BREAKING CHANGE: PASSWORD is gone and AUTH and CERTRESOLVER are required.
The server's compose.yaml and .env must be updated in the same deploy — the
new image ignores PASSWORD, and the old one refuses to start without it.
Authelia now sits in front of Traefik, so the app was asking for a second
password at the same door. Two prompts, and the weaker of the two was the one
holding a single shared secret with no sessions, no MFA and no revocation.
Deleting it is the whole change: Authelia already does this properly, once,
for every service on the host.
Gone: auth(), challenge(), the whole of throttle.go and its tests, and
golang.org/x/time with them. routes() returns the bare mux, /healthz is an
ordinary route on it, and the smoke script drops sixty -u flags. Roughly 230
lines removed and nothing written to replace them.
What holds the app up now, both asserted in compose.yaml:
- The router names the Authelia middleware through AUTH. Traefik takes a
router out of service when its middleware does not resolve, so a typo or an
unset variable fails shut rather than serving the app open.
- The container still publishes no ports, so the proxy is the only thing that
can reach it. Publishing 8080 would now bypass authentication outright, not
merely TLS — the comment there says so.
certresolver replaces the bare tls=true, parameterised as CERTRESOLVER: the
server had been carrying that label by hand since the first deploy. Naming a
resolver implies tls=true, so it stays one label.
TestAuth and TestHealthzSkipsAuth are replaced by one test asserting every
route answers without credentials — a 401 from here would now mean auth had
crept back in.
## Fixed
- Days older than the first entry ever logged can now be opened. Picking a
date from before anything was recorded landed on a dead end.
## Changed
- Releases are built by CI. Merging this pull request builds the image,
tags it `vYYYYMMDD-N` and `latest`, pushes both, and creates the git
tag. Nothing is built locally any more.
- `make image`, `push`, `release`, `seed`, `icons` and `vendor` are gone;
the Makefile is down from 151 lines to 71. The two rare commands are
written out in the README.
- Every push to `dev` now runs `make check` in CI.
## Deployment
No new or renamed environment variables, and `compose.yaml` is unchanged —
nothing to copy to the server this time. Pull the new image once CI reports
the build finished.
---------
Co-authored-by: Esa Kataja <[email protected]>
Reviewed-on: #4
Esa Kataja
KessinenandEsa Kataja