root/ubuntu-post-install
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make the Authelia login portal's subdomain configurable, not hardcoded

Browse Source 
install_authelia() and add_authelia_domain() both hardcoded "auth." as
the login portal's subdomain prefix everywhere -- configuration.yml's
authelia_url, the Caddy portal block/domain, generated README/OIDC
text. No prompt ever offered anything else, despite this repo
otherwise treating "auth.<domain>" as just this one instance's own
choice, not a protocol requirement.

Both now prompt for the portal subdomain (default "auth", so existing
behavior is unchanged for anyone who doesn't care) and use the actual
chosen value throughout. Every function that operates on an EXISTING
domain (remove_authelia_domain, _authelia_add_oidc_client) now reads
the real portal domain back from that domain's own session.cookies
authelia_url entry instead of assuming "auth.<domain>" -- matching the
same read-back pattern _authelia_add_oidc_client already used for the
apex domain itself, and _authelia_provision_oidc_client already used
for the portal URL. _authelia_remove_caddy_portal_block now takes the
portal's full domain directly rather than reconstructing it, so
removing a domain whose portal used a custom prefix actually finds and
removes the right Caddy block.

Also fixed a real, separate small bug found while in here: the
primary portal's Caddy log path was hardcoded to a generic auth.log
(collides across instances/domains) instead of following every other
site block's own <domain>.log convention.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SpKTLpwAgZNooTacWeQLuc
This commit is contained in:
Claude
2026-08-22 17:04:37 +00:00
parent 5fbc1f2ec5
commit cd25903865
1 changed files with 82 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/authelia.sh
+82 -44
View File
@@ -287,9 +287,17 @@ install_authelia() {
echo " Authelia needs a few details to configure." echo " Authelia needs a few details to configure."
echo "" echo ""
local CADDY_NET="${SITE_CADDY_NET:-caddy_net}" local CADDY_NET="${SITE_CADDY_NET:-caddy_net}"
local AUTHELIA_DOMAIN AUTHELIA_ADMIN_USER AUTHELIA_ADMIN_DISPLAY AUTHELIA_ADMIN_EMAIL local AUTHELIA_DOMAIN AUTHELIA_PORTAL_SUBDOMAIN AUTHELIA_PORTAL_DOMAIN AUTHELIA_ADMIN_USER AUTHELIA_ADMIN_DISPLAY AUTHELIA_ADMIN_EMAIL
local AUTHELIA_SMTP_HOST AUTHELIA_SMTP_PORT AUTHELIA_SMTP_USER AUTHELIA_SMTP_PASS AUTHELIA_TZ local AUTHELIA_SMTP_HOST AUTHELIA_SMTP_PORT AUTHELIA_SMTP_USER AUTHELIA_SMTP_PASS AUTHELIA_TZ
prompt_text " Your domain (e.g., example.com):" "${SITE_DOMAIN:-example.com}" AUTHELIA_DOMAIN prompt_text " Your domain (e.g., example.com):" "${SITE_DOMAIN:-example.com}" AUTHELIA_DOMAIN
