docs: add Authelia server-side setup guide to script output and README

After configure_authelia() saves credentials, it now prints the full
Dockerized Authelia server-side checklist: argon2 hash generation
command, users.yml kiosk user template, configuration.yml session
duration and access_control rules, and a docker compose restart step.

README gains a new Authentication section under Optional Add-ons
covering the same steps in Markdown with a table comparing Authelia
SSO vs HTTP Basic Auth (both can coexist).

Also clarifies that the Authelia password is encrypted at rest and
not stored in plain text.

https://claude.ai/code/session_01EyjEQLWbTXcZgbMDarf7NU

Readme.md

@@ -114,6 +114,92 @@ The installer will guide you through configuration during setup.
 
 ## Optional Add-ons
 
+### Authentication
+
+#### Authelia Auto-Login (SSO)
+
+Automatically authenticates the kiosk against a self-hosted [Authelia](https://www.authelia.com) instance on every startup. The Authelia password is **not stored in plain text** — it is encrypted with AES-256-CBC using a key derived from the machine's unique `/etc/machine-id`, so the encrypted blob is useless on any other machine.
+
+**Access via menu:** `Addons → 5. Authelia Auto-Login`
+
+After running the addon it prints the full server-side setup, but the summary is below.
+
+##### Kiosk side (SSH in and run the installer)
+
+```bash
+ssh user@kiosk-machine
+./$(ls ubuntu-based-kiosk-v*.sh | sort -V | tail -1)
+# Addons → 5. Authelia Auto-Login
+# Enter your Authelia URL, username, and password when prompted
+```
+
+##### Authelia server side (Dockerized)
+
+**Step 1 — Generate the argon2 password hash** (run on your Docker host):
+
+```bash
+docker run --rm authelia/authelia:latest \
+  authelia crypto hash generate argon2 \
+  --password 'yourpassword'
+```
+
+Copy the `$argon2id$...` output — that is your hash.
+
+**Step 2 — Add a kiosk user** to `~/docker/authelia/config/users.yml`:
+
+```yaml
+kiosk:
+  displayname: "Kiosk Display"
+  password: '$argon2id$v=19$m=65536,t=3,p=4$<paste hash here>'
+  email: kiosk@local.com
+  groups:
+    - kiosk
+```
+
+**Step 3 — Configure session duration and access control** in `~/docker/authelia/config/configuration.yml`:
+
+```yaml
+session:
+  expiration: 1y       # absolute session lifetime
+  inactivity: 90d      # idle timeout before logout
+  remember_me: 1y      # duration granted by keepMeLoggedIn
+
+access_control:
+  default_policy: deny
+  rules:
+    # Allow kiosk group to reach any subdomain with one-factor auth
+    - domain: '*.yourdomain.com'
+      subject: 'group:kiosk'
+      policy: one_factor
+    # Optional: bypass Authelia entirely for the kiosk's static IP
+    # - domain: '*.yourdomain.com'
+    #   networks: ['192.168.1.50/32']
+    #   policy: bypass
+```
+
+**Step 4 — Restart Authelia:**
+
+```bash
+docker compose restart authelia
+```
+
+##### How it works
+
+On every kiosk startup, Electron calls Authelia's `/api/firstfactor` endpoint with `keepMeLoggedIn: true` **before** any sites load. Authelia responds with a `Set-Cookie` header that Electron absorbs into its default session. All BrowserViews then load with that session cookie already present.
+
+Because Electron's session persists to disk across reboots (`/home/kiosk/.config/kiosk-app/`), the cookie also survives restarts — the API call on startup just refreshes or extends it.
+
+##### Authelia vs HTTP Basic Auth
+
+Both can be used at the same time — they serve different purposes:
+
+| Method | Where configured | When to use |
+|--------|-----------------|-------------|
+| **Authelia SSO** | `Addons → Authelia Auto-Login` (global) | Sites protected by an Authelia reverse proxy |
+| **HTTP Basic Auth** | Per-site username/password in tab config | Sites that show a browser popup asking for credentials |
+
+---
+
 ### Communication
 - **Easy Asterisk Intercom** - Voice communication and intercom system
   - Downloads latest version from Easy Asterisk repository
@@ -399,7 +485,7 @@ smb://WORKGROUP/COMPUTER/PrinterName
 
 # Menu structure:
 # 1. Core Settings - Sites, WiFi, schedules, passwords, full reinstall, complete uninstall
-# 2. Addons - Easy Asterisk Intercom, LMS, CUPS, VNC, VPNs
+# 2. Addons - Authelia Auto-Login, Easy Asterisk Intercom, LMS, CUPS, VNC, VPNs
 # 3. Advanced - Diagnostics, logs, Electron updates, virtual consoles, emergency hotspot
 # 4. Restart Kiosk Display
 ```

ubuntu-based-kiosk-v1.0.1.sh

@@ -10007,9 +10007,55 @@ process.stdout.write(Buffer.concat([iv,enc]).toString('base64'));
     sudo chown "$KIOSK_USER:$KIOSK_USER" "$config_file"
 
     echo
-    echo "✓ Authelia config saved."
-    echo "  To clear it later, remove autheliaURL / autheliaUsername /"
-    echo "  autheliaEncryptedPassword from $config_file"
+    echo "✓ Authelia config saved (password encrypted, NOT stored in plain text)."
+    echo
+    echo "════════════════════════════════════════════════════════════"
+    echo "       AUTHELIA SERVER-SIDE SETUP (Dockerized)"
+    echo "════════════════════════════════════════════════════════════"
+    echo
+    echo "1. Generate the argon2 password hash on your Docker host:"
+    echo
+    echo "   docker run --rm authelia/authelia:latest \\"
+    echo "     authelia crypto hash generate argon2 \\"
+    echo "     --password 'yourpassword'"
+    echo
+    echo "   Copy the \$argon2id\$... output — that is your hash."
+    echo
+    echo "2. Add a kiosk user to ~/docker/authelia/config/users.yml:"
+    echo
+    echo "   kiosk:"
+    echo "     displayname: \"Kiosk Display\""
+    echo "     password: '\$argon2id\$v=19\$m=65536,t=3,p=4\$<paste hash here>'"
+    echo "     email: kiosk@local.com"
+    echo "     groups:"
+    echo "       - kiosk"
+    echo
+    echo "3. Add to ~/docker/authelia/config/configuration.yml:"
+    echo
+    echo "   session:"
+    echo "     expiration: 1y"
+    echo "     inactivity: 90d"
+    echo "     remember_me: 1y"
+    echo
+    echo "   access_control:"
+    echo "     default_policy: deny"
+    echo "     rules:"
+    echo "       - domain: '*.yourdomain.com'"
+    echo "         subject: 'group:kiosk'"
+    echo "         policy: one_factor"
+    echo
+    echo "4. Restart Authelia on your Docker host:"
+    echo "   docker compose restart authelia"
+    echo
+    echo "────────────────────────────────────────────────────────────"
+    echo "  NOTE: HTTP Basic Auth (per-site username/password) still"
+    echo "  works alongside Authelia for sites that use browser-popup"
+    echo "  authentication rather than Authelia SSO."
+    echo "────────────────────────────────────────────────────────────"
+    echo
+    echo "  To clear Authelia config later, remove autheliaURL /"
+    echo "  autheliaUsername / autheliaEncryptedPassword from:"
+    echo "  $config_file"
     echo
     read -r -p "Restart kiosk display now? [y/N]: " restart
     if [[ "$restart" == "y" || "$restart" == "Y" ]]; then