Merge branch 'master' into certbot-revamp-config-file

README.md

@@ -336,6 +336,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
 
 ## Versions
 
+* **27.04.23:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) authelia-location.conf, authelia-server.conf, authentik-location.conf, authentik-server.conf - Simplify auth configs and fix Set-Cookie header bug.
 * **13.04.23:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, authelia-location.conf, authentik-location.conf, and site-confs/default.conf - Move ssl.conf include to default.conf. Remove Authorization headers in authelia. Sort proxy_set_header in authelia and authentik.
 * **25.03.23:** - Fix renewal post hook.
 * **10.03.23:** - Cleanup unused csr and keys folders. See [certbot 2.3.0 release notes](https://github.com/certbot/certbot/releases/tag/v2.3.0).

package_versions.txt

@@ -1,8 +1,8 @@
 NAME                            VERSION                TYPE   
 ConfigArgParse                  1.5.3                  python  
-PyJWT                           2.6.0                  python  
+PyJWT                           2.7.0                  python  
 PyYAML                          6.0                    python  
-acme                            2.5.0                  python  
+acme                            2.6.0                  python  
 alpine-baselayout               3.4.0-r0               apk     
 alpine-baselayout-data          3.4.0-r0               apk     
 alpine-keys                     2.4-r1                 apk     
@@ -21,58 +21,58 @@ azure-mgmt-core                 1.4.0                  python
 azure-mgmt-dns                  8.0.0                  python  
 bash                            5.2.15-r0              apk     
 beautifulsoup4                  4.12.2                 python  
-boto3                           1.26.129               python  
+boto3                           1.26.131               python  
-botocore                        1.29.129               python  
+botocore                        1.29.131               python  
 brotli-libs                     1.0.9-r9               apk     
 bs4                             0.0.1                  python  
 busybox                         1.35.0                 binary  
 busybox                         1.35.0-r29             apk     
 busybox-binsh                   1.35.0-r29             apk     
 c-client                        2007f-r14              apk     
-ca-certificates                 20220614-r4            apk     
+ca-certificates                 20230506-r0            apk     
 ca-certificates-bundle          20220614-r4            apk     
 cachetools                      5.3.0                  python  
-certbot                         2.5.0                  python  
+certbot                         2.6.0                  python  
 certbot-dns-acmedns             0.1.0                  python  
 certbot-dns-aliyun              2.0.0                  python  
 certbot-dns-azure               2.1.0                  python  
-certbot-dns-cloudflare          2.5.0                  python  
+certbot-dns-cloudflare          2.6.0                  python  
 certbot-dns-cpanel              0.4.0                  python  
 certbot-dns-desec               1.2.1                  python  
-certbot-dns-digitalocean        2.5.0                  python  
+certbot-dns-digitalocean        2.6.0                  python  
 certbot-dns-directadmin         1.0.3                  python  
-certbot-dns-dnsimple            2.5.0                  python  
+certbot-dns-dnsimple            2.6.0                  python  
-certbot-dns-dnsmadeeasy         2.5.0                  python  
+certbot-dns-dnsmadeeasy         2.6.0                  python  
 certbot-dns-dnspod              0.1.0                  python  
 certbot-dns-do                  0.31.0                 python  
 certbot-dns-domeneshop          0.2.9                  python  
 certbot-dns-duckdns             1.3                    python  
 certbot-dns-dynu                0.0.4                  python  
-certbot-dns-gehirn              2.5.0                  python  
+certbot-dns-gehirn              2.6.0                  python  
 certbot-dns-godaddy             0.2.2                  python  
-certbot-dns-google              2.5.0                  python  
+certbot-dns-google              2.6.0                  python  
 certbot-dns-google-domains      0.1.11                 python  
 certbot-dns-he                  1.0.0                  python  
 certbot-dns-hetzner             2.0.0                  python  
 certbot-dns-infomaniak          0.2.1                  python  
 certbot-dns-inwx                2.2.0                  python  
 certbot-dns-ionos               2022.11.24             python  
-certbot-dns-linode              2.5.0                  python  
+certbot-dns-linode              2.6.0                  python  
 certbot-dns-loopia              1.0.1                  python  
-certbot-dns-luadns              2.5.0                  python  
+certbot-dns-luadns              2.6.0                  python  
 certbot-dns-netcup              1.2.0                  python  
 certbot-dns-njalla              1.0.0                  python  
-certbot-dns-nsone               2.5.0                  python  
+certbot-dns-nsone               2.6.0                  python  
-certbot-dns-ovh                 2.5.0                  python  
+certbot-dns-ovh                 2.6.0                  python  
 certbot-dns-porkbun             0.8                    python  
-certbot-dns-rfc2136             2.5.0                  python  
+certbot-dns-rfc2136             2.6.0                  python  
-certbot-dns-route53             2.5.0                  python  
+certbot-dns-route53             2.6.0                  python  
-certbot-dns-sakuracloud         2.5.0                  python  
+certbot-dns-sakuracloud         2.6.0                  python  
 certbot-dns-standalone          1.1                    python  
 certbot-dns-transip             0.5.2                  python  
 certbot-dns-vultr               1.0.3                  python  
 certbot-plugin-gandi            1.4.3                  python  
-certifi                         2022.12.7              python  
+certifi                         2023.5.7               python  
 cffi                            1.15.1                 python  
 charset-normalizer              3.1.0                  python  
 cloudflare                      2.11.1                 python  
@@ -221,7 +221,6 @@ nginx-mod-stream                1.22.1-r0              apk
 nginx-mod-stream-geoip2         1.22.1-r0              apk     
 nginx-vim                       1.22.1-r0              apk     
 npth                            1.6-r2                 apk     
-oauth2client                    4.1.3                  python  
 oauthlib                        3.2.2                  python  
 oniguruma                       6.9.8-r0               apk     
 openssl                         3.0.8-r4               apk     
@@ -291,7 +290,7 @@ pkb-client                      1.2                    python
 popt                            1.19-r0                apk     
 portalocker                     2.7.0                  python  
 procps                          3.3.17-r2              apk     
-protobuf                        4.22.4                 python  
+protobuf                        4.23.0                 python  
 publicsuffixlist                0.9.4                  python  
 pyOpenSSL                       23.1.1                 python  
 pyRFC3339                       1.1                    python  

