refactor(docker-compose): Move authelia to /auth, then bring back host checks

docker-compose.yml

@@ -52,17 +52,17 @@ services:
       - TZ=${TIMEZONE}
     labels:
       - traefik.enable=true
-      - traefik.http.routers.authelia.rule=PathPrefix(`/`)
+      - traefik.http.routers.authelia.rule=Host(`${APP_HOSTNAME}`) && PathPrefix(`/auth`) # Changed rule
       - traefik.http.routers.authelia.entrypoints=web
-      - traefik.http.routers.authelia.priority=100
+      # - traefik.http.routers.authelia.priority=100 # Removed priority
       - traefik.http.services.authelia.loadbalancer.server.port=9091
-      - traefik.http.middlewares.authelia-auth.forwardAuth.address=http://authelia:9091/api/verify?rd=https://${APP_HOSTNAME}/
+      - traefik.http.middlewares.authelia-auth.forwardAuth.address=http://authelia:9091/api/verify # Simplified forwardAuth address
       - traefik.http.middlewares.authelia-auth.forwardAuth.trustForwardHeader=true
       - traefik.http.middlewares.authelia-auth.forwardAuth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email
       - homepage.group=Security
       - homepage.name=Authelia
       - homepage.icon=authelia.png
-      - homepage.href=https://${APP_HOSTNAME}/
+      - homepage.href=/auth # Updated href
       - homepage.description=Authentication Portal
   sonarr:
     image: lscr.io/linuxserver/sonarr
@@ -81,7 +81,7 @@ services:
       retries: 10
     labels:
       - traefik.enable=true
-      - traefik.http.routers.sonarr.rule=PathPrefix(`/sonarr`)
+      - traefik.http.routers.sonarr.rule=Host(`${APP_HOSTNAME}`) && PathPrefix(`/sonarr`) # Added Host check
       - traefik.http.routers.sonarr.entrypoints=web
       - traefik.http.routers.sonarr.middlewares=authelia-auth@docker
       - traefik.http.services.sonarr.loadbalancer.server.port=8989
@@ -111,7 +111,7 @@ services:
       retries: 10
     labels:
       - traefik.enable=true
-      - traefik.http.routers.radarr.rule=PathPrefix(`/radarr`)
+      - traefik.http.routers.radarr.rule=Host(`${APP_HOSTNAME}`) && PathPrefix(`/radarr`) # Added Host check
       - traefik.http.routers.radarr.entrypoints=web
       - traefik.http.routers.radarr.middlewares=authelia-auth@docker
       - traefik.http.services.radarr.loadbalancer.server.port=7878
@@ -141,7 +141,7 @@ services:
       retries: 10
     labels:
       - traefik.enable=true
-      - traefik.http.routers.lidarr.rule=PathPrefix(`/lidarr`)
+      - traefik.http.routers.lidarr.rule=Host(`${APP_HOSTNAME}`) && PathPrefix(`/lidarr`) # Added Host check
       - traefik.http.routers.lidarr.entrypoints=web
       - traefik.http.routers.lidarr.middlewares=authelia-auth@docker
       - traefik.http.services.lidarr.loadbalancer.server.port=8686
@@ -173,7 +173,7 @@ services:
       retries: 10
     labels:
       - traefik.enable=true
-      - traefik.http.routers.bazarr.rule=PathPrefix(`/bazarr`)
+      - traefik.http.routers.bazarr.rule=Host(`${APP_HOSTNAME}`) && PathPrefix(`/bazarr`) # Added Host check
       - traefik.http.routers.bazarr.entrypoints=web
       - traefik.http.routers.bazarr.middlewares=authelia-auth@docker
       - traefik.http.services.bazarr.loadbalancer.server.port=6767
@@ -208,7 +208,7 @@ services:
       retries: 10
     labels:
       - traefik.enable=true
-      - traefik.http.routers.jellyseerr.rule=PathPrefix(`/jellyseerr`)
+      - traefik.http.routers.jellyseerr.rule=Host(`${APP_HOSTNAME}`) && PathPrefix(`/jellyseerr`) # Added Host check
       - traefik.http.routers.jellyseerr.entrypoints=web
       - traefik.http.services.jellyseerr.loadbalancer.server.port=5055
       - traefik.http.routers.jellyseerr.middlewares=jellyseerr-stripprefix,jellyseerr-rewrite,jellyseerr-rewriteHeaders,authelia-auth@docker
@@ -282,7 +282,7 @@ services:
       retries: 10
     labels:
       - traefik.enable=true
-      - traefik.http.routers.prowlarr.rule=PathPrefix(`/prowlarr`)
+      - traefik.http.routers.prowlarr.rule=Host(`${APP_HOSTNAME}`) && PathPrefix(`/prowlarr`) # Added Host check
       - traefik.http.routers.prowlarr.entrypoints=web
