Issue when loading secrets: error loading secret into key 'session.secret': it's already defined in other configuration sources #7321
-
|
I cannot seem to load any secrets into the configuration file. I have all my secrets in Here is my docker-compose.yml: ---
networks:
proxy:
external: true
name: 'proxy'
services:
authelia:
container_name: 'authelia'
image: 'docker.io/authelia/authelia:latest'
restart: 'unless-stopped'
user: '994:992'
networks:
- proxy
expose:
- 9091
environment:
AUTHELIA_JWT_SECRET_FILE: '/secrets/JWT_SECRET'
AUTHELIA_SESSION_SECRET_FILE: '/secrets/SESSION_SECRET'
AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: '/secrets/STORAGE_ENCRYPTION_KEY'
AUTHELIA_DUO_API_INTEGRATION_KEY_FILE: '/secrets/DUO_API_INTEGRATION_KEY'
AUTHELIA_DUO_API_SECRET_KEY_FILE: '/secrets/DUO_API_SECRET_KEY'
TZ: 'America/New_York'
volumes:
- '/var/lib/authelia/config:/config'
- '/var/lib/authelia/secrets:/secrets:ro'
healthcheck:
test: ["CMD", "/app/healthcheck.sh"]
interval: 5m
timeout: 5sHere are the logs: |
Beta Was this translation helpful? Give feedback.
Replies: 3 comments 6 replies
-
|
Please note this response was created using generative AI leveraging previously available information from the repository. This information may be helpful however it is our strong recommendation that you carefully consider the information before blindly applying it. The issue you're encountering where secrets are reported as "already defined in other configuration sources" typically indicates that the same configuration keys are being defined in multiple places within your Authelia configuration. This can happen if the secrets are set both in the environment variables and directly in the configuration files, or if there are duplicate entries within the configuration itself. Here are a few steps to troubleshoot and resolve this issue:
If after these checks the issue persists, consider simplifying your configuration to the minimum necessary to run Authelia and incrementally add configurations to identify the problematic setting. For more detailed guidance, you can refer to the Authelia documentation on secrets management and configuration: This comment was generated by Glime. |
Beta Was this translation helpful? Give feedback.
-
|
That AI is actually surprisingly very coherent... I changed all the instances of |
Beta Was this translation helpful? Give feedback.
-
|
Show the contents of /var/lib/authelia/config/configuration.yml? |
Beta Was this translation helpful? Give feedback.
-
|
Actually the way you describe it you've configured it both in the secret env vars, and configured it in the configuration.yml, you can't do both. |
Beta Was this translation helpful? Give feedback.
-
|
I changed teh AUTHELIA_JWT_SECRET_FILE to AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE as suggested. ---
theme: "dark"
default_2fa_method: "mobile_push"
server:
address: "tcp://:9091/"
asset_path: "/config/assets/"
log:
level: "debug"
file_path: "/config/authelia.log"
keep_stdout: true
telemetry:
metrics:
enabled: false
address: "tcp://:9959/metrics"
buffers:
read: 4096
write: 4096
timeouts:
read: "6 seconds"
write: "6 seconds"
idle: "30 seconds"
totp:
disable: false
algorithm: "SHA1"
digits: 6
period: 30
skew: 1
secret_size: 32
allowed_algorithms:
- "SHA1"
allowed_digits:
- 6
allowed_periods:
- 30
disable_reuse_security_policy: false
duo_api:
disable: false
hostname: "api.duosecurity.com"
integration_key: AUTHELIA_DUO_API_INTEGRATION_KEY_FILE
secret_key: AUTHELIA_DUO_API_SECRET_KEY_FILE
enable_self_enrollment: false
identity_validation:
reset_password:
jwt_lifespan: "5 minutes"
jwt_algorithm: "HS256"
jwt_secret: AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE
elevated_session:
code_lifespan: "5 minutes"
elevation_lifespan: "10 minutes"
characters: 8
require_second_factor: true
skip_second_factor: true
authentication_backend:
password_reset:
disable: false
file:
path: "/config/users_database.yml"
watch: false
password:
algorithm: "argon2"
argon2:
variant: "argon2id"
iterations: 3
memory: 65536
parallelism: 4
key_length: 32
salt_length: 16
password_policy:
standard:
enabled: true
min_length: 8
max_length: 0
require_uppercase: true
require_lowercase: true
require_number: true
require_special: true
zxcvbn:
enabled: false
min_score: 3
privacy_policy:
enabled: false
require_user_acceptance: false
policy_url: ""
access_control:
default_policy: "deny"
rules:
- domain: "auth.mydomain.com"
policy: "bypass"
- domain: ["mydomain.com"]
policy: "one_factor"
- domain: ["portainer.mydomain.com", "nginx.mydomain.com"]
policy: "two_factor"
session:
secret: AUTHELIA_SESSION_SECRET_FILE
cookies:
- name: "authelia_session"
domain: "mydomain.com"
authelia_url: "https://auth.mydomain.com"
default_redirection_url: "https://mydomain.com"
inactivity: "5 minutes"
expiration: "1 hour"
remember_me: "1 month"
regulation:
max_retries: 3
find_time: "2 minutes"
ban_time: "5 minutes"
storage:
encryption_key: AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE
local:
path: "/config/db.sqlite3"
notifier:
disable_startup_check: false
filesystem:
filename: "/config/notification.txt" |
Beta Was this translation helpful? Give feedback.
-
|
Remove encryption key for example. Same applies to the other ones defined with a storage:
encryption_key: AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE |
Beta Was this translation helpful? Give feedback.
-
|
I mean the errors dissapeared but why? Where else would I be defining them? Or does setting the values to |
Beta Was this translation helpful? Give feedback.
-
|
You defined them in your docker compose, when using the env secrets detection you do must not define them in the config as well. This is to prevent confusion and prevent accidentally including them in the config as well. |
Beta Was this translation helpful? Give feedback.
-
|
I appreciate the clarification! I think the documentation on this isn't exactly clear. It doesn't really mention that Authelia loads these values automatically. I assumed that you had to set the env variables as the filepaths and then call them in the configuration file. |
Beta Was this translation helpful? Give feedback.
You defined them in your docker compose, when using the env secrets detection you do must not define them in the config as well. This is to prevent confusion and prevent accidentally including them in the config as well.