readme-vars.yml

@@ -154,6 +154,7 @@ app_setup_block: |
 
 # changelog
 changelogs:
+  - { date: "27.04.23:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) authelia-location.conf, authelia-server.conf, authentik-location.conf, authentik-server.conf - Simplify auth configs and fix Set-Cookie header bug." }
   - { date: "13.04.23:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, authelia-location.conf, authentik-location.conf, and site-confs/default.conf - Move ssl.conf include to default.conf. Remove Authorization headers in authelia. Sort proxy_set_header in authelia and authentik." }
   - { date: "25.03.23:", desc: "Fix renewal post hook." }
   - { date: "10.03.23:", desc: "Cleanup unused csr and keys folders. See [certbot 2.3.0 release notes](https://github.com/certbot/certbot/releases/tag/v2.3.0)." }

root/defaults/nginx/authelia-location.conf.sample

@@ -1,25 +1,27 @@
-## Version 2023/04/13 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authelia-location.conf.sample
+## Version 2023/04/27 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authelia-location.conf.sample
 # Make sure that your authelia container is in the same user defined bridge network and is named authelia
 # Rename /config/nginx/proxy-confs/authelia.subdomain.conf.sample to /config/nginx/proxy-confs/authelia.subdomain.conf
 # Make sure that the authelia configuration.yml has 'path: "authelia"' defined
 
-## Send a subrequest to Authelia to verify if the user is authenticated and has permission to access the resource.
+## Send a subrequest to Authelia to verify if the user is authenticated and has permission to access the resource
 auth_request /authelia/api/verify;
-## If the subreqest returns 200 pass to the backend, if the subrequest returns 401 redirect to the portal.
+## If the subreqest returns 200 pass to the backend, if the subrequest returns 401 redirect to the portal
 error_page 401 = @authelia_proxy_signin;
 
