-
-
Notifications
You must be signed in to change notification settings - Fork 13.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
authelia: 4.37.5 -> 4.38.9 #299309
authelia: 4.37.5 -> 4.38.9 #299309
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change | ||||
---|---|---|---|---|---|---|
|
@@ -8,7 +8,6 @@ let | |||||
cfg = config.services.authelia; | ||||||
|
||||||
format = pkgs.formats.yaml { }; | ||||||
configFile = format.generate "config.yml" cfg.settings; | ||||||
|
||||||
autheliaOpts = with lib; { name, ... }: { | ||||||
options = { | ||||||
|
@@ -156,18 +155,12 @@ let | |||||
}; | ||||||
|
||||||
server = { | ||||||
host = mkOption { | ||||||
bendlas marked this conversation as resolved.
Show resolved
Hide resolved
|
||||||
address = mkOption { | ||||||
type = types.str; | ||||||
default = "localhost"; | ||||||
example = "0.0.0.0"; | ||||||
default = "tcp://:9091/"; | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
That's an excellent point.
Suggested change
WARNING untested and probably not working Maybe something like this could smooth over the transition ... There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I could not find a way to make this work: The first problem is that there can be multiple authelia instances, some using the old settings, and others using the new one -> The default value being applied to all, there will be problems. If we suppose that there is only one instance, after fixing the condition (the settings are accessed with I tried to instead conditionnaly set the address = mkOption ({
type = types.str;
example = "unix:///var/run/authelia.sock";
description = "The address to listen on.";
} // lib.optionalAttrs
(
let
instance0 = builtins.elemAt (builtins.attrValues cfg.instances) 0;
in
if (instance0.settings.server.host != null) ||
(instance0.settings.server.port != null) ||
(instance0.settings.server.path != null) then
warn "Please replace services.authelia.setings.{host,port,path} with services.authelia.settings.address, before release 4.39" false
else true
)
{
default = "tcp://:9091/";
});
}; , but nix encounters an infinite recursion... There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Hm, yeah, I think the infinite recursion comes from Also it seems like that snippet would set the default for each authelia instance, based on the setting of the (arbitrary) first one. I don't think, that's what we want to be doing. Try taking a |
||||||
example = "unix:///var/run/authelia.sock?path=authelia&umask=0117"; | ||||||
description = "The address to listen on."; | ||||||
}; | ||||||
|
||||||
port = mkOption { | ||||||
type = types.port; | ||||||
default = 9091; | ||||||
description = "The port to listen on."; | ||||||
}; | ||||||
}; | ||||||
|
||||||
log = { | ||||||
|
@@ -233,6 +226,23 @@ let | |||||
}; | ||||||
}; | ||||||
}; | ||||||
|
||||||
writeOidcJwksConfigFile = oidcIssuerPrivateKeyFile: pkgs.writeText "oidc-jwks.yaml" '' | ||||||
identity_providers: | ||||||
oidc: | ||||||
jwks: | ||||||
- key: {{ secret "${oidcIssuerPrivateKeyFile}" | mindent 10 "|" | msquote }} | ||||||
''; | ||||||
|
||||||
# Remove an attribute in a nested set | ||||||
# https://discourse.nixos.org/t/modify-an-attrset-in-nix/29919/5 | ||||||
removeAttrByPath = set: pathList: | ||||||
lib.updateManyAttrsByPath [{ | ||||||
path = lib.init pathList; | ||||||
update = old: | ||||||
lib.filterAttrs (n: v: n != (lib.last pathList)) old; | ||||||
}] | ||||||
set; | ||||||
in | ||||||
{ | ||||||
options.services.authelia.instances = with lib; mkOption { | ||||||
|
@@ -281,20 +291,30 @@ in | |||||
let | ||||||
mkInstanceServiceConfig = instance: | ||||||
let | ||||||
cleanedSettings = | ||||||
if (instance.settings.server?host || instance.settings.server?port || instance.settings.server?path) then | ||||||
# Old settings are used: display a warning and remove the default value of server.address | ||||||
# as authelia does not allow both old and new settings to be set | ||||||
lib.warn "Please replace services.authelia.instances.${instance.name}.settings.{host,port,path} with services.authelia.instances.${instance.name}.settings.address, before release 5.0.0" | ||||||
(removeAttrByPath instance.settings [ "server" "address" ]) | ||||||
else | ||||||
instance.settings; | ||||||
|
||||||
execCommand = "${instance.package}/bin/authelia"; | ||||||
configFile = format.generate "config.yml" instance.settings; | ||||||
configArg = "--config ${builtins.concatStringsSep "," (lib.concatLists [[configFile] instance.settingsFiles])}"; | ||||||
configFile = format.generate "config.yml" cleanedSettings; | ||||||
oidcJwksConfigFile = lib.optional (instance.secrets.oidcIssuerPrivateKeyFile != null) (writeOidcJwksConfigFile instance.secrets.oidcIssuerPrivateKeyFile); | ||||||
configArg = "--config ${builtins.concatStringsSep "," (lib.concatLists [[configFile] instance.settingsFiles oidcJwksConfigFile])}"; | ||||||
in | ||||||
{ | ||||||
description = "Authelia authentication and authorization server"; | ||||||
wantedBy = [ "multi-user.target" ]; | ||||||
after = [ "network.target" ]; | ||||||
environment = | ||||||
(lib.filterAttrs (_: v: v != null) { | ||||||
AUTHELIA_JWT_SECRET_FILE = instance.secrets.jwtSecretFile; | ||||||
X_AUTHELIA_CONFIG_FILTERS = lib.mkIf (oidcJwksConfigFile != [ ]) "template"; | ||||||
AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE = instance.secrets.jwtSecretFile; | ||||||
AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE = instance.secrets.storageEncryptionKeyFile; | ||||||
AUTHELIA_SESSION_SECRET_FILE = instance.secrets.sessionSecretFile; | ||||||
AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE = instance.secrets.oidcIssuerPrivateKeyFile; | ||||||
AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE = instance.secrets.oidcHmacSecretFile; | ||||||
}) | ||||||
// instance.environmentVariables; | ||||||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This
config
will be scoped to per-instance, becauseautheliaOpts
is passed totypes.submodule
.That way, it should be possible to do warnings per affected instance.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Using
config
here allows for accessing the instance configuration (thank you for the tip), however I still get the infinite recursion :/I think that it is because I try to lazily define
settings
(i.e. theaddress
option of the submodulesettings
) while trying to access the "final state" ofsettings
(i.e. thehost
/port
/path
).When I set the condition to something outside
settings
(e.g.config.enable
), it works.It is when I try to use something in
settings
that it breaks.Also, when using eager functions (e.g.
lib.optionalString
), it compiles, but the key is still defined in the YAML configuration file (address: ''
), and Authelia yells about defining both old and new keys.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hm :/ I'd have to take a look to say more, but I guess last resort would be a top-level
mapAttrsToList
, to generateconfig.warnings
manually ....