authelia: 4.37.5 -> 4.38.9 #299309

nicomem · 2024-03-26T21:32:13Z

Description of changes

Package Update

Updated manually using the update.sh script (but as said in #296502, the nixpkgs-update bot will probably not be able to automatically update it).

The 4.38.0 version has some big changes and some configuration depreciation, but simply by keeping my old configuration, everything seems to work fine (apart from the depreciation warnings).

Module Update

Removals

Removed options services.authelia.instances.<name>.settings.server.{host,port}, and added services.authelia.instances.<name>.settings.server.address.

If any of the former options are used, an assertion will be triggered.

Other changes

services.authelia.instances.<name>.secrets.jwtSecretFile now sets the AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE environment variable instead of AUTHELIA_JWT_SECRET_FILE
services.authelia.instances.<name>.secrets.oidcIssuerPrivateKeyFile now creates a new YAML config file to set identity_providers.oidc.key using templates

Things done

Add a 👍 reaction to pull requests you find important.

nicomem · 2024-03-28T18:49:57Z

Notify maintainers : @06kellyjac @RaitoBezarius @dit7ya

GGG-KILLER · 2024-03-30T04:57:42Z

Gave a try setting this up and the module will need reworking for people who want to take advantage of unix sockets

b12f · 2024-04-03T21:53:33Z

The service config will have to be updated. Using server.address , the new and recommended way to set the listening address, crashes Authelia. This is because the nix options explicitly declare server.host and server.port, and declaring both is invalid.

nicomem · 2024-04-04T21:17:19Z

Gave a try at updating the module (I do not have much experience on that), and have currently the following to still have the host+port settings working but transformed into the address (for backwards compatibility):

# In autheliaOpts, remove server.host & server.port and add server.address

imports =
    # settings.server.address should be set instead of host + port
    (map
      (name:
        let
          serverConfigPath = [ "services" "authelia" "instances" name "settings" "server" ];
          hostConfigPath = serverConfigPath ++ [ "host" ];
          portConfigPath = serverConfigPath ++ [ "port" ];
          addressConfigPath = serverConfigPath ++ [ "address" ];
        in
        lib.mkMergedOptionModule
          [
            hostConfigPath
            portConfigPath
          ]
          addressConfigPath
          (config:
            let
              host = lib.attrByPath hostConfigPath "" config;
              port = lib.attrByPath portConfigPath 9091 config;
            in
            "tcp://${host}:${port}/"
          )
      )
      (lib.attrNames cfg.instances));

However, this has two problems:

nix encounters an infinite recursion at the map (...) (lib.attrNames cfg.instances)

And if I test with a single instance name, I get the following error:

The option `services.authelia.instances' in module `<...>/security/authelia.nix' would be a parent of the following options, but its type `attribute set of (submodule)' does not support nested options.
      - option(s) with prefix `services.authelia.instances.main' in module `<...>/security/authelia.nix'

Which I assume is due to mkMergedOptionModule trying to define the old options but clashes with the usage of type = types.submodule { ... } which defines a specific attribute set

If someone has any idea on how to fix this or a better way of doing things, feel free to share your thoughts.

b12f · 2024-04-05T19:27:58Z

To make life simple on yourself, I would just deprecate the config option and show the user where to find the new one. You can use lib.mkRemovedModuleOption for this: https://github.com/NixOS/nixpkgs/blob/master/lib/modules.nix#L1091

nicomem · 2024-04-06T11:49:44Z

lib.mkRemovedModuleOption did not work for the same reasons as lib.mkMergedOptionModule, so I instead added an assertion checking if either option was set

nicomem · 2024-04-09T19:14:41Z

Updated again the module due to other options having problems with the new settings:

secrets.jwtSecretFile was mapped to the AUTHELIA_JWT_SECRET_FILE env variable
- It is now mapped to AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE (the newer setting)
secrets.oidcIssuerPrivateKeyFile has been removed
- Authelia now does not allow setting this using env variable, but by setting identity_providers.oidc.jwks.key (jwks being an array)
- Authelia advises using a file filter as such:
```
identity_providers:
  oidc:
    jwks:
      - key: {{ secret "/config/jwks/rsa.2048.pem" | mindent 10 "|" | msquote }}
```
- However, this way of doing does not seem to work with the Nix -> YAML conversion
- So the most secure way I found of setting this is by using services.authelia.<name>.settingsFiles, and using a file that is only readable by the authelia user (for example, in my conf, I use agenix)

Updated the manual & added an assertion in the same way as the previously removed options

nicomem · 2024-04-15T16:22:40Z

Added a commit to add myself as a maintainer.

