Run quadlets as rootless user units

Quadlet does not support User= in system units: the generated pod
service writes its conmon pidfile to %t/%N.pid, which resolves to
/run/authelia-pod.pid and is unwritable by the authelia user, so
authelia-pod.service always failed with status 125. See
podman-systemd.unit(5).

- Move all quadlet files and drop-ins to the rootless search path
  /etc/containers/systemd/users/126; units now run in the authelia
  user's systemd manager, started at boot via linger
- Drop the [Service] User=/HOME overrides from the quadlet files
- Enable the pod via WantedBy=default.target
- Make /etc/authelia authelia-owned so rootless podman can relabel
  the config bind mount (:z)
- Replace system-unit systemd macros in the -container scriptlets
  with systemctl --user -M authelia@ daemon-reload / stop

authelia-db.container

@@ -15,8 +15,6 @@ HealthOnFailure=kill
 LogDriver=journald
 
 [Service]
-User=authelia
-Environment=HOME=/var/lib/authelia
 Restart=always
 RestartSec=5
 TimeoutStartSec=900

authelia-pod-enable.conf

@@ -1,2 +1,2 @@
 [Install]
-WantedBy=multi-user.target
+WantedBy=default.target

authelia-redis.container

@@ -15,8 +15,6 @@ HealthOnFailure=kill
 LogDriver=journald
 
 [Service]
-User=authelia
-Environment=HOME=/var/lib/authelia
 Restart=always
 RestartSec=5
 TimeoutStartSec=900

authelia.container

@@ -12,8 +12,6 @@ Volume=/etc/localtime:/etc/localtime:ro
 LogDriver=journald
 
 [Service]
-User=authelia
-Environment=HOME=/var/lib/authelia
 Restart=always
 RestartSec=5
 TimeoutStartSec=900

authelia.pod

@@ -4,7 +4,3 @@ Description=Authelia pod
 [Pod]
 PodName=authelia-pod
 PublishPort=127.0.0.1:9091:9091
-
-[Service]
-User=authelia
-Environment=HOME=/var/lib/authelia

authelia.spec

@@ -7,9 +7,17 @@
 # Prebuilt upstream binary: no debuginfo to extract
 %global debug_package %{nil}
 
+# Fixed UID/GID of the authelia user (see authelia.sysusers)
+%global authelia_uid 126
+# Rootless quadlet search path for the authelia user. Quadlets do not
+# support User=, so the units run in the authelia user's systemd manager
+# (started at boot via linger); /usr/share/containers/systemd is only
+# searched for rootful quadlets. See podman-systemd.unit(5).
+%global quadletdir %{_sysconfdir}/containers/systemd/users/%{authelia_uid}
+
 Name:           authelia
 Version:        4.39.20
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        Authelia - authentication and authorization server
 License:        Apache-2.0
 Group:          System Environment/Base
@@ -144,28 +152,28 @@ install -d -m 750 %{buildroot}%{_sharedstatedir}/authelia/data
 # Service subpackage
 install -p -D -m 755 authelia %{buildroot}%{_libexecdir}/authelia
 install -p -D -m 644 %{SOURCE10} %{buildroot}%{_unitdir}/authelia.service
-install -p -D -m 644 %{SOURCE19} %{buildroot}%{_datadir}/containers/systemd/authelia-db.container.d/publish.conf
+install -p -D -m 644 %{SOURCE19} %{buildroot}%{quadletdir}/authelia-db.container.d/publish.conf
-install -p -D -m 644 %{SOURCE25} %{buildroot}%{_datadir}/containers/systemd/authelia-redis.container.d/publish.conf
+install -p -D -m 644 %{SOURCE25} %{buildroot}%{quadletdir}/authelia-redis.container.d/publish.conf
 %endif
 
 # Container subpackage
-install -p -D -m 644 %{SOURCE14} %{buildroot}%{_datadir}/containers/systemd/authelia.container
+install -p -D -m 644 %{SOURCE14} %{buildroot}%{quadletdir}/authelia.container
-install -p -D -m 644 %{SOURCE15} %{buildroot}%{_datadir}/containers/systemd/authelia.pod
+install -p -D -m 644 %{SOURCE15} %{buildroot}%{quadletdir}/authelia.pod
-install -p -D -m 644 %{SOURCE16} %{buildroot}%{_sysconfdir}/containers/systemd/authelia.pod.d/enable.conf
+install -p -D -m 644 %{SOURCE16} %{buildroot}%{quadletdir}/authelia.pod.d/enable.conf
-install -p -D -m 644 %{SOURCE18} %{buildroot}%{_datadir}/containers/systemd/authelia-db.container.d/pod.conf
+install -p -D -m 644 %{SOURCE18} %{buildroot}%{quadletdir}/authelia-db.container.d/pod.conf
-install -p -D -m 644 %{SOURCE24} %{buildroot}%{_datadir}/containers/systemd/authelia-redis.container.d/pod.conf
+install -p -D -m 644 %{SOURCE24} %{buildroot}%{quadletdir}/authelia-redis.container.d/pod.conf
 
