rpms-fedora-free/authelia
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Run quadlets as rootless user units

Browse Source 
Quadlet does not support User= in system units: the generated pod
service writes its conmon pidfile to %t/%N.pid, which resolves to
/run/authelia-pod.pid and is unwritable by the authelia user, so
authelia-pod.service always failed with status 125. See
podman-systemd.unit(5).

- Move all quadlet files and drop-ins to the rootless search path
  /etc/containers/systemd/users/126; units now run in the authelia
  user's systemd manager, started at boot via linger
- Drop the [Service] User=/HOME overrides from the quadlet files
- Enable the pod via WantedBy=default.target
- Make /etc/authelia authelia-owned so rootless podman can relabel
  the config bind mount (:z)
- Replace system-unit systemd macros in the -container scriptlets
  with systemctl --user -M authelia@ daemon-reload / stop
This commit is contained in:
zpericic
2026-08-06 22:11:57 +02:00
parent 755fe4e81e
commit ca1b8cf1ba
6 changed files with 72 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
authelia-db.container
-2
View File
@@ -15,8 +15,6 @@ HealthOnFailure=kill
LogDriver=journald
[Service]
User=authelia
Environment=HOME=/var/lib/authelia
Restart=always
RestartSec=5
TimeoutStartSec=900
authelia-pod-enable.conf
+1 -1
View File
@@ -1,2 +1,2 @@
[Install]
WantedBy=multi-user.target
WantedBy=default.target
authelia-redis.container
-2
View File
@@ -15,8 +15,6 @@ HealthOnFailure=kill
LogDriver=journald
[Service]
User=authelia
Environment=HOME=/var/lib/authelia
Restart=always
RestartSec=5
TimeoutStartSec=900
authelia.container
-2
View File
@@ -12,8 +12,6 @@ Volume=/etc/localtime:/etc/localtime:ro
LogDriver=journald
[Service]
User=authelia
Environment=HOME=/var/lib/authelia
Restart=always
RestartSec=5
TimeoutStartSec=900
authelia.pod
-4
View File
@@ -4,7 +4,3 @@ Description=Authelia pod
[Pod]
PodName=authelia-pod
PublishPort=127.0.0.1:9091:9091
[Service]
User=authelia
Environment=HOME=/var/lib/authelia
authelia.spec
+71 -39
View File
@@ -7,9 +7,17 @@
# Prebuilt upstream binary: no debuginfo to extract
%global debug_package %{nil}
# Fixed UID/GID of the authelia user (see authelia.sysusers)
%global authelia_uid 126
# Rootless quadlet search path for the authelia user. Quadlets do not
# support User=, so the units run in the authelia user's systemd manager
# (started at boot via linger); /usr/share/containers/systemd is only
# searched for rootful quadlets. See podman-systemd.unit(5).
%global quadletdir %{_sysconfdir}/containers/systemd/users/%{authelia_uid}
Name: authelia
Version: 4.39.20
Release: 1%{?dist}
Release: 2%{?dist}
Summary: Authelia - authentication and authorization server
License: Apache-2.0
Group: System Environment/Base
@@ -144,28 +152,28 @@ install -d -m 750 %{buildroot}%{_sharedstatedir}/authelia/data
# Service subpackage
install -p -D -m 755 authelia %{buildroot}%{_libexecdir}/authelia
install -p -D -m 644 %{SOURCE10} %{buildroot}%{_unitdir}/authelia.service
install -p -D -m 644 %{SOURCE19} %{buildroot}%{_datadir}/containers/systemd/authelia-db.container.d/publish.conf
install -p -D -m 644 %{SOURCE25} %{buildroot}%{_datadir}/containers/systemd/authelia-redis.container.d/publish.conf
install -p -D -m 644 %{SOURCE19} %{buildroot}%{quadletdir}/authelia-db.container.d/publish.conf
install -p -D -m 644 %{SOURCE25} %{buildroot}%{quadletdir}/authelia-redis.container.d/publish.conf
%endif
# Container subpackage
install -p -D -m 644 %{SOURCE14} %{buildroot}%{_datadir}/containers/systemd/authelia.container
install -p -D -m 644 %{SOURCE15} %{buildroot}%{_datadir}/containers/systemd/authelia.pod