# Subdomain the login portal itself lives on — "auth" is just the
# default, not a fixed convention. Every later function that needs this
# domain's portal (add_authelia_domain for a DIFFERENT domain's own
# portal, remove_authelia_domain, OIDC client registration, etc.) reads
# it back from configuration.yml's session.cookies authelia_url instead
# of assuming "auth." — see those functions for why.
prompt_text " Subdomain for the login portal (e.g. 'auth' -> auth.${AUTHELIA_DOMAIN}):" "auth" AUTHELIA_PORTAL_SUBDOMAIN
AUTHELIA_PORTAL_DOMAIN="${AUTHELIA_PORTAL_SUBDOMAIN}.${AUTHELIA_DOMAIN}"
prompt_text " Admin username:" "admin" AUTHELIA_ADMIN_USER prompt_text " Admin username:" "admin" AUTHELIA_ADMIN_USER
prompt_text " Admin display name:" "Administrator" AUTHELIA_ADMIN_DISPLAY prompt_text " Admin display name:" "Administrator" AUTHELIA_ADMIN_DISPLAY
prompt_text " Admin email:" "admin@${AUTHELIA_DOMAIN}" AUTHELIA_ADMIN_EMAIL prompt_text " Admin email:" "admin@${AUTHELIA_DOMAIN}" AUTHELIA_ADMIN_EMAIL
@@ -411,7 +419,7 @@ session:
remember_me: 7d remember_me: 7d
cookies: cookies:
- domain: ${AUTHELIA_DOMAIN} - domain: ${AUTHELIA_DOMAIN}
authelia_url: https://auth.${AUTHELIA_DOMAIN} authelia_url: https://${AUTHELIA_PORTAL_DOMAIN}
default_redirection_url: https://${AUTHELIA_DOMAIN} default_redirection_url: https://${AUTHELIA_DOMAIN}
storage: storage:
@@ -482,19 +490,19 @@ SNIPPET_EOF
cat "$CADDY_FILE"; } > "$CADDY_FILE.tmp" && mv "$CADDY_FILE.tmp" "$CADDY_FILE" cat "$CADDY_FILE"; } > "$CADDY_FILE.tmp" && mv "$CADDY_FILE.tmp" "$CADDY_FILE"
echo " ✓ Authelia snippet added to Caddyfile" echo " ✓ Authelia snippet added to Caddyfile"
fi fi
if ! grep -q "auth.${AUTHELIA_DOMAIN}" "$CADDY_FILE"; then if ! grep -q "${AUTHELIA_PORTAL_DOMAIN}" "$CADDY_FILE"; then
cat >> "$CADDY_FILE" << CADDY_AUTH_BLOCK cat >> "$CADDY_FILE" << CADDY_AUTH_BLOCK
# ── Authelia login portal ────────────────────────────────────────────────────── # ── Authelia login portal ──────────────────────────────────────────────────────
auth.${AUTHELIA_DOMAIN} { ${AUTHELIA_PORTAL_DOMAIN} {
# header_up pins X-Forwarded-Host to whatever the client actually sent. # header_up pins X-Forwarded-Host to whatever the client actually sent.
# Without it, Caddy's reverse_proxy recomputes X-Forwarded-Host from its # Without it, Caddy's reverse_proxy recomputes X-Forwarded-Host from its
# own incoming request (always auth.${AUTHELIA_DOMAIN} itself) and # own incoming request (always ${AUTHELIA_PORTAL_DOMAIN} itself) and
# overwrites the value a forward_auth caller (e.g. a remote site's # overwrites the value a forward_auth caller (e.g. a remote site's
# "forward_auth https://auth.${AUTHELIA_DOMAIN}" block, see # "forward_auth https://${AUTHELIA_PORTAL_DOMAIN}" block, see
# services/asterisk.sh's droplet-mode Caddy block) set for its own domain. Confirmed # services/asterisk.sh's droplet-mode Caddy block) set for its own domain. Confirmed
# live: every forward-auth check evaluated as if it were for # live: every forward-auth check evaluated as if it were for
# auth.${AUTHELIA_DOMAIN} itself (which has policy: bypass in # ${AUTHELIA_PORTAL_DOMAIN} itself (which has policy: bypass in
# access_control.rules so its own login portal isn't gated behind # access_control.rules so its own login portal isn't gated behind
# itself), so every domain behind it silently passed through with no # itself), so every domain behind it silently passed through with no