-## Translate response headers from Authelia into variables
+## Translate the user information response headers from the auth subrequest into variables
 auth_request_set $email $upstream_http_remote_email;
 auth_request_set $groups $upstream_http_remote_groups;
 auth_request_set $name $upstream_http_remote_name;
 auth_request_set $user $upstream_http_remote_user;
 
-## Inject the response header variables into the request made to the actual upstream
+## Inject the user information into the request made to the actual upstream
 proxy_set_header Remote-Email $email;
 proxy_set_header Remote-Groups $groups;
 proxy_set_header Remote-Name $name;
 proxy_set_header Remote-User $user;
 
-## Include the Set-Cookie header if present.
+## Translate the Set-Cookie response header from the auth subrequest into a variable
 auth_request_set $set_cookie $upstream_http_set_cookie;
-add_header Set-Cookie $set_cookie;
+
+## Translate the Location response header from the auth subrequest into a variable
+auth_request_set $signin_url $upstream_http_location;

root/defaults/nginx/authelia-server.conf.sample

@@ -1,4 +1,4 @@
-## Version 2023/02/09 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authelia-server.conf.sample
+## Version 2023/04/27 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authelia-server.conf.sample
 # Make sure that your authelia container is in the same user defined bridge network and is named authelia
 # Rename /config/nginx/proxy-confs/authelia.subdomain.conf.sample to /config/nginx/proxy-confs/authelia.subdomain.conf
 # Make sure that the authelia configuration.yml has 'path: "authelia"' defined
@@ -19,9 +19,9 @@ location = /authelia/api/verify {
     include /config/nginx/proxy.conf;
     include /config/nginx/resolver.conf;
     set $upstream_authelia authelia;
-    proxy_pass http://$upstream_authelia:9091/authelia/api/verify;
+    proxy_pass http://$upstream_authelia:9091;
 
-    ## Include the Set-Cookie header if present.
+    ## Include the Set-Cookie header if present
     auth_request_set $set_cookie $upstream_http_set_cookie;
     add_header Set-Cookie $set_cookie;
 
@@ -29,27 +29,25 @@ location = /authelia/api/verify {
     proxy_set_header Content-Length "";
 }
 
-# Virtual location for authelia 401 redirects
+# virtual location for authelia 401 redirects
 location @authelia_proxy_signin {
     internal;
 
-    ## Set the $target_url variable based on the original request.
+    ## Include the Set-Cookie header if present
-    set_escape_uri $target_url $scheme://$http_host$request_uri;
-
-    ## Include the Set-Cookie header if present.
     auth_request_set $set_cookie $upstream_http_set_cookie;
     add_header Set-Cookie $set_cookie;
 
-    ## Set $authelia_backend to route requests to the current domain by default
+    ## Set the $target_url variable based on the original request
-    set $authelia_backend $http_host;
+    set_escape_uri $target_url $scheme://$http_host$request_uri;
-    ## In order for Webauthn to work with multiple domains authelia must operate on a separate subdomain
-    ## To use authelia on a separate subdomain:
-    ##  * comment the $authelia_backend line above
-    ##  * rename /config/nginx/proxy-confs/authelia.conf.sample to /config/nginx/proxy-confs/authelia.conf
-    ##  * make sure that your dns has a cname set for authelia
-    ##  * uncomment the $authelia_backend line below and change example.com to your domain
-    ##  * restart the swag container
-    #set $authelia_backend authelia.example.com;
 
-    return 302 https://$authelia_backend/authelia/?rd=$target_url;
+    ## Translate the Location response header from the auth subrequest into a variable
+    auth_request_set $signin_url $upstream_http_location;
+
+    if ($signin_url = '') {
+        ## Set the $signin_url variable
+        set $signin_url https://$http_host/authelia/?rd=$target_url;
+    }
+
+    ## Redirect to login
+    return 302 $signin_url;
 }

root/defaults/nginx/authentik-location.conf.sample

@@ -1,26 +1,25 @@
-## Version 2023/04/13 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authentik-location.conf.sample
+## Version 2023/04/27 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authentik-location.conf.sample
 # Make sure that your authentik container is in the same user defined bridge network and is named authentik-server
 # Rename /config/nginx/proxy-confs/authentik.subdomain.conf.sample to /config/nginx/proxy-confs/authentik.subdomain.conf
 