 # PostgreSQL subpackage
 install -d -m 750 %{buildroot}%{_sharedstatedir}/authelia/postgresql
-install -p -D -m 644 %{SOURCE17} %{buildroot}%{_datadir}/containers/systemd/authelia-db.container
+install -p -D -m 644 %{SOURCE17} %{buildroot}%{quadletdir}/authelia-db.container
-install -p -D -m 644 %{SOURCE20} %{buildroot}%{_sysconfdir}/containers/systemd/authelia-db.container.d/credentials.conf
+install -p -D -m 644 %{SOURCE20} %{buildroot}%{quadletdir}/authelia-db.container.d/credentials.conf
-install -p -D -m 644 %{SOURCE21} %{buildroot}%{_sysconfdir}/containers/systemd/authelia.container.d/database.conf
+install -p -D -m 644 %{SOURCE21} %{buildroot}%{quadletdir}/authelia.container.d/database.conf
 install -p -D -m 644 %{SOURCE22} %{buildroot}%{_sysconfdir}/systemd/system/authelia.service.d/database.conf
 
 # Redis subpackage
 install -d -m 750 %{buildroot}%{_sharedstatedir}/authelia/redis
-install -p -D -m 644 %{SOURCE23} %{buildroot}%{_datadir}/containers/systemd/authelia-redis.container
+install -p -D -m 644 %{SOURCE23} %{buildroot}%{quadletdir}/authelia-redis.container
-install -p -D -m 644 %{SOURCE26} %{buildroot}%{_sysconfdir}/containers/systemd/authelia.container.d/session.conf
+install -p -D -m 644 %{SOURCE26} %{buildroot}%{quadletdir}/authelia.container.d/session.conf
 install -p -D -m 644 %{SOURCE27} %{buildroot}%{_sysconfdir}/systemd/system/authelia.service.d/session.conf
 
 %pre
@@ -204,13 +212,18 @@ fi
 %endif
 
 %post container
-%systemd_post authelia.service
+# Quadlets run in the authelia user's systemd manager (started via
+# linger). Reload it so the units appear without a reboot; if the
+# manager is not running yet this is a no-op until next boot.
+systemctl --user -M authelia@ daemon-reload >/dev/null 2>&1 || :
 
 %preun container
-%systemd_preun authelia.service
+if [ $1 -eq 0 ]; then
+    systemctl --user -M authelia@ stop authelia-pod.service >/dev/null 2>&1 || :
+fi
 
 %postun container
-%systemd_postun authelia.service
+systemctl --user -M authelia@ daemon-reload >/dev/null 2>&1 || :
 
 %clean
 %{__rm} -rf %{buildroot}
@@ -219,9 +232,10 @@ fi
 %defattr(-,root,root,-)
 %{_sysusersdir}/authelia.conf
 
-%dir %attr(0750,root,authelia) %{_sysconfdir}/authelia
+# authelia-owned so rootless podman can relabel (:z) the config mount
-%config(noreplace) %attr(0640,root,authelia) %{_sysconfdir}/authelia/configuration.yml
+%dir %attr(0750,authelia,authelia) %{_sysconfdir}/authelia
-%config(noreplace) %attr(0640,root,authelia) %{_sysconfdir}/authelia/users_database.yml
+%config(noreplace) %attr(0640,authelia,authelia) %{_sysconfdir}/authelia/configuration.yml
+%config(noreplace) %attr(0640,authelia,authelia) %{_sysconfdir}/authelia/users_database.yml
 