# 2FA prompt regardless of that domain's own policy. # 2FA prompt regardless of that domain's own policy.
@@ -502,16 +510,16 @@ auth.${AUTHELIA_DOMAIN} {
header_up X-Forwarded-Host {http.request.header.X-Forwarded-Host} header_up X-Forwarded-Host {http.request.header.X-Forwarded-Host}
} }
log { log {
output file /var/log/caddy/auth.log output file /var/log/caddy/${AUTHELIA_PORTAL_DOMAIN}.log
} }
} }
CADDY_AUTH_BLOCK CADDY_AUTH_BLOCK
echo " ✓ Authelia portal block added for auth.${AUTHELIA_DOMAIN}" echo " ✓ Authelia portal block added for ${AUTHELIA_PORTAL_DOMAIN}"
fi fi
docker ps --format '{{.Names}}' | grep -q "^caddy$" && \ docker ps --format '{{.Names}}' | grep -q "^caddy$" && \
{ docker exec -w /etc/caddy caddy caddy reload 2>/dev/null && echo " ✓ Caddy reloaded" || echo " ⚠ Reload manually after checking the Caddyfile"; } { docker exec -w /etc/caddy caddy caddy reload 2>/dev/null && echo " ✓ Caddy reloaded" || echo " ⚠ Reload manually after checking the Caddyfile"; }
else else
echo " ℹ Caddy not installed yet — add the (authelia) snippet + auth.${AUTHELIA_DOMAIN} block to your Caddyfile later (see README)." echo " ℹ Caddy not installed yet — add the (authelia) snippet + ${AUTHELIA_PORTAL_DOMAIN} block to your Caddyfile later (see README)."
fi fi
# ── README for the service folder ──────────────────────────────────────── # ── README for the service folder ────────────────────────────────────────
@@ -519,7 +527,7 @@ CADDY_AUTH_BLOCK
# Authelia — SSO + 2FA portal # Authelia — SSO + 2FA portal
Single login (with TOTP two-factor) that protects any Caddy subdomain via Single login (with TOTP two-factor) that protects any Caddy subdomain via
forward-auth. Portal: **https://auth.${AUTHELIA_DOMAIN}** forward-auth. Portal: **https://${AUTHELIA_PORTAL_DOMAIN}**
## Layout ## Layout
\`\`\` \`\`\`
@@ -573,10 +581,10 @@ registered app gets its own Client ID/Secret under
secret is shown once at registration time and only the hash is kept. secret is shown once at registration time and only the hash is kept.
Endpoints (needed if an app asks for them instead of a discovery URL): Endpoints (needed if an app asks for them instead of a discovery URL):
- Discovery: \`https://auth.${AUTHELIA_DOMAIN}/.well-known/openid-configuration\` - Discovery: \`https://${AUTHELIA_PORTAL_DOMAIN}/.well-known/openid-configuration\`
- Authorization: \`https://auth.${AUTHELIA_DOMAIN}/api/oidc/authorization\` - Authorization: \`https://${AUTHELIA_PORTAL_DOMAIN}/api/oidc/authorization\`
- Token: \`https://auth.${AUTHELIA_DOMAIN}/api/oidc/token\` - Token: \`https://${AUTHELIA_PORTAL_DOMAIN}/api/oidc/token\`
- UserInfo: \`https://auth.${AUTHELIA_DOMAIN}/api/oidc/userinfo\` - UserInfo: \`https://${AUTHELIA_PORTAL_DOMAIN}/api/oidc/userinfo\`
## Manage ## Manage
\`\`\` \`\`\`
@@ -624,7 +632,7 @@ README_MD
fi fi
echo "" echo ""
echo " Auth portal: https://auth.${AUTHELIA_DOMAIN}" echo " Auth portal: https://${AUTHELIA_PORTAL_DOMAIN}"
echo " Admin login: ${AUTHELIA_ADMIN_USER} (use Forgot Password to set a real password)" echo " Admin login: ${AUTHELIA_ADMIN_USER} (use Forgot Password to set a real password)"
echo " README: $AUTHELIA_DIR/README.md" echo " README: $AUTHELIA_DIR/README.md"
echo "" echo ""
@@ -666,6 +674,10 @@ add_authelia_domain() {
return 0 return 0
fi fi
local NEW_PORTAL_SUBDOMAIN NEW_PORTAL_DOMAIN
