Brand the Authelia login portal with the SUS 🤨 logo #94
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| # Bundled portal assets | ||
|
|
||
| - `logo.png` — "face with raised eyebrow" (U+1F928), from the | ||
| [Noto Emoji](https://github.com/googlefonts/noto-emoji) project, licensed | ||
| Apache-2.0. Used as the default Authelia login-portal logo. Operators can | ||
| override it via `auth.authelia.branding.logoPngBase64`. |
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| {{- if and .Values.auth.enabled .Values.auth.authelia.branding.enabled }} | ||
| # Authelia server-asset override mounted at server.asset_path (/config/assets): | ||
| # logo.png -> the login-portal logo (replaces Authelia's default icon) | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
| metadata: | ||
| name: {{ include "sus.authelia.fullname" . }}-assets | ||
| namespace: {{ .Values.namespaces.platform }} | ||
| labels: | ||
| {{- include "sus.labels" . | nindent 4 }} | ||
| app.kubernetes.io/component: authelia | ||
| binaryData: | ||
| logo.png: {{ .Values.auth.authelia.branding.logoPngBase64 | default (.Files.Get "assets/logo.png" | b64enc) }} | ||
| {{- end }} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -27,6 +27,9 @@ spec: | |
| # used — rotate/roll that yourself.) | ||
| checksum/authelia-config: {{ include (print $.Template.BasePath "/authelia/configmap.yaml") . | sha256sum }} | ||
| checksum/authelia-secret: {{ include (print $.Template.BasePath "/authelia/secret.yaml") . | sha256sum }} | ||
| {{- if .Values.auth.authelia.branding.enabled }} | ||
| checksum/authelia-assets: {{ include (print $.Template.BasePath "/authelia/assets-configmap.yaml") . | sha256sum }} | ||
| {{- end }} | ||
| spec: | ||
| containers: | ||
| - name: authelia | ||
|
|
@@ -76,10 +79,23 @@ spec: | |
| readOnly: true | ||
| - name: data | ||
| mountPath: /data | ||
| {{- if .Values.auth.authelia.branding.enabled }} | ||
| # subPath mount places the logo into the asset tree | ||
| # (server.asset_path = /config/assets) without shadowing the rest of it. | ||
| - name: assets | ||
| mountPath: /config/assets/logo.png | ||
| subPath: logo.png | ||
| readOnly: true | ||
| {{- end }} | ||
| volumes: | ||
| - name: config | ||
| configMap: | ||
| name: {{ include "sus.authelia.fullname" . }} | ||
| {{- if .Values.auth.authelia.branding.enabled }} | ||
| - name: assets | ||
| configMap: | ||
| name: {{ include "sus.authelia.fullname" . }}-assets | ||
| {{- end }} | ||
| - name: users | ||
| secret: | ||
| secretName: {{ $secretName }} | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -111,6 +111,16 @@ auth: | |
| # Pinned minor tag — Authelia's config schema is version-sensitive. | ||
| tag: "4.38" | ||
| pullPolicy: IfNotPresent | ||
| # -- Login-portal branding. Replaces Authelia's default icon with the SUS 🤨 | ||
| # logo by default; the rest of the portal (including the "Sign in" text) is | ||
| # left as Authelia ships it. | ||
| branding: | ||
| enabled: true | ||
| # Portal color scheme: light | dark | grey | auto. | ||
| theme: light | ||
|
Comment on lines
+117
to
+120
There was a problem hiding this comment. Minor wiring surprise: Also worth a one-line note that Authelia only accepts |
||
| # -- Override the bundled 🤨 logo with your own PNG (base64-encoded, e.g. | ||
| # `base64 -i logo.png`). Empty = use the bundled SUS logo. | ||
| logoPngBase64: "" | ||
| # Memory limit must accommodate argon2id password verification, which is | ||
| # memory-hard by design (default parameters use 64MiB per concurrent login) | ||
| # on top of Authelia's baseline — too low a limit OOM-kills the container | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
A line-wrapped
logoPngBase64breaks the render with an opaque error. The value is interpolated unquoted, so any newline in it corrupts the YAML. This is easy to hit because the guidance invalues.yamlisbase64 -i logo.png, and on GNU coreutils-iis--ignore-garbage(not "input file"), so encoding still wraps at 76 columns. Reproduced locally with a two-line value:The error points at the template, not at the operator's value, so it's a rough debugging experience.
Separately, if
assets/logo.pngever goes missing (or gets.helmignored),.Files.Getreturns""and this renderslogo.png:— a null value that applies cleanly and mounts a 0-bytelogo.png, i.e. a silently broken image on the login page rather than a loud failure.Both are covered by normalizing whitespace, quoting, and requiring a non-empty result:
Worth updating the
values.yamlhint tobase64 -w0 logo.pngtoo (orbase64 < logo.png | tr -d '\n'for portability across GNU/BSD).