refactor: use filesystem notifier instead of SMTP
Solo-admin setup; enrollment codes in config/notification.txt. Drop 0012 SMTP/secret files. Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Frank Schwenk
@@ -4,13 +4,3 @@ TZ=Europe/Berlin
|
||||
|
||||
# Optional: Authelia log level (info|debug|trace)
|
||||
# AUTHELIA_LOG_LEVEL=info
|
||||
|
||||
# --- SMTP credentials (0012.de Plesk) ---
|
||||
# Authelia reads these from secret files (not from env):
|
||||
# secrets/smtp_username.txt e.g. auth@0012.de
|
||||
# secrets/smtp_password.txt
|
||||
# secrets/smtp_sender.txt e.g. Authelia <auth@0012.de>
|
||||
# Create them on the server (see README). Keep this .env for your own notes if useful:
|
||||
SMTP_USER=auth@0012.de
|
||||
SMTP_PASSWORD=
|
||||
SMTP_SENDER=Authelia <auth@0012.de>
|
||||
|
||||
@@ -4,7 +4,9 @@ Scratchpad for this project.
|
||||
|
||||
---
|
||||
|
||||
## 2026-08-01 — Repo ready, not deployed
|
||||
## 2026-08-01
|
||||
|
||||
- Stack files in place; `authelia validate-config` OK with template secrets + SMTP env.
|
||||
- Next (Fränky): DNS, `.env` SMTP from 0012, secrets generate, `users_database.yml`, deploy to `/home/frank/auth.schwenk.online`.
|
||||
- SMTP verworfen (Authelia Send „OK“, Gmail bekam Authelia-Mails nicht; Control-Mails sonst ok).
|
||||
- Notifier: filesystem → `config/notification.txt`
|
||||
- TOTP/Google Authenticator verknüpft.
|
||||
- Mail-Konto `auth@0012.de` darf weg.
|
||||
|
||||
@@ -40,8 +40,9 @@ Zusätzlich in diesem Repo unter `config/configuration.yml` → `access_control.
|
||||
| `compose.yml` | Authelia, Redis, whoami-Smoke |
|
||||
| `config/configuration.yml` | Authelia-Config (kein Secret-Inhalt) |
|
||||
| `config/users_database.yml.example` | User-Template |
|
||||
| `secrets/` | `jwt_secret.txt`, `session_secret.txt`, `storage_encryption_key.txt`, `smtp_username.txt`, `smtp_password.txt`, `smtp_sender.txt` (nur auf dem Server) |
|
||||
| `.env` | `TZ` (+ optional Log-Level); SMTP-Passwort gehört in `secrets/smtp_*.txt` |
|
||||
| `config/notification.txt` | Filesystem-Notifier-Ausgabe (gitignored, nur Server) |
|
||||
| `secrets/` | `jwt_secret.txt`, `session_secret.txt`, `storage_encryption_key.txt` (nur auf dem Server) |
|
||||
| `.env` | `TZ` (+ optional Log-Level) |
|
||||
|
||||
## Deploy (boka)
|
||||
|
||||
@@ -52,7 +53,6 @@ ssh frank-schwenk.de
|
||||
git clone ssh://git@gitea.schwenk.online:2222/froxxxy/authschwenkonline.git /home/frank/auth.schwenk.online
|
||||
cd /home/frank/auth.schwenk.online
|
||||
cp .env.example .env
|
||||
# SMTP_PASSWORD und Sender aus 0012 server.env eintragen
|
||||
```
|
||||
|
||||
### Secrets erzeugen
|
||||
@@ -65,18 +65,6 @@ docker run --rm -u 8000:8000 -v "$(pwd)/secrets:/secrets" authelia/authelia:4.39
|
||||
session_secret.txt storage_encryption_key.txt jwt_secret.txt'
|
||||
```
|
||||
|
||||
SMTP (0012.de) — Dateien unter `secrets/` (UID 8000):
|
||||
|
||||
```bash
|
||||
# as root / via docker if secrets/ is 0700 for uid 8000
|
||||
printf '%s\n' 'auth@0012.de' > secrets/smtp_username.txt
|
||||
printf '%s\n' 'YOUR_SMTP_PASSWORD' > secrets/smtp_password.txt
|
||||
printf '%s\n' 'Authelia <auth@0012.de>' > secrets/smtp_sender.txt
|
||||
chown 8000:8000 secrets/smtp_*.txt && chmod 600 secrets/smtp_*.txt
|
||||
```
|
||||
|
||||
Notifier: `submissions://ha01s019.org-dns.com:465` (implizites TLS). Sender-Format muss RFC5322 sein: `Name <user@domain>` — kein unquoted `foo.bar.baz <…>`.
