diff --git a/services/authelia.sh b/services/authelia.sh index f4bed01..9927a43 100644 --- a/services/authelia.sh +++ b/services/authelia.sh @@ -247,10 +247,11 @@ install_authelia() { echo " 13) Make sure admins always have access to every site (old and new —" echo " safe to re-run any time)" echo " 14) Rename an outside-access group (e.g. \"customer1\" -> \"acme-corp\")" + echo " 15) Show every group's sites and users (site groups + user groups overview)" echo " 0) Leave as-is / exit" echo "" local EXISTING_CHOICE="" - prompt_text " Choice [1-14, 0 to exit]:" "0" EXISTING_CHOICE + prompt_text " Choice [1-15, 0 to exit]:" "0" EXISTING_CHOICE case "$EXISTING_CHOICE" in 1) add_authelia_domain @@ -307,6 +308,10 @@ install_authelia() { _authelia_rename_group return 0 ;; + 15) + _authelia_report_groups + return 0 + ;; 0|*) echo " Keeping existing Authelia. (Edit config/users.yml then: cd $AUTHELIA_DIR && docker compose restart authelia)" return 0 @@ -1894,6 +1899,74 @@ _authelia_rename_group() { fi } +# For a given group, the domains it has an actual ALLOW rule for — i.e. its +# "site membership" — as opposed to the deny-elsewhere rule +# _authelia_scope_access also writes for the same group (same subject, but +# a wildcard domain and policy: deny, which isn't a site the group can +# reach and must be excluded). Rules are always domain-line, then +# optionally a subject-line, then a policy-line, in that fixed order with +# nothing else between them — this walks the file once matching that shape +# rather than assuming fixed line-count blocks, so it works whether it's a +# 2-line (no subject) or 3-line (subject present) rule. +_authelia_group_domains() { + local config_file="$1" group="$2" + awk -v grp="group:${group}" ' + /^ - domain:/ { d=$0; sub(/^ - domain: /,"",d); gsub(/"/,"",d); s=""; next } + /^ subject:/ { s=$0; next } + /^ policy:/ { if (s ~ grp && $0 !~ /deny/) print d; d=""; s=""; next } + ' "$config_file" +} + +# Read-only overview: every outside-access group, which sites it can reach, +# and which users are in it — the "site groups" and "user groups" views +# from the AD-style mental model, in one place, since a group's site +# membership is otherwise only visible by grepping configuration.yml's +# raw rules and its user membership only by grepping users.yml. +_authelia_report_groups() { + local users_file="$DOCKER_DIR/authelia/config/users.yml" + local config_file="$DOCKER_DIR/authelia/config/configuration.yml" + [ -f "$config_file" ] || { log_warning "No configuration.yml found — install Authelia first."; return 1; } + + local -a groups + mapfile -t groups < <(_authelia_list_scoped_groups "$users_file") + if [ "${#groups[@]}" -eq 0 ]; then + log_info "No outside-access groups exist yet — every site is native (open to any Authelia user, admins always included)." + return 0 + fi + + local -a all_users + mapfile -t all_users < <(_authelia_list_usernames "$users_file") + + echo "" + local g u start_end start end + for g in "${groups[@]}"; do + echo " ${g%-only}" + + echo " Sites:" + local -a domains + mapfile -t domains < <(_authelia_group_domains "$config_file" "$g") + if [ "${#domains[@]}" -eq 0 ]; then + echo " (none found — its access rule may be missing; try re-running site protection for it)" + else + printf ' - %s\n' "${domains[@]}" + fi + + echo " Users:" + local -a members=() + for u in "${all_users[@]}"; do + start_end="$(_authelia_user_line_range "$users_file" "$u")" + start="${start_end% *}"; end="${start_end#* }" + sed -n "${start},${end}p" "$users_file" | grep -qF " - ${g}" && members+=("$u") + done + if [ "${#members[@]}" -eq 0 ]; then + echo " (none)" + else + printf ' - %s\n' "${members[@]}" + fi + echo "" + done +} + # Menu-driven, idempotent bulk version of _authelia_ensure_admin_bypass — # backfills the admin-bypass