Esa Kataja
cf2cb0ce0a
check / check (push) Successful in 46s
BREAKING CHANGE: PASSWORD is gone and AUTH and CERTRESOLVER are required. The server's compose.yaml and .env must be updated in the same deploy — the new image ignores PASSWORD, and the old one refuses to start without it. Authelia now sits in front of Traefik, so the app was asking for a second password at the same door. Two prompts, and the weaker of the two was the one holding a single shared secret with no sessions, no MFA and no revocation. Deleting it is the whole change: Authelia already does this properly, once, for every service on the host. Gone: auth(), challenge(), the whole of throttle.go and its tests, and golang.org/x/time with them. routes() returns the bare mux, /healthz is an ordinary route on it, and the smoke script drops sixty -u flags. Roughly 230 lines removed and nothing written to replace them. What holds the app up now, both asserted in compose.yaml: - The router names the Authelia middleware through AUTH. Traefik takes a router out of service when its middleware does not resolve, so a typo or an unset variable fails shut rather than serving the app open. - The container still publishes no ports, so the proxy is the only thing that can reach it. Publishing 8080 would now bypass authentication outright, not merely TLS — the comment there says so. certresolver replaces the bare tls=true, parameterised as CERTRESOLVER: the server had been carrying that label by hand since the first deploy. Naming a resolver implies tls=true, so it stays one label. TestAuth and TestHealthzSkipsAuth are replaced by one test asserting every route answers without credentials — a 401 from here would now mean auth had crept back in.
37 lines
1.3 KiB
Bash
37 lines
1.3 KiB
Bash
# Copy to .env and fill in. .env is gitignored — the real registry hostname
|
|
# must not end up in the repository.
|
|
|
|
# Image coordinates. REPO carries no tag.
|
|
REPO=registry.example.com/you/foodster
|
|
TAG=latest
|
|
|
|
# Hostname Traefik routes to. Kept here rather than in compose.yaml so no
|
|
# infrastructure detail is committed.
|
|
HOST=foodster.example.com
|
|
|
|
# The Traefik middleware that authenticates the app. The app itself has no
|
|
# login, so this is the whole of its access control — an unset or misspelt
|
|
# name takes the router out of service, which is the right way to fail.
|
|
AUTH=authelia@docker
|
|
|
|
# Traefik certificate resolver issuing the TLS certificate for HOST.
|
|
CERTRESOLVER=letsencrypt
|
|
|
|
# Anything other than prod is written into the browser tab title, so a dev
|
|
# instance open beside the real one can be told apart.
|
|
ENV=prod
|
|
|
|
# The database lives in ./data, bind-mounted into the container. These must
|
|
# match whoever owns that directory on the host, or the container cannot
|
|
# write to it. `id -u` and `id -g` will tell you.
|
|
#
|
|
# Named PUID/PGID because UID is read-only in bash and a plain UID here would
|
|
# be quietly replaced by the invoking shell's own.
|
|
PUID=1000
|
|
PGID=1000
|
|
|
|
# Used for every calendar-day calculation. Set it in development too: under
|
|
# UTC the date rolls over three hours late, which is exactly when dinner
|
|
# gets logged.
|
|
TZ=Europe/Helsinki
|