       - traefik.http.routers.prowlarr.middlewares=authelia-auth@docker
       - traefik.http.services.prowlarr.loadbalancer.server.port=9696
@@ -306,7 +306,7 @@ services:
       - TZ=${TIMEZONE}
     labels:
       - traefik.enable=true
-      - traefik.http.routers.flaresolverr.rule=PathPrefix(`/flaresolverr`)
+      - traefik.http.routers.flaresolverr.rule=Host(`${APP_HOSTNAME}`) && PathPrefix(`/flaresolverr`) # Added Host check
       - traefik.http.routers.flaresolverr.entrypoints=web
       - traefik.http.routers.flaresolverr.middlewares=authelia-auth@docker
       - traefik.http.services.flaresolverr.loadbalancer.server.port=8191
@@ -332,7 +332,7 @@ services:
       retries: 10
     labels:
       - traefik.enable=true
-      - traefik.http.routers.qbittorrent.rule=PathPrefix(`/qbittorrent`)
+      - traefik.http.routers.qbittorrent.rule=Host(`${APP_HOSTNAME}`) && PathPrefix(`/qbittorrent`) # Added Host check
       - traefik.http.routers.qbittorrent.entrypoints=web
       - traefik.http.services.qbittorrent.loadbalancer.server.port=8080
       - traefik.http.routers.qbittorrent.middlewares=qbittorrent-strip-slash,qbittorrent-stripprefix,authelia-auth@docker
@@ -378,7 +378,7 @@ services:
     restart: always
     labels:
       - traefik.enable=true
-      - traefik.http.routers.sabnzbd.rule=PathPrefix(`/sabnzbd`)
+      - traefik.http.routers.sabnzbd.rule=Host(`${APP_HOSTNAME}`) && PathPrefix(`/sabnzbd`) # Added Host check
       - traefik.http.routers.sabnzbd.entrypoints=web
       - traefik.http.routers.sabnzbd.middlewares=authelia-auth@docker
       - traefik.http.services.sabnzbd.loadbalancer.server.port=8080
@@ -414,9 +414,9 @@ services:
       retries: 10
     labels:
       - traefik.enable=true
-      - traefik.http.routers.jellyfin.rule=PathPrefix(`/jellyfin`)
+      - traefik.http.routers.jellyfin.rule=Host(`${APP_HOSTNAME}`) && PathPrefix(`/jellyfin`) # Added Host check
       - traefik.http.routers.jellyfin.entrypoints=web
-      - traefik.http.routers.jellyfin.middlewares=authelia-auth@docker
+      - traefik.http.routers.jellyfin.middlewares= # Ensure this remains empty for no auth
       - traefik.http.services.jellyfin.loadbalancer.server.port=8096
       - homepage.group=Media
       - homepage.name=Jellyfin
@@ -446,7 +446,7 @@ services:
       - traefik.http.middlewares.calibre-headers.headers.customRequestHeaders.X-Script-Name=/calibre
       - traefik.http.middlewares.calibre-stripprefixregex.stripPrefixRegex.regex=/calibre
       - traefik.http.routers.calibre.middlewares=calibre-headers,calibre-stripprefixregex,authelia-auth@docker
-      - traefik.http.routers.calibre.rule=PathPrefix(`/calibre`)
+      - traefik.http.routers.calibre.rule=Host(`${APP_HOSTNAME}`) && PathPrefix(`/calibre`) # Added Host check
       - traefik.http.routers.calibre.entrypoints=web
       - traefik.http.services.calibre.loadbalancer.server.port=8083
       - homepage.group=Media
@@ -519,15 +519,15 @@ services:
       [sh, -c, "cp -n /app/config/tpl/*.yaml /app/config && node server.js"]
     labels:
       - traefik.enable=true
-      - traefik.http.routers.homepage.rule=PathPrefix(`/home`)
+      - traefik.http.routers.homepage.rule=Host(`${APP_HOSTNAME}`) && PathPrefix(`/`) # Changed rule to root
       - traefik.http.routers.homepage.entrypoints=web
-      - traefik.http.routers.homepage.priority=10
-      - traefik.http.middlewares.homepage-stripprefix.stripPrefix.prefixes=/home
-      - traefik.http.routers.homepage.middlewares=homepage-stripprefix,authelia-auth@docker
+      # - traefik.http.routers.homepage.priority=10 # Removed priority
+      # - traefik.http.middlewares.homepage-stripprefix.stripPrefix.prefixes=/home # Removed stripPrefix middleware definition
+      - traefik.http.routers.homepage.middlewares=authelia-auth@docker # Removed stripPrefix middleware usage
       - homepage.group=Dashboard
       - homepage.name=Homepage
       - homepage.icon=homepage.png
-      - homepage.href=/home
+      - homepage.href=/ # Updated href
       - homepage.description=Service Dashboard
   watchtower:
     image: ghcr.io/containrrr/watchtower:latest

