feat(deploy): add install-authelia.sh script and align NextWks config with real Authelia paths
This commit is contained in:
parent
e3fbe0f9d9
commit
65f00a336a
3 changed files with 173 additions and 4 deletions
|
|
@ -15,8 +15,8 @@ database:
|
|||
|
||||
authelia:
|
||||
host: "http://127.0.0.1:9091"
|
||||
config_path: "/opt/authelia/config/configuration.yml"
|
||||
users_db_path: "/opt/authelia/data/users_database.yml"
|
||||
config_path: "/opt/authelia/configuration.yml"
|
||||
users_db_path: "/opt/authelia/users_database.yml"
|
||||
|
||||
smtp:
|
||||
host: ""
|
||||
|
|
|
|||
12
install.sh
12
install.sh
|
|
@ -68,6 +68,14 @@ if [ "$UNINSTALL" = true ]; then
|
|||
exit 0
|
||||
fi
|
||||
|
||||
# --- Check Authelia ---
|
||||
if [ ! -f "/opt/authelia/authelia" ]; then
|
||||
warn "Authelia is not installed at /opt/authelia/"
|
||||
warn "User management requires Authelia to function."
|
||||
warn "Install with: bash scripts/install-authelia.sh"
|
||||
echo ""
|
||||
fi
|
||||
|
||||
# --- Build ---
|
||||
if [ "$SKIP_BUILD" = false ] && [ "$CONFIG_ONLY" = false ]; then
|
||||
info "Building Next Workspace core..."
|
||||
|
|
@ -133,8 +141,8 @@ database:
|
|||
|
||||
authelia:
|
||||
host: "http://127.0.0.1:9091"
|
||||
config_path: "/opt/authelia/config/configuration.yml"
|
||||
users_db_path: "/opt/authelia/data/users_database.yml"
|
||||
config_path: "/opt/authelia/configuration.yml"
|
||||
users_db_path: "/opt/authelia/users_database.yml"
|
||||
|
||||
smtp:
|
||||
host: ""
|
||||
|
|
|
|||
161
scripts/install-authelia.sh
Executable file
161
scripts/install-authelia.sh
Executable file
|
|
@ -0,0 +1,161 @@
|
|||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# ============================================
|
||||
# install-authelia.sh
|
||||
# Installs and configures Authelia IDP for NextWks
|
||||
# ============================================
|
||||
|
||||
# ==========================================
|
||||
# 1. CONFIGURATION / VARIABLES
|
||||
# ==========================================
|
||||
DOMAIN="sechpoint.app"
|
||||
AUTH_SUBDOMAIN="auth.${DOMAIN}"
|
||||
SMTP_HOST="smtp.openxchange.eu"
|
||||
SMTP_PORT=587
|
||||
SMTP_USER="post@sechpoint.app"
|
||||
SMTP_PASS="0@pYAY14mB"
|
||||
|
||||
# Initial Admin Setup
|
||||
ADMIN_USER="admin"
|
||||
ADMIN_EMAIL="cl@${DOMAIN}"
|
||||
ADMIN_PASSWORD="ueM8tLARi5v3orIzvd56w6u6!" # This will be hashed automatically
|
||||
|
||||
# Bulk Onboarding List (Format: "username:DisplayName:email")
|
||||
USER_LIST=(
|
||||
"clohmar:Claus Lohmar:cl@${DOMAIN}"
|
||||
)
|
||||
|
||||
# Paths
|
||||
AUTHELIA_DIR="/opt/authelia"
|
||||
AUTHELIA_VERSION="v4.38.0"
|
||||
|
||||
# ==========================================
|
||||
# 2. INSTALLATION & PREPARATION
|
||||
# ==========================================
|
||||
echo "Installing prerequisites and downloading Authelia..."
|
||||
apt-get update && apt-get install -y wget curl tar openssl jq
|
||||
|
||||
mkdir -p "$AUTHELIA_DIR"
|
||||
wget -q "https://github.com/authelia/authelia/releases/download/${AUTHELIA_VERSION}/authelia-${AUTHELIA_VERSION}-linux-amd64.tar.gz" -O /tmp/authelia.tar.gz
|
||||
tar -xzf /tmp/authelia.tar.gz -C "$AUTHELIA_DIR"
|
||||
mv "$AUTHELIA_DIR/authelia-linux-amd64" "$AUTHELIA_DIR/authelia"
|
||||
chmod +x "$AUTHELIA_DIR/authelia"
|
||||
|
||||
# Generate Secrets
|
||||
JWT_SECRET=$(openssl rand -base64 32)
|
||||
SESSION_SECRET=$(openssl rand -base64 32)
|
||||
STORAGE_ENCRYPTION_KEY=$(openssl rand -base64 32)
|
||||
|
||||
# Generate Hash for the Initial Admin
|
||||
ADMIN_HASH=$("$AUTHELIA_DIR/authelia" crypto hash generate --password "$ADMIN_PASSWORD" | awk '{print $NF}')
|
||||
|
||||
# ==========================================
|
||||
# 3. GENERATE USER DATABASE (BULK ONBOARDING)
|
||||
# ==========================================
|
||||
echo "Generating user database..."
