feat(installer): auto-install Authelia — one script deploys everything

install.sh

@@ -291,23 +291,39 @@ $SUDO systemctl daemon-reload
 success "Service: $SERVICE_FILE"
 
 # ============================================================
-# AUTHELIA CONFIG
 # ============================================================
-if [ -f "${AUTHELIA_DIR}/authelia" ]; then
+# AUTHELIA — Download, configure, and start
-    header "── Authelia Config ──"
+# ============================================================
+header "── Authelia ──"
+AUTHELIA_VERSION="4.38.0"
+
+if [ ! -f "${AUTHELIA_DIR}/authelia" ]; then
+    info "Downloading Authelia v${AUTHELIA_VERSION}..."
+    $SUDO apt-get update -qq && $SUDO apt-get install -y -qq wget tar openssl jq 2>/dev/null
+    $SUDO mkdir -p "$AUTHELIA_DIR"
+    wget -q "https://github.com/authelia/authelia/releases/download/v${AUTHELIA_VERSION}/authelia-v${AUTHELIA_VERSION}-linux-amd64.tar.gz" -O /tmp/authelia.tar.gz
+    $SUDO tar -xzf /tmp/authelia.tar.gz -C "$AUTHELIA_DIR"
+    $SUDO mv "$AUTHELIA_DIR/authelia-linux-amd64" "$AUTHELIA_DIR/authelia" 2>/dev/null || true
+    $SUDO chmod +x "$AUTHELIA_DIR/authelia"
+    rm -f /tmp/authelia.tar.gz
+    success "Authelia downloaded"
+fi
+
+# Generate Authelia secrets and config
 JWT_SECRET=$(openssl rand -base64 32)
 SESSION_SECRET=$(openssl rand -base64 32)
 STORAGE_KEY=$(openssl rand -base64 32)
 OIDC_HMAC=$(openssl rand -base64 32)
 
-    # Generate RSA key for OIDC signing
+# Generate RSA key for OIDC
 openssl genrsa -out /tmp/nw-oidc.key 2048 2>/dev/null
 OIDC_KEY=$(cat /tmp/nw-oidc.key)
 rm -f /tmp/nw-oidc.key
 
-    # Hash current admin password (if users exist) or generate one
+# Clean old DB if encryption key changed
-    ADMIN_HASH=$("${AUTHELIA_DIR}/authelia" crypto hash generate --password "$(openssl rand -base64 12)" 2>/dev/null | awk '{print $NF}' || echo "\$argon2id\$v=19\$m=65536,t=3,p=4\$placeholder\$placeholder")
+$SUDO find "${AUTHELIA_DIR}/db.sqlite3" -delete 2>/dev/null || true
 
+info "Writing Authelia configuration..."
 $SUDO tee "$AUTHELIA_CONFIG" > /dev/null << AUTHEOF
 theme: light
 server:
@@ -377,15 +393,11 @@ $(echo "$OIDC_KEY" | sed 's/^/          /')
         userinfo_signed_response_alg: "none"
 AUTHEOF
 $SUDO chmod 600 "$AUTHELIA_CONFIG"
-    success "Authelia config written"
 
-    # Create initial users_database.yml (needed for Authelia to start)
+# Create initial users database
 if [ ! -f "${AUTHELIA_DIR}/users_database.yml" ]; then
-        info "Creating initial users database..."
+    ADMIN_HASH=$("${AUTHELIA_DIR}/authelia" crypto hash generate --password "$(openssl rand -base64 16)" 2>/dev/null | awk '{print $NF}' || echo "placeholder")
-        # Remove old DB if encryption key changed
+    $SUDO tee "${AUTHELIA_DIR}/users_database.yml" > /dev/null << USERSDB
-        find "${AUTHELIA_DIR}/db.sqlite3" -delete 2>/dev/null || true
-        ADMIN_HASH=$("${AUTHELIA_DIR}/authelia" crypto hash generate --password "$(openssl rand -base64 16)" 2>/dev/null | awk '{print $NF}' || echo "\$argon2id\$v=19\$m=65536,t=3,p=4\$placeholder")
-        cat > "${AUTHELIA_DIR}/users_database.yml" << USERSDB
 users:
   placeholder:
     displayname: "Setup Account"
@@ -394,12 +406,38 @@ users:
     groups: [admins]
 USERSDB
     $SUDO chmod 600 "${AUTHELIA_DIR}/users_database.yml"
-        success "Users database created"
 fi
 
-    $SUDO systemctl restart authelia 2>/dev/null && info "Authelia restarted" || info "Authelia not running (will start later)"
+# Create systemd service for Authelia
+$SUDO tee /etc/systemd/system/authelia.service > /dev/null << AUTHSVC
+[Unit]
+Description=Authelia Identity Provider
+After=network.target
+
+[Service]
+Type=simple
+User=${SYS_USER}
+WorkingDirectory=${AUTHELIA_DIR}
+ExecStart=${AUTHELIA_DIR}/authelia --config ${AUTHELIA_CONFIG}
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+AUTHSVC
+
+$SUDO systemctl daemon-reload
+$SUDO systemctl enable authelia 2>/dev/null || true
+$SUDO systemctl restart authelia 2>/dev/null
+sleep 2
+if $SUDO systemctl is-active --quiet authelia 2>/dev/null; then
+    success "Authelia v${AUTHELIA_VERSION} running"
+else
+    warn "Authelia may need manual start — check: sudo journalctl -u authelia"
 fi
 
+# ============================================================
+# SMOKE TEST + ADMIN CREATION
 # ============================================================
 # SMOKE TEST + ADMIN CREATION
 # ============================================================
@@ -458,12 +496,6 @@ $SUDO systemctl enable --now nextwks 2>/dev/null && success "NextWks is running"
 echo ""
 info "  Logs:  sudo journalctl -u nextwks -f"
 echo ""
-if [ -f "${AUTHELIA_DIR}/authelia" ]; then
-    info "  Authelia:   installed and configured"
-else
-    warn "  Authelia:   not installed — run scripts/install-authelia.sh or install manually"
-fi
-echo ""
 if [ -n "${ADMIN_PASS:-}" ]; then
     warn "  ┌─────────────────────────────────────────┐"
     warn "  │  Admin login:  ${AUTH_URL}"