Secrets ENV on freebsd

[thijsjek]

Authelia is running in its own jail.
Currently my authelia.yml contains secrets. I have been reading on how to change that. but to no avail.

If i use
setenv AUTHELIA_STORAGE_MYSQL_PASSWORD_FILE "/usr/local/share/authelia/storage.mysql.password"
with or without "", and uncomment the specific line in the config results in:
time="2023-02-04T13:35:00+01:00" level=error msg="Configuration: storage: mysql: option 'username' and 'password' are required" time="2023-02-04T13:35:00+01:00" level=fatal msg="Can't continue due to the errors loading the configuration"
meanwhile the Configuration parsed and loaded successfully without errors.
If i then leave the line in the config, i get the error: duplicate entry.
the contents of /usr/local/share/authelia/storage.mysql.password
is for example: apple123. The file is root 600, same as authelia,.

So my conclusion is, authelia sees the env, but the value is somehow not correct.

[james-d-elliott]

We don't have a error that reads duplicate entry so something else is going on. Also the information provided seems in conflict:

and uncomment the specific line in the config results in: leads to the mysql username and password required? meanwhile the Configuration parsed and loaded successfully without errors.?

So my conclusion is, authelia sees the env, but the value is somehow not correct.

if this was the case there would be an error about reading the file.

[nightah]

Are you setting a secret for both the username and password?
If not are you leaving the username within the config along with the env you have set above?

[thijsjek]

We don't have a error that reads duplicate entry so something else is going on. Also the information provided seems in conflict:

and uncomment the specific line in the config results in: leads to the mysql username and password required? meanwhile the Configuration parsed and loaded successfully without errors.?

So my conclusion is, authelia sees the env, but the value is somehow not correct.

if this was the case there would be an error about reading the file.

Sorry, long day..
If I set the env while not comment out the password line and run the validator I get:
secrets: error loading secret into key 'storage.mysql.password': it's already defined in other configuration sources
If I now remove the password line in the config
It gets parsed without errors. If I then restart authelia, it doesn't start.
Log: username and password are required.

In the password file is only the password, and the username line is still in the config.

[james-d-elliott]

Did you define it as two similar envs one with and one without _FILE?

[thijsjek]

I tried now to setenv username and setenv password without _FILE. So directly the username and password in the env. Still got parsed but exited with no username and password are required

[nightah]

It sounds like the environment isn't being set or perhaps being consumed elsewhere.

Have you tried prepending the env vars with the actual command to run Authelia like: ENV_FILE=value authelia -config ...?

[thijsjek]

Hmm, now it is getting interesting.
If I run authelia --config /usr/local/etc/authelia.yml authelia starts. When I use service authelia start, it ends up with the errors.

This is the startup script

# PROVIDE: authelia
# REQUIRE: DAEMON NETWORKING
# KEYWORD: shutdown

# Add the following lines to /etc/rc.conf to enable authelia:
# authelia_enable : set to "YES" to enable the daemon, default is "NO"

. /etc/rc.subr

name=authelia
rcvar=authelia_enable

load_rc_config $name

authelia_enable=${authelia_enable:-"NO"}

logfile="/var/log/${name}.log"

procname=/usr/local/bin/authelia
command="/usr/sbin/daemon"
command_args="-u root -o ${logfile} -t ${name} /usr/local/bin/authelia --config /usr/local/etc/authelia.yml"

run_rc_command "$1"```

[nightah]

Where are you performing the setenv? If it's not in that script it's likely not being set in the correct area.

[thijsjek]

Previously In the jail's shell.
Now I figured out how to put env_file into freebsd startup script at /use/local/etc/rc.d/authelia
export AUTHELIA_STORAGE_MYSQL_PASSWORD_FILE="/usr/local/share/authelia/storage.mysql.password"
This causes the config file parsed and loaded with errors, but still working if I run as service. As authelia --config is throwing in the same errors.