 0 ]; then + systemctl --user -M authelia@ stop authelia-pod.service >/dev/null 2>&1 || : +fi %postun container -%systemd_postun authelia.service +systemctl --user -M authelia@ daemon-reload >/dev/null 2>&1 || : %clean %{__rm} -rf %{buildroot} @@ -219,9 +232,10 @@ fi %defattr(-,root,root,-) %{_sysusersdir}/authelia.conf -%dir %attr(0750,root,authelia) %{_sysconfdir}/authelia -%config(noreplace) %attr(0640,root,authelia) %{_sysconfdir}/authelia/configuration.yml -%config(noreplace) %attr(0640,root,authelia) %{_sysconfdir}/authelia/users_database.yml +# authelia-owned so rootless podman can relabel (:z) the config mount +%dir %attr(0750,authelia,authelia) %{_sysconfdir}/authelia +%config(noreplace) %attr(0640,authelia,authelia) %{_sysconfdir}/authelia/configuration.yml +%config(noreplace) %attr(0640,authelia,authelia) %{_sysconfdir}/authelia/users_database.yml %dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia %dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia/data @@ -232,44 +246,62 @@ fi %{_libexecdir}/authelia %ghost %{_bindir}/authelia %attr(0644,root,root) %{_unitdir}/authelia.service -%dir %{_datadir}/containers/systemd/authelia-db.container.d -%{_datadir}/containers/systemd/authelia-db.container.d/publish.conf -%dir %{_datadir}/containers/systemd/authelia-redis.container.d -%{_datadir}/containers/systemd/authelia-redis.container.d/publish.conf +%dir %{_sysconfdir}/containers/systemd/users +%dir %{quadletdir} +%dir %{quadletdir}/authelia-db.container.d +%{quadletdir}/authelia-db.container.d/publish.conf +%dir %{quadletdir}/authelia-redis.container.d +%{quadletdir}/authelia-redis.container.d/publish.conf %endif %files container %defattr(-,root,root,-) -%{_datadir}/containers/systemd/authelia.container -%{_datadir}/containers/systemd/authelia.pod -%dir %{_sysconfdir}/containers/systemd/authelia.pod.d -%config(noreplace) %{_sysconfdir}/containers/systemd/authelia.pod.d/enable.conf -%dir %{_datadir}/containers/systemd/authelia-db.container.d -%{_datadir}/containers/systemd/authelia-db.container.d/pod.conf -%dir %{_datadir}/containers/systemd/authelia-redis.container.d -%{_datadir}/containers/systemd/authelia-redis.container.d/pod.conf +%dir %{_sysconfdir}/containers/systemd/users +%dir %{quadletdir} +%{quadletdir}/authelia.container +%{quadletdir}/authelia.pod +%dir %{quadletdir}/authelia.pod.d +%config(noreplace) %{quadletdir}/authelia.pod.d/enable.conf +%dir %{quadletdir}/authelia-db.container.d +%{quadletdir}/authelia-db.container.d/pod.conf +%dir %{quadletdir}/authelia-redis.container.d +%{quadletdir}/authelia-redis.container.d/pod.conf %files postgresql %defattr(-,root,root,-) %dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia/postgresql -%{_datadir}/containers/systemd/authelia-db.container -%dir %{_sysconfdir}/containers/systemd/authelia-db.container.d -%config(noreplace) %{_sysconfdir}/containers/systemd/authelia-db.container.d/credentials.conf -%dir %{_sysconfdir}/containers/systemd/authelia.container.d -%config(noreplace) %{_sysconfdir}/containers/systemd/authelia.container.d/database.conf +%dir %{_sysconfdir}/containers/systemd/users +%dir %{quadletdir} +%{quadletdir}/authelia-db.container +%dir %{quadletdir}/authelia-db.container.d +%config(noreplace) %{quadletdir}/authelia-db.container.d/credentials.conf +%dir %{quadletdir}/authelia.container.d +%config(noreplace) %{quadletdir}/authelia.container.d/database.conf %dir %{_sysconfdir}/systemd/system/authelia.service.d %config(noreplace) %{_sysconfdir}/systemd/system/authelia.service.d/database.conf %files redis %defattr(-,root,root,-) %dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia/redis -%{_datadir}/containers/systemd/authelia-redis.container -%dir %{_sysconfdir}/containers/systemd/authelia.container.d -%config(noreplace) %{_sysconfdir}/containers/systemd/authelia.container.d/session.conf +%dir %{_sysconfdir}/containers/systemd/users +%dir %{quadletdir} +%{quadletdir}/authelia-redis.container +%dir %{quadletdir}/authelia.container.d +%config(noreplace) %{quadletdir}/authelia.container.d/session.conf %dir %{_sysconfdir}/systemd/system/authelia.service.d %config(noreplace) %{_sysconfdir}/systemd/system/authelia.service.d/session.conf %changelog +* Thu Aug 06 2026 Zoran Pericic - 4.39.20-2 +- Run quadlets as proper rootless user units in + /etc/containers/systemd/users/126 instead of system units with + User=authelia: quadlet does not support User= (the pod's conmon + pidfile at %%t/%%N.pid is unwritable in the system /run), see + podman-systemd.unit(5) +- Enable via WantedBy=default.target in the authelia user manager +- Make /etc/authelia authelia-owned so rootless podman can relabel + the config bind mount + * Thu Aug 06 2026 Zoran Pericic - 4.39.20-1 - Initial package with service, container, postgresql and redis subpackages