release: authentication moves to Authelia #5

2026-09-06T10:38:22Z

Kessinen commented

2026-09-06 10:38:22 +00:00

Authelia now runs in front of Traefik, so the app was asking for a second
password at the same door. This removes its own authentication entirely
rather than layering the two.

Breaking — the server needs both files in this deploy

compose.yaml and .env are not pulled from this repository. The new image
ignores PASSWORD, and the old image refuses to start without it, so the
image and the compose file have to move together or the container dies at
startup.

Variable	Change
`PASSWORD`	removed — the app no longer reads it
`AUTH`	new, required — the Traefik middleware that authenticates the app, e.g. `authelia@docker`
`CERTRESOLVER`	new, required — the resolver issuing the certificate for `HOST`

The tls=true label is replaced by tls.certresolver=${CERTRESOLVER}.
Naming a resolver implies TLS, so it stays one label rather than two — and
the resolver had been carried by hand on the server since the first deploy.

What was removed

auth() and challenge() — HTTP Basic over a single shared password
throttle.go and its tests — the per-IP guess limiter and the
X-Forwarded-For handling that fed it
golang.org/x/time, which existed only for that limiter
Sixty -u flags from the smoke script

routes() returns the bare mux and /healthz is an ordinary route on it.
159 insertions against 446 deletions; nothing was written to replace what
went.

What holds the app up now

Both invariants live in compose.yaml, next to comments saying why:

The router names the Authelia middleware through AUTH. Traefik takes
a router out of service when its middleware does not resolve, so an unset
or misspelt value fails shut rather than serving the app open.
The container publishes no ports. It is reachable only over the shared
proxy network. Publishing 8080 would now bypass authentication outright,
not merely TLS.

/healthz returns the version and nothing else, so it is safe to exempt in
Authelia if a monitor needs to reach it.

Why this is stronger, not weaker

The layer being deleted was one shared secret with no sessions, no second
factor and no way to revoke access for one person. Authelia does all three,
configured once for every service on the host instead of reimplemented per
app. The weaker of the two prompts was the one being kept.

Tests

TestAuth and TestHealthzSkipsAuth are replaced by a single test asserting
every route answers without credentials — a 401 from the app would now mean
authentication had crept back in. make check green; CI green on dev.

Note on the commit list

Nine of the ten commits below are already in main via #4, squash-merged
under a different SHA. They contribute nothing to the diff, which is the
auth removal alone.

Authelia now runs in front of Traefik, so the app was asking for a second password at the same door. This removes its own authentication entirely rather than layering the two. ## Breaking — the server needs both files in this deploy `compose.yaml` and `.env` are not pulled from this repository. The new image ignores `PASSWORD`, and the old image refuses to start without it, so the image and the compose file have to move together or the container dies at startup. | Variable | Change | |---|---| | `PASSWORD` | **removed** — the app no longer reads it | | `AUTH` | **new, required** — the Traefik middleware that authenticates the app, e.g. `authelia@docker` | | `CERTRESOLVER` | **new, required** — the resolver issuing the certificate for `HOST` | The `tls=true` label is replaced by `tls.certresolver=${CERTRESOLVER}`. Naming a resolver implies TLS, so it stays one label rather than two — and the resolver had been carried by hand on the server since the first deploy. ## What was removed - `auth()` and `challenge()` — HTTP Basic over a single shared password - `throttle.go` and its tests — the per-IP guess limiter and the `X-Forwarded-For` handling that fed it - `golang.org/x/time`, which existed only for that limiter - Sixty `-u` flags from the smoke script `routes()` returns the bare mux and `/healthz` is an ordinary route on it. 159 insertions against 446 deletions; nothing was written to replace what went. ## What holds the app up now Both invariants live in `compose.yaml`, next to comments saying why: - **The router names the Authelia middleware through `AUTH`.** Traefik takes a router out of service when its middleware does not resolve, so an unset or misspelt value fails shut rather than serving the app open. - **The container publishes no ports.** It is reachable only over the shared proxy network. Publishing `8080` would now bypass authentication outright, not merely TLS. `/healthz` returns the version and nothing else, so it is safe to exempt in Authelia if a monitor needs to reach it. ## Why this is stronger, not weaker The layer being deleted was one shared secret with no sessions, no second factor and no way to revoke access for one person. Authelia does all three, configured once for every service on the host instead of reimplemented per app. The weaker of the two prompts was the one being kept. ## Tests `TestAuth` and `TestHealthzSkipsAuth` are replaced by a single test asserting every route answers without credentials — a 401 from the app would now mean authentication had crept back in. `make check` green; CI green on `dev`. ## Note on the commit list Nine of the ten commits below are already in `main` via #4, squash-merged under a different SHA. They contribute nothing to the diff, which is the auth removal alone.

Kessinen added 1 commit 2026-09-06 10:39:46 +00:00

feat!: drop the built-in auth in favour of Authelia

check / check (push) Successful in 46s

Details

cf2cb0ce0a

BREAKING CHANGE: PASSWORD is gone and AUTH and CERTRESOLVER are required.
The server's compose.yaml and .env must be updated in the same deploy — the
new image ignores PASSWORD, and the old one refuses to start without it.

Authelia now sits in front of Traefik, so the app was asking for a second
password at the same door. Two prompts, and the weaker of the two was the one
holding a single shared secret with no sessions, no MFA and no revocation.
Deleting it is the whole change: Authelia already does this properly, once,
for every service on the host.

Gone: auth(), challenge(), the whole of throttle.go and its tests, and
golang.org/x/time with them. routes() returns the bare mux, /healthz is an
ordinary route on it, and the smoke script drops sixty -u flags. Roughly 230
lines removed and nothing written to replace them.

What holds the app up now, both asserted in compose.yaml:

- The router names the Authelia middleware through AUTH. Traefik takes a
  router out of service when its middleware does not resolve, so a typo or an
  unset variable fails shut rather than serving the app open.
- The container still publishes no ports, so the proxy is the only thing that
  can reach it. Publishing 8080 would now bypass authentication outright, not
  merely TLS — the comment there says so.

certresolver replaces the bare tls=true, parameterised as CERTRESOLVER: the
server had been carrying that label by hand since the first deploy. Naming a
resolver implies tls=true, so it stays one label.

TestAuth and TestHealthzSkipsAuth are replaced by one test asserting every
route answers without credentials — a 401 from here would now mean auth had
crept back in.

Kessinen force-pushed dev from 2974ffc621 to cf2cb0ce0a

2026-09-06 10:39:46 +00:00

Compare

Kessinen merged commit 71e413fbbb into main

2026-09-06 10:40:54 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Kessinen/foodster#5