Re-pinging the maintainers : @06kellyjac @dit7ya

In case the maintainers still do not respond, also adding @AndersonTorres who merged the init PR (#180469), and @marsam who merged the last authelia PR (#266455)

nicomem · 2024-04-15T16:26:01Z

Tried to see if we could avoid vendoring the package-lock.json file, as the Authelia repo has a pnpm-lock.yaml, but it seems like there is not yet the required tooling for that (see #231513)

nicomem · 2024-06-21T19:23:14Z

The solution seems to work well! I added this modification to the PR

nixos/doc/manual/release-notes/rl-2411.section.md

nixos/modules/services/security/authelia.nix

nicomem · 2024-06-22T18:18:46Z

Changes: depreciates -> deprecates

bendlas

Found more problems during testing: error occurred performing deprecation mapping for keys 'server.host', 'server.port', and 'server.path' to new key server.address: the new key already exists with value 'unix:///run/authelia/http' but the deprecated keys and the new key can't both be configured

According to the error message, the address option not just supersedes host and port, but also the path option.
I am using the the path configuration option. Right now, I'm not sure how to combine that into the address option, together with a unix socket path. This is not a problem to necessarily be solved as part of this PR - I will ask about it upstream - but it is an example for why it's preferrable to not put additional restrictions on what's accepted upstream. EDIT: found out, you can pass a ?path=... argument to the unix socket address.

~~Second Error: identity_providers: oidc: option jwks must not be configured at the same time as 'issuer_private_key' or 'issuer_certificate_chain'~~ EDIT: solved it. I could update my cert chain config. Will contribute this.

This one looks, like it should be fixed in my config. I'll check on how to do that.

nixos/modules/services/security/authelia.nix

bendlas · 2024-06-24T12:14:08Z

So, I managed to get everything running with this PR now, but I feel like the assertion doesn't cut it. To summarize:

Using address also precludes using path: This should be added to the assertion / warning logic
Doing an assertion precludes using the still valid (if deprecated) options: I recommend downgrading to a warning, or removing the check outright (since we won't be validating all the authelia options anyway)

nicomem · 2024-06-28T16:34:09Z

@bendlas I removed the assertion because as you said, we won't validate all the options.

Another thing that I thought is about the default value of the server.address setting:

Defining a default value in the module will break the config of those that are defining host, port or path
But most NixOS modules define a default value for the host+port/address ; and when the deprecated settings will be outright removed, the config will stop to work in any case

bendlas

Excellent!

bendlas · 2024-06-28T16:49:59Z

nixos/modules/services/security/authelia.nix

- default = "localhost";
- example = "0.0.0.0";
+ default = "tcp://:9091/";
+ example = "unix:///var/run/authelia.sock";


Suggested change

example = "unix:///var/run/authelia.sock";

example = "unix:///var/run/authelia.sock?path=authelia&umask=0117";

this is how I'm running it. I think that's useful as an example, because it shows how to do socket permissions, and in particular, how to translate the path setting.

I tried and did not manage to make it working.
Do you have a complete authelia config example available on github ?

Modification applied

I tried and did not manage to make it working. Do you have a complete authelia config example available on github ?

What are you having your issue with @hatch01?

Have you had a working configuration with authelia on a subpath before?

I do have a working configuration. It's part of a larger approach, that I'm looking at open-sourcing real soon (tm). If you'd be interested in having a look at that, possibly helping out, I'm happy to share privately. Feel free to DM.

I'll reply in this thread, in order to avoid spamming the main thread more ...

I can obviously write in the file using sudo -u authelia echo test > /var/log/authelia/authelia.log and read it in the same way.

I think the usual way to do this within a nixos module is systemd.tmpfiles.rules.

If that still doesn't work let's take this elsewhere and let's try to keep this PR focussed on the out-of-box config + stuff that was verified to work before, please.

bendlas · 2024-06-28T16:58:00Z

nixos/modules/services/security/authelia.nix

 type = types.str;
- default = "localhost";
- example = "0.0.0.0";
+ default = "tcp://:9091/";


Defining a default value in the module will break the config of those that are defining host, port or path

That's an excellent point.

Suggested change

default = "tcp://:9091/";

default = if not isNull cfg.settings.host or cfg.settings.port or cfg.settings.path or null then warn "Please replace services.authelia.setings.{host,port,path} with services.authelia.settings.address, before release 4.39" null else "tcp://:9091/";

WARNING untested and probably not working

Maybe something like this could smooth over the transition ...