install -p -D -m 644 %{SOURCE16} %{buildroot}%{_sysconfdir}/containers/systemd/authelia.pod.d/enable.conf
install -p -D -m 644 %{SOURCE18} %{buildroot}%{_datadir}/containers/systemd/authelia-db.container.d/pod.conf
install -p -D -m 644 %{SOURCE24} %{buildroot}%{_datadir}/containers/systemd/authelia-redis.container.d/pod.conf
install -p -D -m 644 %{SOURCE14} %{buildroot}%{quadletdir}/authelia.container
install -p -D -m 644 %{SOURCE15} %{buildroot}%{quadletdir}/authelia.pod
install -p -D -m 644 %{SOURCE16} %{buildroot}%{quadletdir}/authelia.pod.d/enable.conf
install -p -D -m 644 %{SOURCE18} %{buildroot}%{quadletdir}/authelia-db.container.d/pod.conf
install -p -D -m 644 %{SOURCE24} %{buildroot}%{quadletdir}/authelia-redis.container.d/pod.conf
# PostgreSQL subpackage
install -d -m 750 %{buildroot}%{_sharedstatedir}/authelia/postgresql
install -p -D -m 644 %{SOURCE17} %{buildroot}%{_datadir}/containers/systemd/authelia-db.container
install -p -D -m 644 %{SOURCE20} %{buildroot}%{_sysconfdir}/containers/systemd/authelia-db.container.d/credentials.conf
install -p -D -m 644 %{SOURCE21} %{buildroot}%{_sysconfdir}/containers/systemd/authelia.container.d/database.conf
install -p -D -m 644 %{SOURCE17} %{buildroot}%{quadletdir}/authelia-db.container
install -p -D -m 644 %{SOURCE20} %{buildroot}%{quadletdir}/authelia-db.container.d/credentials.conf
install -p -D -m 644 %{SOURCE21} %{buildroot}%{quadletdir}/authelia.container.d/database.conf
install -p -D -m 644 %{SOURCE22} %{buildroot}%{_sysconfdir}/systemd/system/authelia.service.d/database.conf
# Redis subpackage
install -d -m 750 %{buildroot}%{_sharedstatedir}/authelia/redis
install -p -D -m 644 %{SOURCE23} %{buildroot}%{_datadir}/containers/systemd/authelia-redis.container
install -p -D -m 644 %{SOURCE26} %{buildroot}%{_sysconfdir}/containers/systemd/authelia.container.d/session.conf
install -p -D -m 644 %{SOURCE23} %{buildroot}%{quadletdir}/authelia-redis.container
install -p -D -m 644 %{SOURCE26} %{buildroot}%{quadletdir}/authelia.container.d/session.conf
install -p -D -m 644 %{SOURCE27} %{buildroot}%{_sysconfdir}/systemd/system/authelia.service.d/session.conf
%pre
@@ -204,13 +212,18 @@ fi
%endif
%post container
%systemd_post authelia.service
# Quadlets run in the authelia user's systemd manager (started via
# linger). Reload it so the units appear without a reboot; if the
# manager is not running yet this is a no-op until next boot.
systemctl --user -M authelia@ daemon-reload >/dev/null 2>&1 || :
%preun container
%systemd_preun authelia.service
if [ $1 -eq 0 ]; then
systemctl --user -M authelia@ stop authelia-pod.service >/dev/null 2>&1 || :
fi
%postun container
%systemd_postun authelia.service
systemctl --user -M authelia@ daemon-reload >/dev/null 2>&1 || :
%clean
%{__rm} -rf %{buildroot}
@@ -219,9 +232,10 @@ fi
%defattr(-,root,root,-)
%{_sysusersdir}/authelia.conf
%dir %attr(0750,root,authelia) %{_sysconfdir}/authelia
%config(noreplace) %attr(0640,root,authelia) %{_sysconfdir}/authelia/configuration.yml
%config(noreplace) %attr(0640,root,authelia) %{_sysconfdir}/authelia/users_database.yml
# authelia-owned so rootless podman can relabel (:z) the config mount
%dir %attr(0750,authelia,authelia) %{_sysconfdir}/authelia
%config(noreplace) %attr(0640,authelia,authelia) %{_sysconfdir}/authelia/configuration.yml
%config(noreplace) %attr(0640,authelia,authelia) %{_sysconfdir}/authelia/users_database.yml
%dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia
%dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia/data
@@ -232,44 +246,62 @@ fi
%{_libexecdir}/authelia
%ghost %{_bindir}/authelia
%attr(0644,root,root) %{_unitdir}/authelia.service
