From e9286c83600cfc498aea8b789d454d8bfa970f91 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 25 Aug 2026 13:25:03 +0000 Subject: [PATCH] Fix wrong Beszel OAuth2 navigation instructions Printed "hub Settings -> Auth providers", which doesn't exist. The real location is PocketBase's own admin panel underneath the hub (/_/#/settings -> unhide collection edit controls -> edit the "users" collection -> Options tab -> OAuth2), confirmed against beszel.dev's OAuth guide directly. Fixed in both beszel.sh's own offer and authelia.sh's generic OIDC menu preset. --- services/authelia.sh | 12 +++++++++--- services/beszel.sh | 10 +++++++++- 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/services/authelia.sh b/services/authelia.sh index 566f058..c6aa117 100644 --- a/services/authelia.sh +++ b/services/authelia.sh @@ -3200,14 +3200,20 @@ _authelia_add_oidc_client() { echo "" ;; 6) - echo " Beszel is PocketBase-based — its OAuth2 provider is a PocketBase admin" - echo " setting, not an API this script can write (checked against beszel.dev's" - echo " own docs). In the hub: Settings -> Auth providers -> OpenID Connect:" + echo " Beszel is PocketBase-based — its OAuth2 provider lives in PocketBase's" + echo " own admin panel underneath the hub, not the hub's own Settings page and" + echo " not an API this script can write (checked against beszel.dev's own docs):" + echo " 1) https:///_/#/settings -> toggle OFF \"Hide" + echo " collection create and edit controls\"" + echo " 2) Collections -> edit the \"users\" collection" + echo " 3) Options tab -> enable OAuth2 -> Add provider, fill in:" echo " Client ID: ${CLIENT_ID}" echo " Client Secret: ${CLIENT_SECRET_PLAIN}" echo " Auth URL: https://${AUTHELIA_PORTAL_DOMAIN}/api/oidc/authorization" echo " Token URL: https://${AUTHELIA_PORTAL_DOMAIN}/api/oidc/token" echo " User Info URL: https://${AUTHELIA_PORTAL_DOMAIN}/api/oidc/userinfo" + echo " 4) Save, then toggle \"Hide collection create and edit controls\" back" + echo " ON — leaving it off is its own exposure once you're done" echo " Register your first Beszel account with a password BEFORE touching" echo " DISABLE_PASSWORD_AUTH/USER_CREATION in its .env — flipping those before" echo " a working login exists risks locking the hub's UI out entirely." diff --git a/services/beszel.sh b/services/beszel.sh index 29fe14b..50b487e 100644 --- a/services/beszel.sh +++ b/services/beszel.sh @@ -288,12 +288,20 @@ _beszel_offer_authelia_oidc() { fi echo "" - echo " In the hub: Settings -> Auth providers -> OpenID Connect:" + echo " This lives in PocketBase's own admin panel underneath the hub, not the" + echo " hub's own Settings page — checked against beszel.dev's OAuth guide" + echo " directly, exact steps:" + echo " 1) Go to https:///_/#/settings and toggle OFF" + echo " \"Hide collection create and edit controls\"" + echo " 2) Go to Collections, edit the \"users\" collection" + echo " 3) Options tab -> enable OAuth2 -> Add provider, fill in:" echo " Client ID: beszel" echo " Client Secret: $OIDC_CLIENT_SECRET_PLAIN" echo " Auth URL: ${OIDC_AUTHELIA_PORTAL_URL}/api/oidc/authorization" echo " Token URL: ${OIDC_AUTHELIA_PORTAL_URL}/api/oidc/token" echo " User Info URL: ${OIDC_AUTHELIA_PORTAL_URL}/api/oidc/userinfo" + echo " 4) Save, then toggle \"Hide collection create and edit controls\" back ON" + echo " at /_/#/settings — leaving it off is its own exposure once you're done" echo "" log_warning "The Client Secret above is shown once — save it now."