Authelia SSO Portal, Secrets Kept Out Of The Config, Proven By A Login

authelia

Authelia from the upstream release (sha256-verified), as a hardened system service on loopback: an authentication and authorization portal for a reverse proxy, with a file user backend, sqlite storage and its secrets generated on the host. Original role for EL 10, live-tested with podman on Rocky Linux 10.

No package, so the checksum is the whole story. EL 10 carries no authelia; Authelia ships a release with a checksum file beside it. The role downloads both and has Ansible's get_url refuse the asset unless its SHA-256 is the one in the vendor's file, then installs the binaries as root's in /usr/local/bin, pinned by authelia_version.

A service account, a hardened unit, a loopback listener. authelia is a system user with no shell that owns the data directory and nothing else; the unit runs with NoNewPrivileges, PrivateTmp, ProtectHome and ProtectSystem=strict. The listener is 127.0.0.1:9091 by default, for a proxy that authenticates or a client on the same host; the live test reads the listening sockets and expects loopback only.

Secrets the configuration never holds. The session secret, the storage encryption key and the reset-password JWT secret are generated once each on the host and handed to the service through AUTHELIA_*_FILE variables in the unit; the same variables are given to authelia config validate, which checks configuration.yml before it lands and, without them, refuses it (that refusal was the control).

A user database that cannot be empty. Authelia's file backend refuses users: {}, so the role writes a disabled placeholder until authelia_users names real ones, each with a hash from authelia crypto hash generate. The backend watches the file, which is how the live test proves the portal: it hashes a throwaway password with Authelia's own hasher, writes the user in place, logs in through /api/firstfactor (200, status: OK), sees a wrong password refused (401), and sees the forward-auth endpoint send an anonymous visitor to https://auth.example.com (302 for a browser, 401 with the same Location for an API client). Set authelia_domain to the cookie domain your applications share and put the portal at auth. under it.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.