Revert OIDC client secrets to file-based approach

Bcrypt hashes contain $ signs which Portainer interpolates when storing as env vars, truncating the values. Use {{ secret "file" }} template syntax instead — hashes live in /srv/authelia/config/secrets/ on the host, written via Python to avoid shell interpolation. Only $ -safe values (hex strings) remain as env vars.
2026-02-26 20:03:03 +00:00
parent 39f6ca8530
commit e6d4b0a349
3 changed files with 21 additions and 13 deletions
@@ -11,8 +11,8 @@ services:
      - AUTHELIA_SESSION_SECRET=${AUTHELIA_SESSION_SECRET}
      - AUTHELIA_STORAGE_ENCRYPTION_KEY=${AUTHELIA_STORAGE_ENCRYPTION_KEY}
      - AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET=${AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET}
-      - AUTHELIA_OIDC_CLIENT_SECRET_OPEN_WEBUI=${AUTHELIA_OIDC_CLIENT_SECRET_OPEN_WEBUI}
-      - AUTHELIA_OIDC_CLIENT_SECRET_LINKDING=${AUTHELIA_OIDC_CLIENT_SECRET_LINKDING}
+      # OIDC client secrets are NOT passed as env vars — bcrypt hashes contain $ which
+      # Portainer/shell interpolates. Stored as files in /srv/authelia/config/secrets/ instead.
      - X_AUTHELIA_CONFIG_FILTERS=template
    networks:
      - npm-network