I could not find a way to make this work:

The first problem is that there can be multiple authelia instances, some using the old settings, and others using the new one -> The default value being applied to all, there will be problems.

If we suppose that there is only one instance, after fixing the condition (the settings are accessed with cfg.instances.<name>.settings.server.{host,port,path}), this still generates the server.address setting in the YAML file, with the value null.

I tried to instead conditionnaly set the default value by doing this:

address = mkOption ({ type = types.str; example = "unix:///var/run/authelia.sock"; description = "The address to listen on."; } // lib.optionalAttrs ( let instance0 = builtins.elemAt (builtins.attrValues cfg.instances) 0; in if (instance0.settings.server.host != null) || (instance0.settings.server.port != null) || (instance0.settings.server.path != null) then warn "Please replace services.authelia.setings.{host,port,path} with services.authelia.settings.address, before release 4.39" false else true ) { default = "tcp://:9091/"; }); };

, but nix encounters an infinite recursion...

Hm, yeah, I think the infinite recursion comes from builtins.elemAt and/or builtins.attrValues being eager.

Also it seems like that snippet would set the default for each authelia instance, based on the setting of the (arbitrary) first one. I don't think, that's what we want to be doing.

Try taking a config argument in the function for autheliaOpts, see comment below.

hatch01 · 2024-07-07T14:18:52Z

Hi, are you using the log.file_path parameter.
Because in my installation, setting it to "/var/log/authelia/authelia.log" just make authelia crashing:

juil. 07 16:17:57 nixos authelia[18380]: time="2024-07-07T16:17:57+02:00" level=fatal msg="Cannot configure logger: open /var/log/authelia/authelia.log: read-only file system" stack="github.com/authelia/authelia/v4/internal/commands/root.go:69 (*CmdCtx).RootRunE\ngithub.com/spf13/cobra@v1.8.1/command.go:985                 (*Command).execute\ngithub.com/spf13/cobra@v1.8.1/command.go:1117                (*Command).ExecuteC\ngithub.com/spf13/cobra@v1.8.1/command.go:1041                (*Command).Execute\ngithub.com/authelia/authelia/v4/cmd/authelia/main.go:10      main\nruntime/internal/atomic/types.go:194                         (*Uint32).Load\nruntime/asm_amd64.s:1695                                     goexit"

I don't know if it is caused by the update or if it was broken before.

Ps:
I can obviously write in the file using sudo -u authelia echo test > /var/log/authelia/authelia.log and read it in the same way.

nicomem · 2024-07-07T15:27:15Z

@hatch01

Hi, are you using the log.file_path parameter.
Because in my installation, setting it to "/var/log/authelia/authelia.log" just make authelia crashing:

The authelia instance services.authelia.<name> declares in its systemd settings the state directory /var/lib/authelia-<name> (and not /var/lib/authelia). Changing the log.file_path to point to the correct directory should probably solve your problem.

hatch01 · 2024-07-07T18:51:00Z

@hatch01

Hi, are you using the log.file_path parameter.
Because in my installation, setting it to "/var/log/authelia/authelia.log" just make authelia crashing:

The authelia instance services.authelia.<name> declares in its systemd settings the state directory /var/lib/authelia-<name> (and not /var/lib/authelia). Changing the log.file_path to point to the correct directory should probably solve your problem.

Sorry I forgot to precise my config : https://github.com/hatch01/server-flake/blob/354a795dff56383e466ee414652a0e2441ccf2f3/apps/authelia.nix
I already set file_path which is the settings which causes the problem.

nicomem · 2024-07-07T22:18:41Z

Sorry if my explanation was not clear, but in your config, you are setting the log.file_path to a file in the /var/lib/authelia directory whereas the systemd service uses /var/lib/authelia-<name> (which in your case would be authelia-main).

Try setting log.file_path to /var/lib/authelia-${autheliaInstance}/authelia.log.

If for some reason you still want/need to use the /var/lib/authelia directory, you will probably need to change the service's systemd settings to allow read-write access to it.

bendlas · 2024-07-09T12:04:36Z

nixos/modules/services/security/authelia.nix

@@ -8,7 +8,6 @@ let
 cfg = config.services.authelia;

 format = pkgs.formats.yaml { };
- configFile = format.generate "config.yml" cfg.settings;

 autheliaOpts = with lib; { name, ... }: {


Suggested change

autheliaOpts = with lib; { name, ... }: {

autheliaOpts = with lib; { name, config, ... }: {

This config will be scoped to per-instance, because autheliaOpts is passed to types.submodule.