prompt_text " Subdomain for this domain's own login portal (e.g. 'auth' -> auth.${NEW_DOMAIN}):" "auth" NEW_PORTAL_SUBDOMAIN
NEW_PORTAL_DOMAIN="${NEW_PORTAL_SUBDOMAIN}.${NEW_DOMAIN}"
# ── access_control.rules: insert right after "rules:" ──────────────────── # ── access_control.rules: insert right after "rules:" ────────────────────
awk -v domain="$NEW_DOMAIN" ' awk -v domain="$NEW_DOMAIN" '
{ print } { print }
@@ -677,11 +689,11 @@ add_authelia_domain() {
' "$CONFIG_FILE" > "$CONFIG_FILE.tmp" && mv "$CONFIG_FILE.tmp" "$CONFIG_FILE" ' "$CONFIG_FILE" > "$CONFIG_FILE.tmp" && mv "$CONFIG_FILE.tmp" "$CONFIG_FILE"
# ── session.cookies: insert right after "cookies:" ──────────────────────── # ── session.cookies: insert right after "cookies:" ────────────────────────
awk -v domain="$NEW_DOMAIN" ' awk -v domain="$NEW_DOMAIN" -v portal="$NEW_PORTAL_DOMAIN" '
{ print } { print }
/^ cookies:$/ && !done { /^ cookies:$/ && !done {
print " - domain: " domain print " - domain: " domain
print " authelia_url: https://auth." domain print " authelia_url: https://" portal
print " default_redirection_url: https://" domain print " default_redirection_url: https://" domain
done=1 done=1
} }
@@ -692,29 +704,29 @@ add_authelia_domain() {
# ── Caddy portal block for the new domain ───────────────────────────────── # ── Caddy portal block for the new domain ─────────────────────────────────
if [ -f "$CADDY_FILE" ]; then if [ -f "$CADDY_FILE" ]; then
if ! grep -q "^auth.${NEW_DOMAIN} {" "$CADDY_FILE"; then if ! grep -qx "${NEW_PORTAL_DOMAIN} {" "$CADDY_FILE"; then
cat >> "$CADDY_FILE" << CADDY_AUTH_BLOCK2 cat >> "$CADDY_FILE" << CADDY_AUTH_BLOCK2
# ── Authelia login portal (${NEW_DOMAIN}) ───────────────────────────────────── # ── Authelia login portal (${NEW_DOMAIN}) ─────────────────────────────────────
auth.${NEW_DOMAIN} { ${NEW_PORTAL_DOMAIN} {
# See auth.${AUTHELIA_DOMAIN:-<original domain>}'s block above for why # See this instance's other portal block(s) above for why header_up
# header_up X-Forwarded-Host is required here, not optional. # X-Forwarded-Host is required here, not optional.
reverse_proxy authelia:9091 { reverse_proxy authelia:9091 {
header_up X-Forwarded-Host {http.request.header.X-Forwarded-Host} header_up X-Forwarded-Host {http.request.header.X-Forwarded-Host}
} }
log { log {
output file /var/log/caddy/auth.${NEW_DOMAIN}.log output file /var/log/caddy/${NEW_PORTAL_DOMAIN}.log
} }
} }
CADDY_AUTH_BLOCK2 CADDY_AUTH_BLOCK2
echo " ✓ Authelia portal block added for auth.${NEW_DOMAIN}" echo " ✓ Authelia portal block added for ${NEW_PORTAL_DOMAIN}"
docker ps --format '{{.Names}}' | grep -q "^caddy$" && \ docker ps --format '{{.Names}}' | grep -q "^caddy$" && \
{ docker exec -w /etc/caddy caddy caddy reload 2>/dev/null && echo " ✓ Caddy reloaded" || echo " ⚠ Reload manually: docker exec caddy caddy reload --config /etc/caddy/Caddyfile"; } { docker exec -w /etc/caddy caddy caddy reload 2>/dev/null && echo " ✓ Caddy reloaded" || echo " ⚠ Reload manually: docker exec caddy caddy reload --config /etc/caddy/Caddyfile"; }
else else
echo " ✓ auth.${NEW_DOMAIN} portal block already exists in the Caddyfile" echo " ✓ ${NEW_PORTAL_DOMAIN} portal block already exists in the Caddyfile"
fi fi
else else
echo " ℹ Caddy not installed — add an auth.${NEW_DOMAIN} portal block manually later (see README)." echo " ℹ Caddy not installed — add a ${NEW_PORTAL_DOMAIN} portal block manually later (see README)."