|
||||
|
||||
### User-DB
|
||||
|
||||
```bash
|
||||
@@ -84,7 +72,7 @@ cp config/users_database.yml.example config/users_database.yml
|
||||
docker run --rm authelia/authelia:4.39 \
|
||||
authelia crypto hash generate argon2 --password 'YOUR_PASSWORD'
|
||||
# Hash in users_database.yml bei frank.password einsetzen
|
||||
# email: Postfach, das Mail von 0012.de SMTP annimmt (Tuta oft problematisch)
|
||||
# email: beliebig (Notifier schreibt lokal, kein SMTP)
|
||||
```
|
||||
|
||||
### Start
|
||||
@@ -94,25 +82,27 @@ docker compose up -d
|
||||
docker compose logs -f authelia
|
||||
```
|
||||
|
||||
## SMTP (0012.de)
|
||||
## Notifier (filesystem)
|
||||
|
||||
- Host `ha01s019.org-dns.com`, Port **465** (`submissions://`), Auth z.B. `auth@0012.de`
|
||||
- Credentials nur in `secrets/smtp_*.txt` (siehe oben)
|
||||
- Startup-Check sendet **keine** Mail — nur Verbindungs-Check
|
||||
- Test von boka: Python/`swaks` an `cuidas@gmail.com`; Authelia-Logs bei Erfolg: Trace `Timing Attack Delay successful: true` nach „Sending an email…“
|
||||
Codes / Reset-Links landen in `config/notification.txt` auf dem Server:
|
||||
|
||||
```bash
|
||||
ssh frank-schwenk.de
|
||||
# config/ is often root-owned after first start:
|
||||
docker run --rm -v /home/frank/auth.schwenk.online/config:/config:ro alpine cat /config/notification.txt
|
||||
```
|
||||
|
||||
## TOTP-Enrollment
|
||||
|
||||
1. `https://auth.schwenk.online` öffnen, einloggen
|
||||
2. Enrollment-Code kommt per Mail
|
||||
2. Gerät registrieren → Code/Link aus `notification.txt` (siehe oben)
|
||||
3. QR mit Google Authenticator (o.ä.) scannen
|
||||
|
||||
## Verify
|
||||
|
||||
1. Portal erreichbar: `https://auth.schwenk.online`
|
||||
2. Smoke hinter 2FA: `https://whoami-auth.schwenk.online` → Login + TOTP → whoami-Body
|
||||
3. Mail-Test: Passwort-Reset oder Enrollment löst SMTP aus
|
||||
4. `docker compose ps` — alle Services `running`
|
||||
3. `docker compose ps` — alle Services `running`
|
||||
|
||||
whoami nach dem Smoke optional aus `compose.yml` entfernen oder Router-Label deaktivieren.
|
||||
|
||||
|
||||
@@ -32,7 +32,7 @@ Fränky (Admin); später ggf. weitere User in der File-DB. Consumer-Projekte (z.
|
||||
## Project-Specific Rules
|
||||
|
||||
- Secrets nur in `.env` / `secrets/` auf dem Server — nie committen
|
||||
- SMTP über 0012.de-Plesk (siehe README) — Passwort aus 0012 `server.env` kopieren
|
||||
- Notifier: filesystem (`config/notification.txt`) — kein SMTP
|
||||
- Middleware-Referenz für Consumer: `authelia@docker`
|
||||
- ACL: neue geschützte Hosts hier ergänzen (`two_factor` o.ä.), Middleware setzt das App-Repo
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
# Authelia configuration — secrets via template files under /secrets/
|
||||
# SMTP username/password/sender: files in /secrets/smtp_*.txt (see README)
|
||||
# Notifier: filesystem (solo admin; codes in /config/notification.txt)
|
||||
|
||||
server:
|
||||
address: 'tcp://:9091'
|
||||
@@ -72,15 +72,5 @@ storage:
|
||||
|
||||
notifier:
|
||||
disable_startup_check: false
|
||||
smtp:
|
||||
address: 'submissions://ha01s019.org-dns.com:465'
|
||||
timeout: '15s'
|
||||
username: {{ secret "/secrets/smtp_username.txt" | mindent 0 "|" | msquote }}
|
||||
password: {{ secret "/secrets/smtp_password.txt" | mindent 0 "|" | msquote }}
|
||||
sender: {{ secret "/secrets/smtp_sender.txt" | mindent 0 "|" | msquote }}
|
||||
identifier: 'auth.schwenk.online'
|
||||
subject: '[Authelia] {title}'
|
||||
startup_check_address: 'cuidas@gmail.com'
|
||||
disable_require_tls: false
|
||||
disable_starttls: false
|
||||
disable_html_emails: false
|
||||
filesystem:
|
||||
filename: '/config/notification.txt'
|
||||
|
||||
@@ -3,12 +3,12 @@
|
||||
# Generate hash:
|
||||
# docker run --rm authelia/authelia:4.39 authelia crypto hash generate argon2 --password 'YOUR_PASSWORD'
|
||||
#
|
||||
# Use an email inbox that accepts mail from 0012.de SMTP (Tuta may reject).
|
||||
# email: placeholder (filesystem notifier — no real mailbox required)
|
||||
|
||||
users:
|
||||
frank:
|
||||
displayname: 'Fränky'
|
||||
password: '$argon2id$v=19$m=65536,t=3,p=4$REPLACE_WITH_REAL_HASH'
|
||||
email: 'cuidas@gmail.com'
|
||||
email: 'frank@schwenk.online'
|
||||
groups:
|
||||
- 'admins'
|
||||
|
||||
Reference in New Issue
Block a user