update-setup.sh

@@ -623,85 +623,69 @@ list_services() {
         return 1
     fi
     
-    # Show a warning if we're not creating a backup for this operation
     echo -e "${BLUE}Checking services in $COMPOSE_FILE...${NC}"
     echo -e "${CYAN}SERVICE\t\tAUTH STATUS${NC}"
     echo -e "${CYAN}-------\t\t-----------${NC}"
     
     local service_count=0
     
-    # Use yq if available for more reliable parsing
-    if command -v yq &> /dev/null; then
-        # Get all services from the docker-compose.yml file
-        local services=$(yq e '.services | keys | .[]' "$COMPOSE_FILE" 2>/dev/null)
+    # Get all router names from the labels
+    # This pattern is specific to how your docker-compose.yml format works
+    local router_lines=$(grep -n "traefik.http.routers" "$COMPOSE_FILE")
+    
+    # Process each router line to get service names
+    while IFS= read -r line; do
+        local line_num=$(echo "$line" | cut -d: -f1)
+        local router_config=$(echo "$line" | cut -d: -f2-)
+        
+        # Extract service name from router definition
+        if [[ "$router_config" =~ traefik\.http\.routers\.([^.]+) ]]; then
+            local service="${BASH_REMATCH[1]}"
             
-        for service in $services; do
             # Skip infrastructure containers
             if [[ "$service" == "redis" || "$service" == "authelia" || "$service" == "traefik" || "$service" == "tailscale" || "$service" == "watchtower" || "$service" == "autoheal" || "$service" == "middlewares" ]]; then
                 continue
             fi
             
-            # Check if this service has Traefik router configured
-            local has_router=$(yq e ".services.$service.labels[] | select(contains(\"traefik.http.routers.$service\"))" "$COMPOSE_FILE" 2>/dev/null)
-            if [ -n "$has_router" ]; then
-                local status=$(get_auth_status "$service")
-                
-                # Format the output with padding
-                printf "${BOLD}%-20s${NC}" "$service"
-                
-                case "$status" in
-                    "enabled")
-                        echo -e "${GREEN}Enabled${NC}"
-                        service_count=$((service_count + 1))
-                        ;;
-                    "disabled")
-                        echo -e "${YELLOW}Disabled${NC}"
-                        service_count=$((service_count + 1))
-                        ;;
-                    *)
-                        echo -e "${RED}Unknown${NC}"
-                        ;;
-                esac
-            fi
-        done
-    else
-        # Fallback to using grep for parsing (less reliable)
-        # First identify all container names
-        local services=$(grep "container_name:" "$COMPOSE_FILE" | awk '{print $3}')
-        
-        for service in $services; do
-            # Skip infrastructure containers
-            if [[ "$service" == "redis" || "$service" == "authelia" || "$service" == "traefik" || "$service" == "tailscale" || "$service" == "watchtower" || "$service" == "autoheal" || "$service" == "middlewares" ]]; then
+            # Skip duplicate entries - only handle each service once
+            if [[ "$processed_services" == *"$service"* ]]; then
                 continue
             fi
+            processed_services="$processed_services $service"
             
-            # Look specifically for router configuration for this service
-            if grep -q "traefik.http.routers.$service" "$COMPOSE_FILE"; then
-                local status=$(get_auth_status "$service")
-                
-                printf "${BOLD}%-20s${NC}" "$service"
-                
-                case "$status" in
-                    "enabled")
-                        echo -e "${GREEN}Enabled${NC}"
-                        service_count=$((service_count + 1))
-                        ;;
-                    "disabled")
-                        echo -e "${YELLOW}Disabled${NC}"
-                        service_count=$((service_count + 1))
-                        ;;
-                    *)
-                        echo -e "${RED}Unknown${NC}"
-                        ;;
-                esac
+            # Find if this router has a middlewares configuration, with or without authelia
+            local status="unknown"
+            # Look for middlewares for this service
+            if grep -q "traefik.http.routers.$service.middlewares=.*authelia-auth" "$COMPOSE_FILE"; then
+                status="enabled"
+            elif grep -q "traefik.http.routers.$service.middlewares=" "$COMPOSE_FILE"; then
+                # Has middlewares but no authelia-auth
+                if ! grep -q "traefik.http.routers.$service.middlewares=.*authelia-auth" "$COMPOSE_FILE"; then
+                    status="disabled"
+                fi
             fi
-        done
-    fi
+            
+            printf "${BOLD}%-20s${NC}" "$service"
+            
+            case "$status" in
+                "enabled")
+                    echo -e "${GREEN}Enabled${NC}"
+                    service_count=$((service_count + 1))
+                    ;;
+                "disabled")
+                    echo -e "${YELLOW}Disabled${NC}"
+                    service_count=$((service_count + 1))
+                    ;;
+                *)
+                    echo -e "${RED}Unknown${NC}"
+                    ;;
+            esac
+        fi
+    done <<< "$router_lines"
     
     if [ $service_count -eq 0 ]; then
         echo -e "${YELLOW}No services found with authentication status.${NC}"
-        echo -e "${YELLOW}This could indicate that no services are configured with Traefik routers,${NC}"
-        echo -e "${YELLOW}or that the compose file has an unexpected structure.${NC}"
+        echo -e "${YELLOW}This could indicate an issue with detecting middlewares in your docker-compose.yml.${NC}"
     fi
 }