fi fi
# ── Restart Authelia to pick up the new config ──────────────────────────── # ── Restart Authelia to pick up the new config ────────────────────────────
@@ -727,7 +739,7 @@ CADDY_AUTH_BLOCK2
fi fi
echo "" echo ""
echo " Auth portal for $NEW_DOMAIN: https://auth.${NEW_DOMAIN}" echo " Auth portal for $NEW_DOMAIN: https://${NEW_PORTAL_DOMAIN}"
echo " Protect a service under this domain the same way as any other:" echo " Protect a service under this domain the same way as any other:"
echo " myservice.${NEW_DOMAIN} {" echo " myservice.${NEW_DOMAIN} {"
echo " import authelia" echo " import authelia"
@@ -738,18 +750,21 @@ CADDY_AUTH_BLOCK2
echo "" echo ""
} }
# Removes the auth.<domain> Caddy portal block add_authelia_domain() writes — # Removes a login-portal Caddy block add_authelia_domain() writes — same
# same bounded-block technique used elsewhere in this repo for Caddy site # bounded-block technique used elsewhere in this repo for Caddy site blocks
# blocks (find the opening "<domain> {" line, walk forward to the matching # (find the opening "<portal-domain> {" line, walk forward to the matching
# unindented "}"), just keyed on "auth.<domain> {" instead of a service # unindented "}"). Takes the portal's own FULL domain, not the apex it
# domain or a reverse_proxy marker. # belongs to and an assumed "auth." prefix — the portal subdomain is
# user-chosen at the time it's added (see add_authelia_domain), so it can't
# be reconstructed from the apex alone. Callers read it back from that
# domain's own session.cookies authelia_url entry before removing it.
_authelia_remove_caddy_portal_block() { _authelia_remove_caddy_portal_block() {
local domain="$1" local portal_domain="$1"
local caddy_file="$DOCKER_DIR/caddy/Caddyfile" local caddy_file="$DOCKER_DIR/caddy/Caddyfile"
[ -f "$caddy_file" ] || return 0 [ -f "$caddy_file" ] || return 0
local domain_line end_line start_line local domain_line end_line start_line
domain_line="$(grep -nx "auth.${domain} {" "$caddy_file" | head -1 | cut -d: -f1)" domain_line="$(grep -nx "${portal_domain} {" "$caddy_file" | head -1 | cut -d: -f1)"
[ -z "$domain_line" ] && return 0 [ -z "$domain_line" ] && return 0
start_line="$domain_line" start_line="$domain_line"
@@ -759,13 +774,13 @@ _authelia_remove_caddy_portal_block() {
end_line="$(tail -n "+$domain_line" "$caddy_file" | grep -nx '}' | head -1 | cut -d: -f1)" end_line="$(tail -n "+$domain_line" "$caddy_file" | grep -nx '}' | head -1 | cut -d: -f1)"
if [ -z "$end_line" ]; then if [ -z "$end_line" ]; then
log_warning "Could not find the end of auth.${domain}'s Caddy block — leaving it as-is." log_warning "Could not find the end of ${portal_domain}'s Caddy block — leaving it as-is."
