refactor: use .env for Authelia password hash

- Rename users_database.yml to users_database.template.yml
- Use envsubst to substitute AUTHELIA_USER_PASSWORD_HASH from .env
- Update configuration.yml to use /config/users_database.yml
- Add AUTHELIA_USER_PASSWORD_HASH environment variable to compose
- Password hash now stored securely in .env instead of git

arty.yml

@@ -128,6 +128,7 @@ envs:
     # Authelia SSO
     NET_AUTHELIA_IMAGE: authelia/authelia:latest
     NET_AUTHELIA_TRAEFIK_HOST: auth.pivoine.art
+    AUTHELIA_USER_PASSWORD_HASH: ""  # Generated via: docker run --rm authelia/authelia:latest authelia crypto hash generate argon2 --password 'yourpassword'
     # AI Stack
     AI_TRAEFIK_ENABLED: true
     AI_COMPOSE_PROJECT_NAME: ai

net/authelia/configuration.yml

@@ -41,7 +41,7 @@ authentication_backend:
     disable: false
   refresh_interval: 5m
   file:
-    path: /etc/authelia/users_database.yml
+    path: /config/users_database.yml
     password:
       algorithm: argon2
       argon2:

net/authelia/users_database.template.yml

@@ -9,7 +9,7 @@
 users:
   valknar:
     displayname: "Valknar"
-    password: "$argon2id$v=19$m=65536,t=3,p=4$c2FsdHNhbHRzYWx0$4oCb4oCh4oCd4oCi4oCl4oCm"  # CHANGE THIS - use: docker run --rm authelia/authelia:latest authelia crypto hash generate argon2 --password 'yourpassword'
+    password: "${AUTHELIA_USER_PASSWORD_HASH}"
     email: valknar@pivoine.art
     groups:
       - admins

net/compose.yaml

@@ -275,9 +275,13 @@ services:
       AUTHELIA_JWT_SECRET: ${AUTHELIA_JWT_SECRET}
       AUTHELIA_SESSION_SECRET: ${AUTHELIA_SESSION_SECRET}
       AUTHELIA_STORAGE_ENCRYPTION_KEY: ${AUTHELIA_STORAGE_ENCRYPTION_KEY}
+      AUTHELIA_USER_PASSWORD_HASH: ${AUTHELIA_USER_PASSWORD_HASH}
     volumes:
       - authelia_config:/config
       - ./authelia:/etc/authelia:ro
+    command: >
+      sh -c "envsubst < /etc/authelia/users_database.template.yml > /config/users_database.yml &&
+             authelia --config /etc/authelia/configuration.yml"
     networks:
       - compose_network
     labels: