From d69806c24eb61336984c8b5cbfaf029ffa3ff701 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 17 Aug 2026 05:26:30 +0000 Subject: [PATCH] Fix SMTP claims and stale Authelia service list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Confirmed live (not from docs): Authelia's in-portal Settings -> Change Password also emails a one-time code to confirm, same as Forgot Password — it is not a no-SMTP path as earlier text here assumed. Reworded all three spots in authelia.sh that claimed otherwise to point at the admin-side "Edit an existing user" -> "Reset password" action instead, which never touches email. Also corrected CLAUDE.md's "No built-in auth — should be protected" list per an actual grep of services/*.sh: it was missing drum-rhythm-game, iopaint, paintplus, stirling-pdf, wolf, and the unconditionally-protected security-dashboard/asterisk, and wrongly included sky-cam (a non-Docker batch script with no web UI or Caddy integration at all, nothing for Authelia to protect). --- CLAUDE.md | 18 +++++++++++++++++- services/authelia.sh | 25 ++++++++++++++++--------- 2 files changed, 33 insertions(+), 10 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 4e2d9dd..ccebf03 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -372,7 +372,23 @@ collision.) `filebrowser`, `wg-easy`, `ntfy` (configurable) **No built-in auth — should be protected:** -`magicmirror`, `wolf-pair`, `js99er`, `sky-cam` +`magicmirror`, `wolf-pair`, `js99er`, `drum-rhythm-game`, `iopaint`, +`paintplus`, `stirling-pdf`, `wolf` (web UI). Each of these prompts +"Protect X with Authelia SSO? (y/n)" and passes `import authelia` as +`configure_caddy_for_service`'s extra block when accepted. + +`security-dashboard` is Authelia-protected unconditionally (not asked — +baked into its own Caddy block, since it exposes Asterisk/CrowdSec +data). `asterisk` offers the same protection for its web admin, with a +choice between a local `import authelia` and a remote `forward_auth` (see +the remote-Authelia note earlier in this file). + +`sky-cam` was previously listed here but has no Caddy integration or web +login of any kind — it's a non-Docker batch/cron script that renders +timelapse videos and posts them to Mattermost, so there's nothing on it +for Authelia to protect. Removed from this list; if it grows a web UI in +the future, add it back and wire up the same prompt other services here +use. For services without built-in auth, prompt the user before calling `configure_caddy_for_service` and pass `import authelia` as the extra block diff --git a/services/authelia.sh b/services/authelia.sh index e394bc6..9b1aeff 100644 --- a/services/authelia.sh +++ b/services/authelia.sh @@ -573,9 +573,13 @@ docker compose down # stop ## Users - Login with the **username** (not email). Admin user: \`${AUTHELIA_ADMIN_USER}\`. -- Tell users to click **Forgot Password** on first login to set their own - password (Authelia emails a reset link via SMTP), or use Authelia's own - Settings page once logged in — that works even without SMTP configured. +- Both self-service paths need working SMTP: **Forgot Password** on the login + screen emails a reset link, and even the in-portal **Settings → Change + Password** page (for an already-logged-in user) sends a one-time code to + their email to confirm the change — confirmed live, it is not a + no-email path despite Authelia describing it as an in-session action. + If SMTP isn't working yet, use the admin-side reset instead (next line), + which never touches email. - **Add a user:** re-run this installer (\`sudo ./setup.sh authelia\` or \`sudo bash authelia.sh\`) and choose **"Add a new user"** from the menu — it prompts for username/email/display name, generates the password hash, @@ -778,10 +782,10 @@ add_authelia_user() { echo "" echo " Add a new user to this Authelia instance." echo " They log in with their username (not email). A temporary password" - echo " is generated below — if SMTP isn't working, hand it to them directly" - echo " instead of relying on \"Forgot Password\"; they can set their own" - echo " password afterward from Authelia's own Settings page (no email" - echo " required for that), or via the reset email once SMTP works." + echo " is generated below — hand it to them directly. \"Forgot Password\"" + echo " and Authelia's own Settings → Change Password both require working" + echo " SMTP (both email a one-time code), so until that's fixed, use this" + echo " menu's \"Edit an existing user\" → \"Reset password\" for future resets." echo "" local NEW_USERNAME="" NEW_DISPLAY="" NEW_EMAIL="" NEW_ADMIN="" prompt_text " Username (lowercase, no spaces):" "" NEW_USERNAME @@ -843,8 +847,11 @@ ${GROUPS_BLOCK}" echo " New user: ${NEW_USERNAME}" echo " Temp password: ${TEMP_PASS}" echo " Give this to them directly (it's shown once, nothing stores it in" - echo " plaintext). They can log in with it as-is, then change it from" - echo " Authelia's own Settings page — no working SMTP required for that." + echo " plaintext). They can log in with it as-is and keep using it, or" + echo " change it themselves from Authelia's Settings page — but that page" + echo " emails a one-time code to confirm the change, so it needs working" + echo " SMTP. Without SMTP, use this menu's \"Edit an existing user\" →" + echo " \"Reset password\" instead — that one never touches email." echo "" }