rule for every apex domain currently on this # instance in one pass. install_authelia and add_authelia_domain bake the diff --git a/services/mealie.sh b/services/mealie.sh index 52ecd86..c4668cb 100644 --- a/services/mealie.sh +++ b/services/mealie.sh @@ -229,7 +229,10 @@ _mealie_offer_authelia_oidc() { local RECONFIGURE="" prompt_yn " Reconfigure it (registers a fresh Authelia client + secret)? (y/n):" "n" RECONFIGURE [[ "$RECONFIGURE" =~ ^[Yy]$ ]] || return 0 - sed -i '/^OIDC_/d' "$DIR/.env" + # ALLOW_PASSWORD_LOGIN isn't OIDC_-prefixed but is written by this + # same step (see below) — strip it too so reconfiguring doesn't + # leave a stale duplicate line if it's set again. + sed -i '/^OIDC_/d; /^ALLOW_PASSWORD_LOGIN=/d' "$DIR/.env" fi local BASE_URL @@ -248,6 +251,27 @@ _mealie_offer_authelia_oidc() { prompt_yn " Require two-factor for Mealie logins via Authelia too? (y/n):" "y" _2fa [[ "$_2fa" =~ ^[Yy]$ ]] || AUTH_POLICY="one_factor" + # Mealie's own docs document ALLOW_PASSWORD_LOGIN (hides the + # username+password fields entirely) and OIDC_AUTO_REDIRECT (skips the + # login page and jumps straight to the identity provider) as the real, + # supported way to make Authelia the only way in — confirmed against + # docs.mealie.io's OIDC and backend-config pages directly, not assumed. + # Off by default: this is a real access-control change (anyone who + # only has a local Mealie account, not an Authelia one, loses their + # login path), not just an additive convenience like the SSO button + # above. Recoverable any time by flipping these back and restarting — + # worth saying so, since a locked-out admin's first instinct otherwise + # is to worry the account itself is gone. + echo "" + local _disable_local="" + prompt_yn " Also disable Mealie's own username/password login, so Authelia is the only way in? (y/n):" "n" _disable_local + local _auto_redirect="" + if [[ "$_disable_local" =~ ^[Yy]$ ]]; then + log_warning "Anyone without an Authelia account (only a local Mealie one) will no longer be able to log in." + log_info "Reversible any time: set ALLOW_PASSWORD_LOGIN back to true in $DIR/.env and 'docker compose up -d'." + prompt_yn " Skip Mealie's login page entirely and jump straight to Authelia? (y/n):" "y" _auto_redirect + fi + if ! _authelia_provision_oidc_client "Mealie" "mealie" "$AUTH_POLICY" "y" "${BASE_URL}/login"; then log_warning "Couldn't register Mealie as an OIDC client in Authelia — skipping SSO setup." return 0 @@ -265,6 +289,15 @@ OIDC_CLIENT_SECRET=$OIDC_CLIENT_SECRET_PLAIN OIDC_CONFIGURATION_URL=$_discovery_url OIDC_PROVIDER_NAME=Authelia ENV + if [[ "$_disable_local" =~ ^[Yy]$ ]]; then + echo "ALLOW_PASSWORD_LOGIN=false" >> "$DIR/.env" + fi + if [[ "$_auto_redirect" =~ ^[Yy]$ ]]; then + { + echo "OIDC_AUTO_REDIRECT=true" + echo "OIDC_REMEMBER_ME=true" + } >> "$DIR/.env" + fi chown "$ACTUAL_USER:$ACTUAL_USER" "$DIR/.env" 2>/dev/null || true # Mealie's OIDC redirect URI generation trusts X-Forwarded-* only from @@ -279,8 +312,10 @@ ENV sed -i "/container_name: ${CONTAINER}\$/a\\ entrypoint: [\"uvicorn\", \"mealie.app:app\", \"--host\", \"0.0.0.0\", \"--port\", \"9000\", \"--forwarded-allow-ips=*\"]" "$DIR/docker-compose.yml" fi + local _success_msg="\"Sign in with Authelia\" added to Mealie — local login still works too." + [[ "$_disable_local" =~ ^[Yy]$ ]] && _success_msg="\"Sign in with Authelia\" added to Mealie — local username/password login is now disabled." (cd "$DIR" && docker compose up -d) \ - && log_success "\"Sign in with Authelia\" added to Mealie — local login still works too." \ + && log_success "$_success_msg" \ || log_warning "Restart failed — check: docker compose -f $DIR/docker-compose.yml logs" declare -F _authelia_scope_access >/dev/null 2>&1 && _authelia_scope_access "mealie" "${BASE_URL#*://}"