 %dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia
 %dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia/data
@@ -232,44 +246,62 @@ fi
 %{_libexecdir}/authelia
 %ghost %{_bindir}/authelia
 %attr(0644,root,root) %{_unitdir}/authelia.service
-%dir %{_datadir}/containers/systemd/authelia-db.container.d
+%dir %{_sysconfdir}/containers/systemd/users
-%{_datadir}/containers/systemd/authelia-db.container.d/publish.conf
+%dir %{quadletdir}
-%dir %{_datadir}/containers/systemd/authelia-redis.container.d
+%dir %{quadletdir}/authelia-db.container.d
-%{_datadir}/containers/systemd/authelia-redis.container.d/publish.conf
+%{quadletdir}/authelia-db.container.d/publish.conf
+%dir %{quadletdir}/authelia-redis.container.d
+%{quadletdir}/authelia-redis.container.d/publish.conf
 %endif
 
 %files container
 %defattr(-,root,root,-)
-%{_datadir}/containers/systemd/authelia.container
+%dir %{_sysconfdir}/containers/systemd/users
-%{_datadir}/containers/systemd/authelia.pod
+%dir %{quadletdir}
-%dir %{_sysconfdir}/containers/systemd/authelia.pod.d
+%{quadletdir}/authelia.container
-%config(noreplace) %{_sysconfdir}/containers/systemd/authelia.pod.d/enable.conf
+%{quadletdir}/authelia.pod
-%dir %{_datadir}/containers/systemd/authelia-db.container.d
+%dir %{quadletdir}/authelia.pod.d
-%{_datadir}/containers/systemd/authelia-db.container.d/pod.conf
+%config(noreplace) %{quadletdir}/authelia.pod.d/enable.conf
-%dir %{_datadir}/containers/systemd/authelia-redis.container.d
+%dir %{quadletdir}/authelia-db.container.d
-%{_datadir}/containers/systemd/authelia-redis.container.d/pod.conf
+%{quadletdir}/authelia-db.container.d/pod.conf
+%dir %{quadletdir}/authelia-redis.container.d
+%{quadletdir}/authelia-redis.container.d/pod.conf
 
 %files postgresql
 %defattr(-,root,root,-)
 %dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia/postgresql
-%{_datadir}/containers/systemd/authelia-db.container
+%dir %{_sysconfdir}/containers/systemd/users
-%dir %{_sysconfdir}/containers/systemd/authelia-db.container.d
+%dir %{quadletdir}
-%config(noreplace) %{_sysconfdir}/containers/systemd/authelia-db.container.d/credentials.conf
+%{quadletdir}/authelia-db.container
-%dir %{_sysconfdir}/containers/systemd/authelia.container.d
+%dir %{quadletdir}/authelia-db.container.d
-%config(noreplace) %{_sysconfdir}/containers/systemd/authelia.container.d/database.conf
+%config(noreplace) %{quadletdir}/authelia-db.container.d/credentials.conf
+%dir %{quadletdir}/authelia.container.d
+%config(noreplace) %{quadletdir}/authelia.container.d/database.conf
 %dir %{_sysconfdir}/systemd/system/authelia.service.d
 %config(noreplace) %{_sysconfdir}/systemd/system/authelia.service.d/database.conf
 
 %files redis
 %defattr(-,root,root,-)
 %dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia/redis
-%{_datadir}/containers/systemd/authelia-redis.container
+%dir %{_sysconfdir}/containers/systemd/users
-%dir %{_sysconfdir}/containers/systemd/authelia.container.d
+%dir %{quadletdir}
-%config(noreplace) %{_sysconfdir}/containers/systemd/authelia.container.d/session.conf
+%{quadletdir}/authelia-redis.container
+%dir %{quadletdir}/authelia.container.d
+%config(noreplace) %{quadletdir}/authelia.container.d/session.conf
 %dir %{_sysconfdir}/systemd/system/authelia.service.d
 %config(noreplace) %{_sysconfdir}/systemd/system/authelia.service.d/session.conf
 
 %changelog
+* Thu Aug 06 2026 Zoran Pericic <zpericic@netst.org> - 4.39.20-2
+- Run quadlets as proper rootless user units in
+  /etc/containers/systemd/users/126 instead of system units with
+  User=authelia: quadlet does not support User= (the pod's conmon
+  pidfile at %%t/%%N.pid is unwritable in the system /run), see
+  podman-systemd.unit(5)
+- Enable via WantedBy=default.target in the authelia user manager
+- Make /etc/authelia authelia-owned so rootless podman can relabel
+  the config bind mount
+
 * Thu Aug 06 2026 Zoran Pericic <zpericic@netst.org> - 4.39.20-1
 - Initial package with service, container, postgresql and redis
   subpackages