feat(installer): auto-install Authelia — one script deploys everything
This commit is contained in:
parent
9a4055df1b
commit
e978e08424
1 changed files with 66 additions and 34 deletions
100
install.sh
100
install.sh
|
|
@ -291,24 +291,40 @@ $SUDO systemctl daemon-reload
|
|||
success "Service: $SERVICE_FILE"
|
||||
|
||||
# ============================================================
|
||||
# AUTHELIA CONFIG
|
||||
# ============================================================
|
||||
if [ -f "${AUTHELIA_DIR}/authelia" ]; then
|
||||
header "── Authelia Config ──"
|
||||
JWT_SECRET=$(openssl rand -base64 32)
|
||||
SESSION_SECRET=$(openssl rand -base64 32)
|
||||
STORAGE_KEY=$(openssl rand -base64 32)
|
||||
OIDC_HMAC=$(openssl rand -base64 32)
|
||||
# AUTHELIA — Download, configure, and start
|
||||
# ============================================================
|
||||
header "── Authelia ──"
|
||||
AUTHELIA_VERSION="4.38.0"
|
||||
|
||||
# Generate RSA key for OIDC signing
|
||||
openssl genrsa -out /tmp/nw-oidc.key 2048 2>/dev/null
|
||||
OIDC_KEY=$(cat /tmp/nw-oidc.key)
|
||||
rm -f /tmp/nw-oidc.key
|
||||
if [ ! -f "${AUTHELIA_DIR}/authelia" ]; then
|
||||
info "Downloading Authelia v${AUTHELIA_VERSION}..."
|
||||
$SUDO apt-get update -qq && $SUDO apt-get install -y -qq wget tar openssl jq 2>/dev/null
|
||||
$SUDO mkdir -p "$AUTHELIA_DIR"
|
||||
wget -q "https://github.com/authelia/authelia/releases/download/v${AUTHELIA_VERSION}/authelia-v${AUTHELIA_VERSION}-linux-amd64.tar.gz" -O /tmp/authelia.tar.gz
|
||||
$SUDO tar -xzf /tmp/authelia.tar.gz -C "$AUTHELIA_DIR"
|
||||
$SUDO mv "$AUTHELIA_DIR/authelia-linux-amd64" "$AUTHELIA_DIR/authelia" 2>/dev/null || true
|
||||
$SUDO chmod +x "$AUTHELIA_DIR/authelia"
|
||||
rm -f /tmp/authelia.tar.gz
|
||||
success "Authelia downloaded"
|
||||
fi
|
||||
|
||||
# Hash current admin password (if users exist) or generate one
|
||||
ADMIN_HASH=$("${AUTHELIA_DIR}/authelia" crypto hash generate --password "$(openssl rand -base64 12)" 2>/dev/null | awk '{print $NF}' || echo "\$argon2id\$v=19\$m=65536,t=3,p=4\$placeholder\$placeholder")
|
||||
# Generate Authelia secrets and config
|
||||
JWT_SECRET=$(openssl rand -base64 32)
|
||||
SESSION_SECRET=$(openssl rand -base64 32)
|
||||
STORAGE_KEY=$(openssl rand -base64 32)
|
||||
OIDC_HMAC=$(openssl rand -base64 32)
|
||||
|
||||
$SUDO tee "$AUTHELIA_CONFIG" > /dev/null << AUTHEOF
|
||||
# Generate RSA key for OIDC
|
||||
openssl genrsa -out /tmp/nw-oidc.key 2048 2>/dev/null
|
||||
OIDC_KEY=$(cat /tmp/nw-oidc.key)
|
||||
rm -f /tmp/nw-oidc.key
|
||||
|
||||
# Clean old DB if encryption key changed
|
||||
$SUDO find "${AUTHELIA_DIR}/db.sqlite3" -delete 2>/dev/null || true
|
||||
|
||||
info "Writing Authelia configuration..."