return 1 return 1
fi fi
end_line=$((domain_line + end_line - 1)) end_line=$((domain_line + end_line - 1))
sed -i "${start_line},${end_line}d" "$caddy_file" sed -i "${start_line},${end_line}d" "$caddy_file"
log_info "Removed the auth.${domain} Caddy portal block." log_info "Removed the ${portal_domain} Caddy portal block."
docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^caddy$" && \ docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^caddy$" && \
{ docker exec -w /etc/caddy caddy caddy reload 2>/dev/null && log_success "Caddy reloaded" \ { docker exec -w /etc/caddy caddy caddy reload 2>/dev/null && log_success "Caddy reloaded" \
|| log_warning "Reload manually: docker exec caddy caddy reload --config /etc/caddy/Caddyfile"; } || log_warning "Reload manually: docker exec caddy caddy reload --config /etc/caddy/Caddyfile"; }
@@ -814,9 +829,21 @@ remove_authelia_domain() {
return 0 return 0
fi fi
# Read the portal's own domain back from this apex's session.cookies
# entry — it's whatever subdomain was chosen when this domain was added
# (see add_authelia_domain), not necessarily "auth.<domain>", so it
# can't be assumed. Must happen before the removal below, which deletes
# this exact entry.
local RM_PORTAL_DOMAIN
RM_PORTAL_DOMAIN="$(awk -v domain="$RM_DOMAIN" '
$0 == " - domain: " domain { f=1; next }
f && /authelia_url:/ { print $2; exit }
' "$CONFIG_FILE" | sed -E 's#^https?://##')"
[ -z "$RM_PORTAL_DOMAIN" ] && RM_PORTAL_DOMAIN="auth.${RM_DOMAIN}"
echo "" echo ""
log_warning "This removes ${RM_DOMAIN}'s access rule, session-cookie scope, and its" log_warning "This removes ${RM_DOMAIN}'s access rule, session-cookie scope, and its"
log_warning "auth.${RM_DOMAIN} login portal from THIS Authelia instance." log_warning "${RM_PORTAL_DOMAIN} login portal from THIS Authelia instance."
log_warning "Any service still using 'import authelia' or forward_auth pointed at" log_warning "Any service still using 'import authelia' or forward_auth pointed at"
log_warning "${RM_DOMAIN} will start failing to authenticate — reconfigure or remove" log_warning "${RM_DOMAIN} will start failing to authenticate — reconfigure or remove"
log_warning "those first if they're still live." log_warning "those first if they're still live."
@@ -843,7 +870,7 @@ remove_authelia_domain() {
chown 1000:1000 "$CONFIG_FILE" 2>/dev/null || true chown 1000:1000 "$CONFIG_FILE" 2>/dev/null || true
log_success "Removed ${RM_DOMAIN} from $CONFIG_FILE" log_success "Removed ${RM_DOMAIN} from $CONFIG_FILE"
_authelia_remove_caddy_portal_block "$RM_DOMAIN" _authelia_remove_caddy_portal_block "$RM_PORTAL_DOMAIN"
local RESTART_AUTH="" local RESTART_AUTH=""
prompt_yn " Restart Authelia to apply? (y/n):" "y" RESTART_AUTH prompt_yn " Restart Authelia to apply? (y/n):" "y" RESTART_AUTH
@@ -1992,6 +2019,17 @@ _authelia_add_oidc_client() {
return 1 return 1
fi fi
# This domain's own portal — whatever subdomain was actually chosen at
# install time (see install_authelia's own AUTHELIA_PORTAL_SUBDOMAIN
# prompt), not necessarily "auth.<domain>". Read back the same way
# AUTHELIA_DOMAIN itself is, from this entry's own authelia_url.
local AUTHELIA_PORTAL_DOMAIN
AUTHELIA_PORTAL_DOMAIN="$(tr -d '\r' < "$CONFIG_FILE" | awk -v domain="$AUTHELIA_DOMAIN" '
$0 == " - domain: " domain { f=1; next }
f && /authelia_url:/ { print $2; exit }
' | sed -E 's#^https?://##')"
[ -z "$AUTHELIA_PORTAL_DOMAIN" ] && AUTHELIA_PORTAL_DOMAIN="auth.${AUTHELIA_DOMAIN}"
echo "" echo ""
echo " Register another app to log in via Authelia (OIDC/SSO)." echo " Register another app to log in via Authelia (OIDC/SSO)."
