vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nix(authelia): start with a disabled placeholder user when the user set is empty

Browse source 
authelia 4.39.20 exits at startup on `users: {}` ("users: non zero value
required"), and the first-boot unit seeded exactly that, so a swarm with
no users crash-looped authelia and answered 502 until `swarmctl user add`
ran.

The first-boot unit now writes one subject, `swarm.placeholder`, when
the users database is absent, empty, or exactly `users: {}`:

- `disabled: true` — authelia returns "user not found" for a disabled
  user before any password check (file_user_provider.go,
  CheckUserPassword).
- password: an argon2id digest with an all-zero key. It decodes (authelia
  rejects a non-digest at startup) and no known password hashes to it.
- the `.` keeps it out of agent names (`[a-z0-9-]`), and `swarmctl user
  add` refuses it as already existing. Neither writer removes users, and
  both round-trip `disabled`.

A file with any user in it is never touched.

The docs that described the crash-loop (sso.md, gateway.md, setup.md,
the sso-unavailable error page) now describe the placeholder; the
writers' load_store docs and the seed fixtures follow. module-eval
nats-authelia asserts the seed branch.
This commit is contained in:
atlas 2026-10-02 11:57:55 +02:00 • committed by mara
commit 99905f50b0
9 changed files with 102 additions and 62 deletions
Download patch file Download diff file Expand all files Collapse all files

12
nix/host-modules/hive-gateway/error-pages.nix
View file

@ -56,21 +56,15 @@ in
'';
};
# Shown when the authelia vhost's upstream refuses the connection.
# Leads with the bootstrap because that is overwhelmingly the cause:
# authelia treats an empty user store as a FATAL startup error, so an
# enabled-but-unbootstrapped swarm crash-loops behind a vhost that is
# working perfectly, and the raw 502 points at the proxy instead.
# Shown when the authelia vhost's upstream refuses the connection: authelia
# is down behind a working gateway, and the raw 502 points at the proxy.
ssoUnavailable = mkPage {
name = "sso-unavailable";
title = "sso unavailable";
accent = "#f9e2af";
body = ''
<p>The swarm's identity provider isn't answering. The gateway is fine — nothing is listening behind it.</p>
<p class="hint">Most likely: <strong>no users exist yet.</strong> Authelia refuses to start with an empty user store, so it never finishes booting. Add the first account on the host running it:</p>
<pre>swarmctl user add &lt;username&gt; \
--display-name &lt;Name&gt; --email &lt;addr&gt; --group admins</pre>
<p class="hint">Otherwise check the container: <code>journalctl -M swarm-authelia -u authelia-swarm</code>. This page recovers on reload once the provider is up.</p>
<p class="hint">Check the container: <code>journalctl -M swarm-authelia -u authelia-swarm</code>. This page recovers on reload once the provider is up.</p>
'';
};