Resolve merge conflicts and restore local configuration

- Keep local DuckDNS subdomain and token customizations
- Preserve user-specific Authelia configuration
- Maintain local docker-compose customizations

docker-compose/core/authelia/configuration.yml

@@ -1,6 +1,6 @@
-# Authelia Configuration Template
+# Authelia Configuration
 # Copy to /opt/stacks/authelia/configuration.yml
-# IMPORTANT: Replace environment variable placeholders with your actual values
+# IMPORTANT: Replace 'kelinreij.duckdns.org' with your actual DuckDNS domain
 
 server:
   host: 0.0.0.0
@@ -11,12 +11,12 @@ log:
 
 theme: dark
 
-jwt_secret: ${AUTHELIA_JWT_SECRET}
+jwt_secret: generate-with-openssl-rand-hex-64
 
-default_redirection_url: https://auth.${DOMAIN}
+default_redirection_url: https://auth.kelinreij.duckdns.org
 
 totp:
-  issuer: ${DOMAIN}
+  issuer: kelinreij.duckdns.org
   period: 30
   skew: 1
 
@@ -35,41 +35,41 @@ access_control:
   default_policy: deny
   
   rules:
-    # Bypass Authelia for media services (allow app access)
-    - domain: jellyfin.${DOMAIN}
+    # Bypass Authelia for Jellyfin (allow app access)
+    - domain: jellyfin.kelinreij.duckdns.org
       policy: bypass
     
     # Bypass for Plex (allow app access)
-    - domain: plex.${DOMAIN}
+    - domain: plex.kelinreij.duckdns.org
       policy: bypass
     
     # Bypass for Home Assistant (has its own auth)
-    - domain: ha.${DOMAIN}
+    - domain: ha.kelinreij.duckdns.org
       policy: bypass
     
     # Bypass for development services (they have their own auth or setup)
-    - domain: pgadmin.${DOMAIN}
+    - domain: pgadmin.kelinreij.duckdns.org
       policy: bypass
-    - domain: gitlab.${DOMAIN}
+    - domain: gitlab.kelinreij.duckdns.org
       policy: bypass
     
     # Protected: All other services require authentication
-    - domain: "*.${DOMAIN}"
+    - domain: "*.kelinreij.duckdns.org"
       policy: one_factor
     
     # Two-factor for admin services (optional)
     # - domain:
-    #     - "admin.${DOMAIN}"
-    #     - "portainer.${DOMAIN}"
+    #     - "admin.kelinreij.duckdns.org"
+    #     - "portainer.kelinreij.duckdns.org"
     #   policy: two_factor
 
 session:
   name: authelia_session
-  secret: ${AUTHELIA_SESSION_SECRET}
+  secret: generate-with-openssl-rand-hex-64
   expiration: 24h      # Session expires after 24 hours
   inactivity: 24h      # Session expires after 24 hours of inactivity
   remember_me_duration: 1M
-  domain: ${DOMAIN}
+  domain: kelinreij.duckdns.org
 
 regulation:
   max_retries: 3
@@ -77,7 +77,7 @@ regulation:
   ban_time: 5m
 
 storage:
-  encryption_key: ${AUTHELIA_STORAGE_ENCRYPTION_KEY}
+  encryption_key: generate-with-openssl-rand-hex-64
   local:
     path: /data/db.sqlite3
 

docker-compose/core/authelia/users_database.yml

@@ -1,14 +1,12 @@
 ###############################################################
 #                         Users Database                      #
 ###############################################################
-# Template - Replace with your actual user information
-# Generate password hash with: docker run authelia/authelia:latest authelia crypto hash generate pbkdf2 --password 'yourpassword'
 
 users:
-  admin:  # Change this username
-    displayname: "Administrator"
-    password: "GENERATE_NEW_PASSWORD_HASH"  # Replace with actual hash
-    email: your-email@example.com  # Replace with your email
+  kelin:
+    displayname: "Admin User"
+    password: "$argon2id$v=19$m=65536,t=3,p=4$a+3pIrywP/li9wy9J6UkMA$+3THyJiAnS/gNYnLaYtlsRCaYfgnnxsUyGZ4D3xGnUg"
+    email: kelinshomelab@gmail.com
     groups:
       - admins
       - users

docker-compose/core/docker-compose.yml

@@ -18,8 +18,8 @@ services:
       - PUID=1000
       - PGID=1000
       - TZ=America/New_York
-      - SUBDOMAINS=${DUCKDNS_SUBDOMAINS}
-      - TOKEN=${DUCKDNS_TOKEN}
+      - SUBDOMAINS=kelinreij
+      - TOKEN=41ef7faa-fc93-41d2-a32f-340fd2b75b2f
     volumes:
       - ./duckdns/config:/config
     networks:
@@ -27,14 +27,12 @@ services:
   