echo "" echo ""
@@ -2074,12 +2112,12 @@ _authelia_add_oidc_client() {
echo "" echo ""
echo " Client ID: ${CLIENT_ID}" echo " Client ID: ${CLIENT_ID}"
echo " Client Secret: ${CLIENT_SECRET_PLAIN}" echo " Client Secret: ${CLIENT_SECRET_PLAIN}"
echo " Discovery URL: https://auth.${AUTHELIA_DOMAIN}/.well-known/openid-configuration" echo " Discovery URL: https://${AUTHELIA_PORTAL_DOMAIN}/.well-known/openid-configuration"
echo "" echo ""
echo " If it asks for individual endpoints instead of a discovery URL:" echo " If it asks for individual endpoints instead of a discovery URL:"
echo " Authorization: https://auth.${AUTHELIA_DOMAIN}/api/oidc/authorization" echo " Authorization: https://${AUTHELIA_PORTAL_DOMAIN}/api/oidc/authorization"
echo " Token: https://auth.${AUTHELIA_DOMAIN}/api/oidc/token" echo " Token: https://${AUTHELIA_PORTAL_DOMAIN}/api/oidc/token"
echo " UserInfo: https://auth.${AUTHELIA_DOMAIN}/api/oidc/userinfo" echo " UserInfo: https://${AUTHELIA_PORTAL_DOMAIN}/api/oidc/userinfo"
echo " Scopes: openid profile email" echo " Scopes: openid profile email"
echo "" echo ""
case "$APP_CHOICE" in case "$APP_CHOICE" in
@@ -2092,7 +2130,7 @@ _authelia_add_oidc_client() {
2) 2)
echo " Add these to Vaultwarden's .env, then: cd \$VAULTWARDEN_DIR && docker compose up -d" echo " Add these to Vaultwarden's .env, then: cd \$VAULTWARDEN_DIR && docker compose up -d"
echo " SSO_ENABLED=true" echo " SSO_ENABLED=true"
echo " SSO_AUTHORITY=https://auth.${AUTHELIA_DOMAIN}" echo " SSO_AUTHORITY=https://${AUTHELIA_PORTAL_DOMAIN}"
echo " SSO_CLIENT_ID=${CLIENT_ID}" echo " SSO_CLIENT_ID=${CLIENT_ID}"
echo " SSO_CLIENT_SECRET=${CLIENT_SECRET_PLAIN}" echo " SSO_CLIENT_SECRET=${CLIENT_SECRET_PLAIN}"
echo " SSO_SCOPES=profile email" echo " SSO_SCOPES=profile email"
@@ -2103,7 +2141,7 @@ _authelia_add_oidc_client() {
;; ;;
3) 3)
echo " Immich → Administration → Settings → OAuth Authentication:" echo " Immich → Administration → Settings → OAuth Authentication:"
echo " Issuer URL: https://auth.${AUTHELIA_DOMAIN}" echo " Issuer URL: https://${AUTHELIA_PORTAL_DOMAIN}"
echo " (Immich appends /.well-known/openid-configuration itself — paste" echo " (Immich appends /.well-known/openid-configuration itself — paste"
echo " just the base URL above, not the full Discovery URL from earlier.)" echo " just the base URL above, not the full Discovery URL from earlier.)"
echo " Client ID: ${CLIENT_ID}" echo " Client ID: ${CLIENT_ID}"