-## Send a subrequest to Authentik to verify if the user is authenticated and has permission to access the resource.
+## Send a subrequest to Authentik to verify if the user is authenticated and has permission to access the resource
 auth_request /outpost.goauthentik.io/auth/nginx;
-## If the subreqest returns 200 pass to the backend, if the subrequest returns 401 redirect to the portal.
+## If the subreqest returns 200 pass to the backend, if the subrequest returns 401 redirect to the portal
 error_page 401 = @goauthentik_proxy_signin;
 
-## Translate response headers from Authentik into variables
+## Translate the user information response headers from the auth subrequest into variables
 auth_request_set $authentik_email $upstream_http_x_authentik_email;
 auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
 auth_request_set $authentik_name $upstream_http_x_authentik_name;
 auth_request_set $authentik_uid $upstream_http_x_authentik_uid;
 auth_request_set $authentik_username $upstream_http_x_authentik_username;
 
-## Inject the response header variables into the request made to the actual upstream
+## Inject the user information into the request made to the actual upstream
 proxy_set_header X-authentik-email $authentik_email;
 proxy_set_header X-authentik-groups $authentik_groups;
 proxy_set_header X-authentik-name $authentik_name;
 proxy_set_header X-authentik-uid $authentik_uid;
 proxy_set_header X-authentik-username $authentik_username;
 
-## Include the Set-Cookie header if present.
+## Translate the Set-Cookie response header from the auth subrequest into a variable
 auth_request_set $set_cookie $upstream_http_set_cookie;
-add_header Set-Cookie $set_cookie;

root/defaults/nginx/authentik-server.conf.sample

@@ -1,4 +1,4 @@
-## Version 2023/02/09 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authentik-server.conf.sample
+## Version 2023/04/27 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authentik-server.conf.sample
 # Make sure that your authentik container is in the same user defined bridge network and is named authentik-server
 # Rename /config/nginx/proxy-confs/authentik.subdomain.conf.sample to /config/nginx/proxy-confs/authentik.subdomain.conf
 
@@ -18,9 +18,9 @@ location = /outpost.goauthentik.io/auth/nginx {
     include /config/nginx/proxy.conf;
     include /config/nginx/resolver.conf;
     set $upstream_authentik authentik-server;
-    proxy_pass http://$upstream_authentik:9000/outpost.goauthentik.io/auth/nginx;
+    proxy_pass http://$upstream_authentik:9000;
 
-    ## Include the Set-Cookie header if present.
+    ## Include the Set-Cookie header if present
     auth_request_set $set_cookie $upstream_http_set_cookie;
     add_header Set-Cookie $set_cookie;
 
@@ -28,18 +28,20 @@ location = /outpost.goauthentik.io/auth/nginx {
     proxy_set_header Content-Length "";
 }
 
-# Virtual location for authentik 401 redirects
+# virtual location for authentik 401 redirects
 location @goauthentik_proxy_signin {
     internal;
 
-    ## Set the $target_url variable based on the original request.
+    ## Include the Set-Cookie header if present
-    set_escape_uri $target_url $scheme://$http_host$request_uri;
-
-    ## Include the Set-Cookie header if present.
     auth_request_set $set_cookie $upstream_http_set_cookie;
     add_header Set-Cookie $set_cookie;
 
-    ## Set $authentik_backend to route requests to the current domain by default
+    ## Set the $target_url variable based on the original request
-    set $authentik_backend $http_host;
+    set_escape_uri $target_url $scheme://$http_host$request_uri;
-    return 302 https://$authentik_backend/outpost.goauthentik.io/start?rd=$target_url;
+
+    ## Set the $signin_url variable
+    set $signin_url https://$http_host/outpost.goauthentik.io/start?rd=$target_url;
+
+    ## Redirect to login
+    return 302 $signin_url;
 }