That way, it should be possible to do warnings per affected instance.

Using config here allows for accessing the instance configuration (thank you for the tip), however I still get the infinite recursion :/

I think that it is because I try to lazily define settings (i.e. the address option of the submodule settings) while trying to access the "final state" of settings (i.e. the host/port/path).

When I set the condition to something outside settings (e.g. config.enable), it works.
It is when I try to use something in settings that it breaks.

Also, when using eager functions (e.g. lib.optionalString), it compiles, but the key is still defined in the YAML configuration file (address: ''), and Authelia yells about defining both old and new keys.

Hm :/ I'd have to take a look to say more, but I guess last resort would be a top-level mapAttrsToList, to generate config.warnings manually ....

dimakow · 2024-07-13T11:13:52Z

Hi folks,

may I ask if you have any ETA in mind for this PR ?

Regards

- Remove settings.server.{host,port} options - Replaced by settings.server.address - If any of settings.server.{host,port,path} are specified in the configuration, a warning is displayed and these values will be used instead of settings.server.address - Change what secrets.oidcIssuerPrivateKeyFile maps to - Previously: AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE - Now: identity_providers.oidc.jwks[0].key - Not done directly in the NixOS settings config but as a separate YAML config file - Done that way because Go templates are not correctly handled by the YAML generator (NixOS#319716) - Change secrets.jwtSecretFile env variable mapping - Previously: AUTHELIA_JWT_SECRET_FILE - Now: AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE

nicomem · 2024-07-13T14:55:21Z

Finally found a way to make the default value of address work with host/port/path!!!

Instead of trying to modify whether we set the default value of address depending on whether the others have been set, we can instead take the instance.settings attribute set and remove the address value if the others have been set, before passing it to the YAML formatter.

This seems to work well:

Setting any of the old settings displays a warning, and address does not appear in the config file
- The warning is per-instance (i.e. only the instances that use the old settings will trigger a warning, one for each)
- The warning indicates which instance defines the old settings (e.g. Please replace services.authelia.instances.main.settings.{host,port,path} with services.authelia.instances.main.settings.address, before release 5.0.0)
Not specifying the old settings, and either setting or leaving as default address does not display any warning, and the value is set in the config file

This now means that this PR now does not bring any breaking change!

Thanks again @bendlas for all the comments and ideas to make this work

bendlas · 2024-07-17T14:42:26Z

Tested and works. Thanks @nicomem, for all your work and being receptive to feedback!

I would merge this right now, except it feels like this should be something done by package maintainers. @06kellyjac and @dit7ya don't seem to have participated so far. Let's wait for the weekend, if they get around, otherwise I'll merge.

may I ask if you have any ETA in mind for this PR ?

@dimakow Generally, there are no ETAs, as NixOS is volunteer work. A more productive way to ask something like this, is to pick the PR onto your branch, try it out, and provide feedback based on your experience, or simply ask if there is any way to help move this along.

06kellyjac

I've not seen it necessary to repeat valid suggestions already posted on quite an active PR.

I've not requested the commit-bit for nixpkgs so I can't merge.

LGTM I don't mind merging now or waiting for @dit7ya

bendlas · 2024-07-17T15:26:24Z

@06kellyjac my bad, sorry. Thanks for approving. I'll merge.

github-actions bot added 6.topic: nixos 8.has: documentation 8.has: changelog labels Mar 26, 2024

ofborg bot added 10.rebuild-darwin: 1-10 10.rebuild-darwin: 1 10.rebuild-linux: 1-10 labels Mar 26, 2024

nicomem force-pushed the authelia-4.38 branch from 7f39fba to 762ef38 Compare March 27, 2024 16:42

nicomem force-pushed the authelia-4.38 branch from 4d11a6e to 3fcf0a7 Compare April 2, 2024 15:38

nicomem changed the title ~~authelia: 4.37.5 -> 4.38.6~~ authelia: 4.37.5 -> 4.38.7 Apr 2, 2024

nicomem force-pushed the authelia-4.38 branch from 3fcf0a7 to 9460a32 Compare April 6, 2024 11:48

github-actions bot added the 8.has: module (update) label Apr 6, 2024

nicomem force-pushed the authelia-4.38 branch 3 times, most recently from a525c37 to 4753af3 Compare April 9, 2024 19:07

nicomem force-pushed the authelia-4.38 branch 3 times, most recently from 430aa2a to 1a815cf Compare April 15, 2024 16:01

nicomem changed the title ~~authelia: 4.37.5 -> 4.38.7~~ authelia: 4.37.5 -> 4.38.8 Apr 15, 2024

ofborg bot requested review from 06kellyjac and dit7ya April 15, 2024 16:44

ofborg bot added the 11.by: package-maintainer label Apr 15, 2024

nicomem force-pushed the authelia-4.38 branch from ebf1c56 to 4495763 Compare June 21, 2024 19:20

