refactor: make Authelia user management scalable

- Remove envsubst complexity for password hashes
- Keep users_database.yml only on server (not in git)
- Add users_database.yml to .gitignore
- Update users_database.template.yml with multi-user examples
- Configure Authelia to watch users_database.yml for changes
- Users can now be added/removed by editing the file on server
- Supports unlimited users without code changes

net/authelia/.gitignore

@@ -0,0 +1 @@
+net/authelia/users_database.yml

net/authelia/configuration.yml

@@ -42,6 +42,7 @@ authentication_backend:
   refresh_interval: 5m
   file:
     path: /etc/authelia/users_database.yml
+    watch: true
     password:
       algorithm: argon2
       argon2:

net/authelia/users_database.template.yml

@@ -0,0 +1,29 @@
+---
+###############################################################
+#                   Users Database Template                    #
+###############################################################
+
+# This is a template file - copy to users_database.yml and edit
+# The actual users_database.yml is not tracked in git for security
+
+# Generate password hashes using:
+# docker run --rm authelia/authelia:latest authelia crypto hash generate argon2 --password 'yourpassword'
+
+# List of users
+users:
+  # Example user - replace with actual users
+  valknar:
+    displayname: "Valknar"
+    password: "$argon2id$v=19$m=65536,t=3,p=4$REPLACE_WITH_ACTUAL_HASH"
+    email: valknar@pivoine.art
+    groups:
+      - admins
+      - dev
+
+  # Add more users as needed:
+  # username:
+  #   displayname: "Full Name"
+  #   password: "$argon2id$v=19$m=65536,t=3,p=4$HASH_HERE"
+  #   email: user@pivoine.art
+  #   groups:
+  #     - users

net/authelia/users_database.yml

@@ -1,16 +0,0 @@
----
-###############################################################
-#                         Users Database                       #
-###############################################################
-
-# This file can be used if you do not have an LDAP set up.
-
-# List of users
-users:
-  valknar:
-    displayname: "Valknar"
-    password: "$argon2id$v=19$m=65536,t=3,p=4$c2FsdHNhbHRzYWx0$4oCb4oCh4oCd4oCi4oCl4oCm"  # CHANGE THIS - use: docker run --rm authelia/authelia:latest authelia crypto hash generate argon2 --password 'yourpassword'
-    email: valknar@pivoine.art
-    groups:
-      - admins
-      - dev