root/ubuntu-post-install
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #391 from outis1one/claude/frigate-authelia-openid-0l1htj

Browse Source 
Add group/site summary view; let Mealie fully hand off login to Authelia
This commit is contained in:
Outis
2026-08-24 11:30:17 -04:00
committed by GitHub
parent 5747eebf86 8808de0dbb
commit 2d2e6aae88
2 changed files with 111 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/authelia.sh
+74 -1
View File
@@ -247,10 +247,11 @@ install_authelia() {
echo " 13) Make sure admins always have access to every site (old and new —"
echo " safe to re-run any time)"
echo " 14) Rename an outside-access group (e.g. \"customer1\" -> \"acme-corp\")"
echo " 15) Show every group's sites and users (site groups + user groups overview)"
echo " 0) Leave as-is / exit"
echo ""
local EXISTING_CHOICE=""
prompt_text " Choice [1-14, 0 to exit]:" "0" EXISTING_CHOICE
prompt_text " Choice [1-15, 0 to exit]:" "0" EXISTING_CHOICE
case "$EXISTING_CHOICE" in
1)
add_authelia_domain
@@ -307,6 +308,10 @@ install_authelia() {
_authelia_rename_group
return 0
;;
15)
_authelia_report_groups
return 0
;;
0|*)
echo " Keeping existing Authelia. (Edit config/users.yml then: cd $AUTHELIA_DIR && docker compose restart authelia)"
return 0
@@ -1894,6 +1899,74 @@ _authelia_rename_group() {
fi
}
# For a given group, the domains it has an actual ALLOW rule for — i.e. its
# "site membership" — as opposed to the deny-elsewhere rule
# _authelia_scope_access also writes for the same group (same subject, but
# a wildcard domain and policy: deny, which isn't a site the group can
# reach and must be excluded). Rules are always domain-line, then
# optionally a subject-line, then a policy-line, in that fixed order with
# nothing else between them — this walks the file once matching that shape
# rather than assuming fixed line-count blocks, so it works whether it's a
# 2-line (no subject) or 3-line (subject present) rule.
_authelia_group_domains() {
local config_file="$1" group="$2"
awk -v grp="group:${group}" '
/^ - domain:/ { d=$0; sub(/^ - domain: /,"",d); gsub(/"/,"",d); s=""; next }
/^ subject:/ { s=$0; next }
/^ policy:/ { if (s ~ grp && $0 !~ /deny/) print d; d=""; s=""; next }
' "$config_file"
}
# Read-only overview: every outside-access group, which sites it can reach,
# and which users are in it — the "site groups" and "user groups" views
# from the AD-style mental model, in one place, since a group's site
# membership is otherwise only visible by grepping configuration.yml's
# raw rules and its user membership only by grepping users.yml.
_authelia_report_groups() {
local users_file="$DOCKER_DIR/authelia/config/users.yml"
local config_file="$DOCKER_DIR/authelia/config/configuration.yml"
[ -f "$config_file" ] || { log_warning "No configuration.yml found — install Authelia first."; return 1; }
local -a groups
mapfile -t groups < <(_authelia_list_scoped_groups "$users_file")
if [ "${#groups[@]}" -eq 0 ]; then
log_info "No outside-access groups exist yet — every site is native (open to any Authelia user, admins always included)."
return 0
fi
local -a all_users
mapfile -t all_users < <(_authelia_list_usernames "$users_file")
echo ""
local g u start_end start end
for g in "${groups[@]}"; do
echo " ${g%-only}"
echo " Sites:"
local -a domains
mapfile -t domains < <(_authelia_group_domains "$config_file" "$g")
if [ "${#domains[@]}" -eq 0 ]; then
echo " (none found — its access rule may be missing; try re-running site protection for it)"
else
printf ' - %s\n' "${domains[@]}"
fi
echo " Users:"
local -a members=()
for u in "${all_users[@]}"; do
start_end="$(_authelia_user_line_range "$users_file" "$u")"
start="${start_end% *}"; end="${start_end#* }"
sed -n "${start},${end}p" "$users_file" | grep -qF " - ${g}" && members+=("$u")
done
if [ "${#members[@]}" -eq 0 ]; then
echo " (none)"
else
printf ' - %s\n' "${members[@]}"
fi
echo ""
done
}
# Menu-driven, idempotent bulk version of _authelia_ensure_admin_bypass —
# backfills the admin-bypass rule for every apex domain currently on this
# instance in one pass. install_authelia and add_authelia_domain bake the
services/mealie.sh
+37 -2
View File
@@ -229,7 +229,10 @@ _mealie_offer_authelia_oidc() {
local RECONFIGURE=""
prompt_yn " Reconfigure it (registers a fresh Authelia client + secret)? (y/n):" "n" RECONFIGURE
[[ "$RECONFIGURE" =~ ^[Yy]$ ]] || return 0
sed -i '/^OIDC_/d' "$DIR/.env"
# ALLOW_PASSWORD_LOGIN isn't OIDC_-prefixed but is written by this
# same step (see below) — strip it too so reconfiguring doesn't
# leave a stale duplicate line if it's set again.
sed -i '/^OIDC_/d; /^ALLOW_PASSWORD_LOGIN=/d' "$DIR/.env"
fi
local BASE_URL
@@ -248,6 +251,27 @@ _mealie_offer_authelia_oidc() {
prompt_yn " Require two-factor for Mealie logins via Authelia too? (y/n):" "y" _2fa
[[ "$_2fa" =~ ^[Yy]$ ]] || AUTH_POLICY="one_factor"
# Mealie's own docs document ALLOW_PASSWORD_LOGIN (hides the
# username+password fields entirely) and OIDC_AUTO_REDIRECT (skips the
# login page and jumps straight to the identity provider) as the real,
# supported way to make Authelia the only way in — confirmed against
# docs.mealie.io's OIDC and backend-config pages directly, not assumed.
# Off by default: this is a real access-control change (anyone who
# only has a local Mealie account, not an Authelia one, loses their
# login path), not just an additive convenience like the SSO button
# above. Recoverable any time by flipping these back and restarting —
# worth saying so, since a locked-out admin's first instinct otherwise
# is to worry the account itself is gone.
echo ""
local _disable_local=""
prompt_yn " Also disable Mealie's own username/password login, so Authelia is the only way in? (y/n):" "n" _disable_local
local _auto_redirect=""
if [[ "$_disable_local" =~ ^[Yy]$ ]]; then
log_warning "Anyone without an Authelia account (only a local Mealie one) will no longer be able to log in."
log_info "Reversible any time: set ALLOW_PASSWORD_LOGIN back to true in $DIR/.env and 'docker compose up -d'."
prompt_yn " Skip Mealie's login page entirely and jump straight to Authelia? (y/n):" "y" _auto_redirect
fi
if ! _authelia_provision_oidc_client "Mealie" "mealie" "$AUTH_POLICY" "y" "${BASE_URL}/login"; then
log_warning "Couldn't register Mealie as an OIDC client in Authelia — skipping SSO setup."
return 0
@@ -265,6 +289,15 @@ OIDC_CLIENT_SECRET=$OIDC_CLIENT_SECRET_PLAIN
OIDC_CONFIGURATION_URL=$_discovery_url
OIDC_PROVIDER_NAME=Authelia
ENV
if [[ "$_disable_local" =~ ^[Yy]$ ]]; then
echo "ALLOW_PASSWORD_LOGIN=false" >> "$DIR/.env"
fi
if [[ "$_auto_redirect" =~ ^[Yy]$ ]]; then
{
echo "OIDC_AUTO_REDIRECT=true"
echo "OIDC_REMEMBER_ME=true"
} >> "$DIR/.env"
fi
chown "$ACTUAL_USER:$ACTUAL_USER" "$DIR/.env" 2>/dev/null || true
# Mealie's OIDC redirect URI generation trusts X-Forwarded-* only from
@@ -279,8 +312,10 @@ ENV
sed -i "/container_name: ${CONTAINER}\$/a\\ entrypoint: [\"uvicorn\", \"mealie.app:app\", \"--host\", \"0.0.0.0\", \"--port\", \"9000\", \"--forwarded-allow-ips=*\"]" "$DIR/docker-compose.yml"
fi
local _success_msg="\"Sign in with Authelia\" added to Mealie — local login still works too."
[[ "$_disable_local" =~ ^[Yy]$ ]] && _success_msg="\"Sign in with Authelia\" added to Mealie — local username/password login is now disabled."
(cd "$DIR" && docker compose up -d) \
&& log_success "\"Sign in with Authelia\" added to Mealie — local login still works too." \
&& log_success "$_success_msg" \
|| log_warning "Restart failed — check: docker compose -f $DIR/docker-compose.yml logs"
declare -F _authelia_scope_access >/dev/null 2>&1 && _authelia_scope_access "mealie" "${BASE_URL#*://}"