%dir %{_datadir}/containers/systemd/authelia-db.container.d
%{_datadir}/containers/systemd/authelia-db.container.d/publish.conf
%dir %{_datadir}/containers/systemd/authelia-redis.container.d
%{_datadir}/containers/systemd/authelia-redis.container.d/publish.conf
%dir %{_sysconfdir}/containers/systemd/users
%dir %{quadletdir}
%dir %{quadletdir}/authelia-db.container.d
%{quadletdir}/authelia-db.container.d/publish.conf
%dir %{quadletdir}/authelia-redis.container.d
%{quadletdir}/authelia-redis.container.d/publish.conf
%endif
%files container
%defattr(-,root,root,-)
%{_datadir}/containers/systemd/authelia.container
%{_datadir}/containers/systemd/authelia.pod
%dir %{_sysconfdir}/containers/systemd/authelia.pod.d
%config(noreplace) %{_sysconfdir}/containers/systemd/authelia.pod.d/enable.conf
%dir %{_datadir}/containers/systemd/authelia-db.container.d
%{_datadir}/containers/systemd/authelia-db.container.d/pod.conf
%dir %{_datadir}/containers/systemd/authelia-redis.container.d
%{_datadir}/containers/systemd/authelia-redis.container.d/pod.conf
%dir %{_sysconfdir}/containers/systemd/users
%dir %{quadletdir}
%{quadletdir}/authelia.container
%{quadletdir}/authelia.pod
%dir %{quadletdir}/authelia.pod.d
%config(noreplace) %{quadletdir}/authelia.pod.d/enable.conf
%dir %{quadletdir}/authelia-db.container.d
%{quadletdir}/authelia-db.container.d/pod.conf
%dir %{quadletdir}/authelia-redis.container.d
%{quadletdir}/authelia-redis.container.d/pod.conf
%files postgresql
%defattr(-,root,root,-)
%dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia/postgresql
%{_datadir}/containers/systemd/authelia-db.container
%dir %{_sysconfdir}/containers/systemd/authelia-db.container.d
%config(noreplace) %{_sysconfdir}/containers/systemd/authelia-db.container.d/credentials.conf
%dir %{_sysconfdir}/containers/systemd/authelia.container.d
%config(noreplace) %{_sysconfdir}/containers/systemd/authelia.container.d/database.conf
%dir %{_sysconfdir}/containers/systemd/users
%dir %{quadletdir}
%{quadletdir}/authelia-db.container
%dir %{quadletdir}/authelia-db.container.d
%config(noreplace) %{quadletdir}/authelia-db.container.d/credentials.conf
%dir %{quadletdir}/authelia.container.d
%config(noreplace) %{quadletdir}/authelia.container.d/database.conf
%dir %{_sysconfdir}/systemd/system/authelia.service.d
%config(noreplace) %{_sysconfdir}/systemd/system/authelia.service.d/database.conf
%files redis
%defattr(-,root,root,-)
%dir %attr(0750,authelia,authelia) %{_sharedstatedir}/authelia/redis
%{_datadir}/containers/systemd/authelia-redis.container
%dir %{_sysconfdir}/containers/systemd/authelia.container.d
%config(noreplace) %{_sysconfdir}/containers/systemd/authelia.container.d/session.conf
%dir %{_sysconfdir}/containers/systemd/users
%dir %{quadletdir}
%{quadletdir}/authelia-redis.container
%dir %{quadletdir}/authelia.container.d
%config(noreplace) %{quadletdir}/authelia.container.d/session.conf
%dir %{_sysconfdir}/systemd/system/authelia.service.d
%config(noreplace) %{_sysconfdir}/systemd/system/authelia.service.d/session.conf
%changelog
* Thu Aug 06 2026 Zoran Pericic <zpericic@netst.org> - 4.39.20-2
- Run quadlets as proper rootless user units in
/etc/containers/systemd/users/126 instead of system units with
User=authelia: quadlet does not support User= (the pod's conmon
pidfile at %%t/%%N.pid is unwritable in the system /run), see
podman-systemd.unit(5)
- Enable via WantedBy=default.target in the authelia user manager
- Make /etc/authelia authelia-owned so rootless podman can relabel
the config bind mount
* Thu Aug 06 2026 Zoran Pericic <zpericic@netst.org> - 4.39.20-1
- Initial package with service, container, postgresql and redis
subpackages