|
||||
$SUDO tee "$AUTHELIA_CONFIG" > /dev/null << AUTHEOF
|
||||
theme: light
|
||||
server:
|
||||
host: 0.0.0.0
|
||||
|
|
@ -376,16 +392,12 @@ $(echo "$OIDC_KEY" | sed 's/^/ /')
|
|||
pre_configured_consent_duration: "1 year"
|
||||
userinfo_signed_response_alg: "none"
|
||||
AUTHEOF
|
||||
$SUDO chmod 600 "$AUTHELIA_CONFIG"
|
||||
success "Authelia config written"
|
||||
$SUDO chmod 600 "$AUTHELIA_CONFIG"
|
||||
|
||||
# Create initial users_database.yml (needed for Authelia to start)
|
||||
if [ ! -f "${AUTHELIA_DIR}/users_database.yml" ]; then
|
||||
info "Creating initial users database..."
|
||||
# Remove old DB if encryption key changed
|
||||
find "${AUTHELIA_DIR}/db.sqlite3" -delete 2>/dev/null || true
|
||||
ADMIN_HASH=$("${AUTHELIA_DIR}/authelia" crypto hash generate --password "$(openssl rand -base64 16)" 2>/dev/null | awk '{print $NF}' || echo "\$argon2id\$v=19\$m=65536,t=3,p=4\$placeholder")
|
||||
cat > "${AUTHELIA_DIR}/users_database.yml" << USERSDB
|
||||
# Create initial users database
|
||||
if [ ! -f "${AUTHELIA_DIR}/users_database.yml" ]; then
|
||||
ADMIN_HASH=$("${AUTHELIA_DIR}/authelia" crypto hash generate --password "$(openssl rand -base64 16)" 2>/dev/null | awk '{print $NF}' || echo "placeholder")
|
||||
$SUDO tee "${AUTHELIA_DIR}/users_database.yml" > /dev/null << USERSDB
|
||||
users:
|
||||
placeholder:
|
||||
displayname: "Setup Account"
|
||||
|
|
@ -393,13 +405,39 @@ users:
|
|||
email: "${ADMIN_EMAIL:-admin@local}"
|
||||
groups: [admins]
|
||||
USERSDB
|
||||
$SUDO chmod 600 "${AUTHELIA_DIR}/users_database.yml"
|
||||
success "Users database created"
|
||||
fi
|
||||
|
||||
$SUDO systemctl restart authelia 2>/dev/null && info "Authelia restarted" || info "Authelia not running (will start later)"
|
||||
$SUDO chmod 600 "${AUTHELIA_DIR}/users_database.yml"
|
||||
fi
|
||||
|
||||
# Create systemd service for Authelia
|
||||
$SUDO tee /etc/systemd/system/authelia.service > /dev/null << AUTHSVC
|
||||
[Unit]
|
||||
Description=Authelia Identity Provider
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=${SYS_USER}
|
||||
WorkingDirectory=${AUTHELIA_DIR}
|
||||
ExecStart=${AUTHELIA_DIR}/authelia --config ${AUTHELIA_CONFIG}
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
AUTHSVC
|
||||
|
||||
$SUDO systemctl daemon-reload
|
||||
$SUDO systemctl enable authelia 2>/dev/null || true
|
||||
$SUDO systemctl restart authelia 2>/dev/null
|
||||
sleep 2
|
||||
if $SUDO systemctl is-active --quiet authelia 2>/dev/null; then
|
||||
success "Authelia v${AUTHELIA_VERSION} running"
|
||||
else
|
||||
warn "Authelia may need manual start — check: sudo journalctl -u authelia"
|
||||
fi
|
||||
|
||||
# ============================================================
|
||||
# SMOKE TEST + ADMIN CREATION
|
||||
# ============================================================
|
||||
# SMOKE TEST + ADMIN CREATION
|
||||
# ============================================================
|
||||
|
|
@ -458,12 +496,6 @@ $SUDO systemctl enable --now nextwks 2>/dev/null && success "NextWks is running"
|
|||
echo ""
|
||||
info " Logs: sudo journalctl -u nextwks -f"
|
||||
echo ""
|
||||
if [ -f "${AUTHELIA_DIR}/authelia" ]; then
|
||||
info " Authelia: installed and configured"
|
||||
else
|
||||
warn " Authelia: not installed — run scripts/install-authelia.sh or install manually"
|
||||
fi
|
||||
echo ""
|
||||
if [ -n "${ADMIN_PASS:-}" ]; then
|
||||
warn " ┌─────────────────────────────────────────┐"
|
||||
warn " │ Admin login: ${AUTH_URL}"
|
||||
|
|
|
|||
Loading…
Reference in a new issue