AndersonTorres approved these changes Jun 22, 2024

View reviewed changes

nixos/doc/manual/release-notes/rl-2411.section.md Outdated Show resolved Hide resolved

bendlas reviewed Jun 22, 2024

View reviewed changes

nixos/modules/services/security/authelia.nix Outdated Show resolved Hide resolved

nixos/modules/services/security/authelia.nix Show resolved Hide resolved

nicomem force-pushed the authelia-4.38 branch from 4495763 to 166bb2d Compare June 22, 2024 18:17

nicomem requested a review from bendlas June 22, 2024 18:18

bendlas requested changes Jun 24, 2024

View reviewed changes

nixos/modules/services/security/authelia.nix Outdated Show resolved Hide resolved

nicomem force-pushed the authelia-4.38 branch from 166bb2d to 2c27b8f Compare June 28, 2024 16:26

nicomem requested a review from bendlas June 28, 2024 16:34

bendlas approved these changes Jun 28, 2024

View reviewed changes

nicomem force-pushed the authelia-4.38 branch from 2c27b8f to 700e422 Compare July 7, 2024 15:57

bendlas reviewed Jul 9, 2024

View reviewed changes

winterqt mentioned this pull request Jul 10, 2024

Authelia: v4.37.5 -> v4.38.9 #326177

Closed

13 tasks

nicomem added 3 commits July 13, 2024 16:40

authelia: 4.37.5 -> 4.38.9

1e89e85

maintainers: Add nicomem

6bb00fd

nicomem force-pushed the authelia-4.38 branch from 700e422 to 6bb00fd Compare July 13, 2024 14:43

06kellyjac approved these changes Jul 17, 2024

View reviewed changes

bendlas merged commit 98d46bc into NixOS:master Jul 17, 2024
28 checks passed

	example = "unix:///var/run/authelia.sock";
	example = "unix:///var/run/authelia.sock?path=authelia&umask=0117";

	default = "tcp://:9091/";
	default = if not isNull cfg.settings.host or cfg.settings.port or cfg.settings.path or null then warn "Please replace services.authelia.setings.{host,port,path} with services.authelia.settings.address, before release 4.39" null else "tcp://:9091/";

	autheliaOpts = with lib; { name, ... }: {
	autheliaOpts = with lib; { name, config, ... }: {

authelia: 4.37.5 -> 4.38.9 #299309

authelia: 4.37.5 -> 4.38.9 #299309

Conversation

nicomem commented Mar 26, 2024 • edited Loading

Description of changes

Package Update

Module Update

Removals

Other changes

Things done

nicomem commented Mar 28, 2024

GGG-KILLER commented Mar 30, 2024

b12f commented Apr 3, 2024

nicomem commented Apr 4, 2024

b12f commented Apr 5, 2024

nicomem commented Apr 6, 2024

nicomem commented Apr 9, 2024 • edited Loading

nicomem commented Apr 15, 2024

nicomem commented Apr 15, 2024

nicomem commented Jun 21, 2024

nicomem commented Jun 22, 2024

bendlas left a comment • edited Loading

Choose a reason for hiding this comment

bendlas commented Jun 24, 2024 • edited Loading

nicomem commented Jun 28, 2024

bendlas left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hatch01 commented Jul 7, 2024

nicomem commented Jul 7, 2024

hatch01 commented Jul 7, 2024

nicomem commented Jul 7, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dimakow commented Jul 13, 2024

nicomem commented Jul 13, 2024

bendlas commented Jul 17, 2024

06kellyjac left a comment

Choose a reason for hiding this comment

bendlas commented Jul 17, 2024

nicomem commented Mar 26, 2024 •

edited

Loading

nicomem commented Apr 9, 2024 •

edited

Loading

bendlas left a comment •

edited

Loading

bendlas commented Jun 24, 2024 •

edited

Loading