From 154ab6c4ae5957574f55d72a16292d7292a6eb3a Mon Sep 17 00:00:00 2001 From: atlas Date: Mon, 17 Aug 2026 19:15:54 +0200 Subject: [PATCH] fix(#3401): let authelia re-read its user file on change Authelia reads authentication_backend.file.path once at startup. Without watch, an identity the bridge creates is real on disk and invisible to the running authelia until something unrelated bounces the unit. swarm-authelia-bridge cannot restart authelia -- running unprivileged inside the container is the whole reason it may write that file, so restarting the unit is exactly the privilege it was designed not to hold. swarmctl does restart it, but that is a systemctl -M shellout that can fail, and when it did the symptom was a login refused for a user whose record was already correct on disk. This makes correctness stop depending on that restart succeeding. --- nix/host-modules/swarm-authelia.nix | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/nix/host-modules/swarm-authelia.nix b/nix/host-modules/swarm-authelia.nix index 7cb4b7c8..3c3d3965 100644 --- a/nix/host-modules/swarm-authelia.nix +++ b/nix/host-modules/swarm-authelia.nix @@ -967,7 +967,29 @@ in server.address = "tcp://127.0.0.1:${toString cfg.port}"; log.level = "info"; - authentication_backend.file.path = cfg.usersFile; + # Authelia reads this file once, at STARTUP. `watch` makes it + # re-read on change, and that is load-bearing rather than a + # convenience. + # + # `swarm-authelia-bridge` writes this file to create agent + # identities and **cannot** restart authelia: running + # unprivileged inside the container is the whole reason it is + # allowed to write the file at all, so "restart the unit" is + # exactly the privilege it was designed not to hold. Without + # `watch` every identity it creates is real on disk and + # invisible to the running authelia until something unrelated + # bounces the unit. + # + # `swarmctl` does restart authelia after writing — but that is + # a `systemctl -M` shellout that can fail, and when it did the + # symptom was a login refused for a user whose record was + # already correct on disk, with nothing implicating the + # reload. This setting is what makes correctness stop + # depending on that restart succeeding. + authentication_backend.file = { + path = cfg.usersFile; + watch = true; + }; # ⚠️ `one_factor` as the DEFAULT means "any authenticated # user", which is authentication, not authorisation. The