   traefik:
     # Reverse proxy and SSL termination - core routing service, must always run
-    # CONFIGURATION REQUIREMENT: traefik.yml MUST be in ./traefik/config/ directory
-    # VOLUME MOUNT: ./traefik/config:/config - config file location is critical
     image: traefik:v3
     container_name: traefik
     restart: unless-stopped
     command: ["--configFile=/config/traefik.yml"]
     environment:
-      - DUCKDNS_TOKEN=${DUCKDNS_TOKEN}
+      - DUCKDNS_TOKEN=41ef7faa-fc93-41d2-a32f-340fd2b75b2f
     ports:
       - 80:80
       - 443:443
@@ -56,7 +54,7 @@ services:
       # If Traefik is on a remote server: these labels are NOT USED; 
       #   configure external yml files in /traefik/dynamic folder instead.
       - "traefik.enable=true"
-      - "traefik.http.routers.traefik.rule=Host(`traefik.${DOMAIN}`)"
+      - "traefik.http.routers.traefik.rule=Host(`traefik.kelinreij.duckdns.org`)"
       - "traefik.http.routers.traefik.entrypoints=websecure"
       - "traefik.http.routers.traefik.tls.certresolver=letsencrypt"
       - "traefik.http.routers.traefik.middlewares=authelia@docker"
@@ -64,10 +62,7 @@ services:
 
   authelia:
     # Single sign-on authentication service - must always run for user authentication
-    # VERSION PINNING: Pinned to v4.37.5 due to breaking changes in v4.39.15+
-    # BREAKING CHANGES: v4.39.15+ has incompatible configuration and database changes
-    # UPGRADE NOTES: Test in separate environment before upgrading. Backup config and DB.
-    image: authelia/authelia:4.37.5
+    image: authelia/authelia:latest
     container_name: authelia
     restart: unless-stopped
     environment:
@@ -91,13 +86,13 @@ services:
       # If Traefik is on a remote server: these labels are NOT USED; 
       #   configure external yml files in /traefik/dynamic folder instead.
       - "traefik.enable=true"
-      - "traefik.http.routers.authelia.rule=Host(`auth.${DOMAIN}`)"
+      - "traefik.http.routers.authelia.rule=Host(`auth.kelinreij.duckdns.org`)"
       - "traefik.http.routers.authelia.entrypoints=websecure"
       - "traefik.http.routers.authelia.tls.certresolver=letsencrypt"
       - "traefik.http.routers.authelia.service=authelia"
       - "traefik.http.services.authelia.loadbalancer.server.port=9091"
       # Authelia forward auth middleware configuration
-      - "traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.${DOMAIN}/"
+      - "traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.kelinreij.duckdns.org/"
       - "traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=X-Secret"
       - "traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true"
 
@@ -120,12 +115,11 @@ services:
       - SABLIER_DOCKER_API_VERSION=1.51
       - SABLIER_DOCKER_NETWORK=traefik-network
       - SABLIER_LOG_LEVEL=debug
-      - DOCKER_HOST=unix:///var/run/docker.sock
-      - DOCKER_TLS_VERIFY=0
+      - DOCKER_HOST=tcp://192.168.4.11:2376
+      - DOCKER_TLS_VERIFY=1
       - DOCKER_CERT_PATH=/certs
     volumes:
       - ./shared-ca:/certs:ro
-      - /var/run/docker.sock:/var/run/docker.sock:ro
     ports:
       - 10000:10000
     labels:
@@ -139,7 +133,7 @@ networks:
 
 x-dockge:
   urls:
-    - https://auth.${DOMAIN}
-    - http://${SERVER_IP}:9091
-    - https://traefik.${DOMAIN}
-    - http://${SERVER_IP}:8080
+    - https://auth.kelinreij.duckdns.org
+    - http://192.168.4.11:9091
+    - https://traefik.kelinreij.duckdns.org
+    - http://192.168.4.11:8080

scripts/enhanced-setup/validate.sh

@@ -15,16 +15,13 @@ source "$(dirname "${BASH_SOURCE[0]}")/lib/ui.sh"
 
 # Validate .env file
 validate_env_file() {
-    echo "DEBUG: Starting validate_env_file"
     local env_file="$EZ_HOME/.env"
-    echo "DEBUG: env_file = $env_file"
 
     if [[ ! -f "$env_file" ]]; then
-        echo "DEBUG: .env file not found"
+        print_error ".env file not found at $env_file"
         return 1
     fi
 
-    echo "DEBUG: .env file exists"
     return 0
 }