|
||||
cat <<EOF > "${AUTHELIA_DIR}/users_database.yml"
|
||||
users:
|
||||
${ADMIN_USER}:
|
||||
displayname: "System Administrator"
|
||||
password: "${ADMIN_HASH}"
|
||||
email: "${ADMIN_EMAIL}"
|
||||
groups: [admins]
|
||||
EOF
|
||||
|
||||
for entry in "${USER_LIST[@]}"; do
|
||||
IFS=":" read -r uname dname uemail <<< "$entry"
|
||||
cat <<EOF >> "${AUTHELIA_DIR}/users_database.yml"
|
||||
${uname}:
|
||||
displayname: "${dname}"
|
||||
password: "${ADMIN_HASH}" # Everyone starts with the same temp password
|
||||
email: "${uemail}"
|
||||
groups: [users]
|
||||
EOF
|
||||
done
|
||||
|
||||
# ==========================================
|
||||
# 4. GENERATE MAIN CONFIGURATION
|
||||
# ==========================================
|
||||
echo "Generating Authelia configuration..."
|
||||
cat <<EOF > "${AUTHELIA_DIR}/configuration.yml"
|
||||
theme: light
|
||||
jwt_secret: "${JWT_SECRET}"
|
||||
default_redirection_url: "https://${DOMAIN}"
|
||||
|
||||
server:
|
||||
host: 0.0.0.0
|
||||
port: 9091
|
||||
|
||||
authentication_backend:
|
||||
password_reset:
|
||||
disable: false
|
||||
file:
|
||||
path: "${AUTHELIA_DIR}/users_database.yml"
|
||||
watch: true
|
||||
|
||||
session:
|
||||
name: authelia_session
|
||||
secret: "${SESSION_SECRET}"
|
||||
domain: "${DOMAIN}"
|
||||
expiration: 1h
|
||||
inactivity: 5m
|
||||
|
||||
notifier:
|
||||
smtp:
|
||||
host: "${SMTP_HOST}"
|
||||
port: ${SMTP_PORT}
|
||||
username: "${SMTP_USER}"
|
||||
password: "${SMTP_PASS}"
|
||||
sender: "Authelia <${SMTP_USER}>"
|
||||
|
||||
storage:
|
||||
encryption_key: "${STORAGE_ENCRYPTION_KEY}"
|
||||
local:
|
||||
path: "${AUTHELIA_DIR}/db.sqlite3"
|
||||
|
||||
access_control:
|
||||
default_policy: deny
|
||||
rules:
|
||||
- domain: "${AUTH_SUBDOMAIN}"
|
||||
policy: bypass
|
||||
- domain: "*.${DOMAIN}"
|
||||
policy: two_factor
|
||||
|
||||
totp:
|
||||
issuer: authelia.com
|
||||
EOF
|
||||
|
||||
# ==========================================
|
||||
# 5. SYSTEMD & PERMISSIONS
|
||||
# ==========================================
|
||||
chown -R root:root "$AUTHELIA_DIR"
|
||||
chmod 600 "${AUTHELIA_DIR}/configuration.yml"
|
||||
chmod 600 "${AUTHELIA_DIR}/users_database.yml"
|
||||
|
||||
cat <<EOF > /etc/systemd/system/authelia.service
|
||||
[Unit]
|
||||
Description=Authelia Identity Provider
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
WorkingDirectory=${AUTHELIA_DIR}
|
||||
ExecStart=${AUTHELIA_DIR}/authelia --config ${AUTHELIA_DIR}/configuration.yml
|
||||
Restart=always
|
||||
User=root
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
|
||||
systemctl daemon-reload
|
||||
systemctl enable --now authelia
|
||||
|
||||
echo "-------------------------------------------------------"
|
||||
echo "Authelia Installation Complete!"
|
||||
echo "Authelia is running on port 9091"
|
||||
echo "Config: ${AUTHELIA_DIR}/configuration.yml"
|
||||
echo "Users: ${AUTHELIA_DIR}/users_database.yml"
|
||||
echo "Next step: Configure your Reverse Proxy for ${AUTH_SUBDOMAIN}"
|
||||
echo "-------------------------------------------------------"
|
||||
Loading…
Reference in a new issue