@lamalibre/create-lamaste 4.4.1 → 4.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/create-lamaste",
-  "version": "4.4.1",
+  "version": "4.6.0",
   "description": "One-command setup for secure reverse tunnels with a management dashboard",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -43,7 +43,7 @@
     "mtls"
   ],
   "dependencies": {
-    "@lamalibre/lamaste": "^4.4.1",
+    "@lamalibre/lamaste": "^4.6.0",
     "chalk": "^5.3.0",
     "execa": "^9.0.0",
     "listr2": "^8.0.0"

package/scripts/lamaste-priv

@@ -16,6 +16,14 @@
  *   nginx-site disable <name>          unlink <name> from sites-enabled
  *   nginx-site remove <name>           delete <name>, its link and its backup
  *   authelia-totp <username>           stdin: base32 secret
+ *   authelia-user purge-second-factors <username>
+ *                                      delete the user's TOTP configuration and
+ *                                      every WebAuthn credential from Authelia's
+ *                                      storage (nothing there is fine)
+ *   authelia-user has-oidc-identifier <username>
+ *                                      print `yes` when Authelia's storage holds an
+ *                                      OpenID Connect opaque identifier for the
+ *                                      username, `no` otherwise — nothing else
  *   self-update <version>              run create-lamaste@<version> detached
  *   hooks install <route> <sha256|none>  stdin: the plugin's approved relay hook
  *                                      module (none: shared hooks only); start its runner
@@ -243,6 +251,12 @@ const WEBROOT_RE = /^\/var\/www\/lamaste\/[A-Za-z0-9._/-]*$/;
 const HEADER_NAME_RE = /^[A-Za-z0-9-]{1,64}$/;
 const VARIABLE_RE = /^\$[A-Za-z_][A-Za-z0-9_]{0,63}$/;
 const URI_PATH_RE = /^\/[A-Za-z0-9._~/-]*$/;
+/** A named location (`location @previous`), the target of a try_files fallback. */
+const NAMED_LOCATION_RE = /^@[a-z][a-z0-9_]{0,31}$/;
+const TRY_FILES_ARG_RE = /^[A-Za-z0-9._/$=-]{1,256}$/;
+/** A `types` entry: a media type, then the extensions served with it. */
+const MEDIA_TYPE_RE = /^[a-z]+\/[a-z0-9.+-]{1,64}$/;
+const EXTENSION_RE = /^[a-z0-9]{1,16}$/;
 
 function hasDotDotSegment(p) {
   return p.split('/').some((seg) => seg === '..' || seg === '.');
@@ -309,18 +323,24 @@ const RULES = {
     error_page: { args: errorPageArgs },
     return: { args: argc(1, 2) },
     rewrite: { args: rewriteArgs },
+    // A host whose every location asks the same authorization (a plugin's
+    // web surface): a URI of this server, never a file.
+    auth_request: { args: (a) => a.length === 1 && (a[0] === 'off' || URI_PATH_RE.test(a[0])) },
     location: { block: 'location', args: locationArgs },
   },
   location: {
     location: { block: 'location', args: locationArgs },
     if: { block: 'if', args: argc(1, 5) },
+    // The content types of a plugin's web surface, named by the vhost
+    // rather than the host's mime.types (entries checked below).
+    types: { block: 'types', args: argc(0, 0) },
     internal: { args: argc(0, 0) },
     return: { args: argc(1, 2) },
     rewrite: { args: rewriteArgs },
     root: { args: (a) => a.length === 1 && webrootPath(a[0]) },
     alias: { args: (a) => a.length === 1 && webrootPath(a[0]) },
     index: { args: each(/^[A-Za-z0-9._-]{1,64}$/) },
-    try_files: { args: each(/^[A-Za-z0-9._/$=-]{1,256}$/) },
+    try_files: { args: tryFilesArgs },
     add_header: {
       args: (a) =>
         (a.length === 2 || (a.length === 3 && a[2] === 'always')) && HEADER_NAME_RE.test(a[0]),
@@ -378,8 +398,20 @@ function rewriteArgs(a) {
   );
 }
 
+/** Files to try under the location's root; the last may instead name a location. */
+function tryFilesArgs(a) {
+  if (a.length === 0) return false;
+  const last = a[a.length - 1];
+  return (
+    a.slice(0, -1).every((v) => TRY_FILES_ARG_RE.test(v)) &&
+    (TRY_FILES_ARG_RE.test(last) || NAMED_LOCATION_RE.test(last))
+  );
+}
+
 function locationArgs(a) {
-  if (a.length === 1) return a[0].length <= 512 && a[0].startsWith('/');
+  if (a.length === 1) {
+    return (a[0].length <= 512 && a[0].startsWith('/')) || NAMED_LOCATION_RE.test(a[0]);
+  }
   return a.length === 2 && ['=', '~', '~*', '^~'].includes(a[0]) && a[1].length <= 512;
 }
 
@@ -399,6 +431,14 @@ function validateDirectives(directives, context) {
       }
       continue;
     }
+    if (context === 'types') {
+      // types entries are "media/type ext...;" — no block, no include.
+      if (d.block !== null) throw new UsageError(`vhost line ${d.line}: block inside types`);
+      if (!MEDIA_TYPE_RE.test(d.name) || !each(EXTENSION_RE)(d.args)) {
+        throw new UsageError(`vhost line ${d.line}: malformed types entry`);
+      }
+      continue;
+    }
     const rule = rules[d.name];
     if (!rule) {
       throw new UsageError(
@@ -583,22 +623,25 @@ function lookupId(flag, name) {
   return id;
 }
 
+/** Same shape as the panel's username schema; a leading "-" would read as a flag. */
+const AUTHELIA_USERNAME_RE = /^[a-z0-9_][a-z0-9_-]{1,31}$/;
+
+function assertAutheliaUsername(username) {
+  if (typeof username !== 'string' || !AUTHELIA_USERNAME_RE.test(username)) {
+    throw new UsageError('invalid username');
+  }
+}
+
 /**
  * Store a TOTP secret in Authelia's database with Authelia's own CLI, run as
  * the Authelia service user (the database is its file).
  */
 function autheliaTotp(username) {
-  // Same shape as the panel's username schema; a leading "-" would read as a flag.
-  if (typeof username !== 'string' || !/^[a-z0-9_][a-z0-9_-]{1,31}$/.test(username)) {
-    throw new UsageError('invalid username');
-  }
+  assertAutheliaUsername(username);
   const secret = readStdin(1024).trim();
   if (!/^[A-Z2-7]{16,128}$/.test(secret)) throw new UsageError('invalid TOTP secret');
 
-  const uid = lookupId('-u', AUTHELIA_USER);
-  const gid = lookupId('-g', AUTHELIA_USER);
-  const result = spawnSync(
-    AUTHELIA_BIN,
+  const result = runAutheliaCli(
     [
       'storage',
       'user',
@@ -615,11 +658,35 @@ function autheliaTotp(username) {
       '6',
       '--period',
       '30',
-      '--config',
-      AUTHELIA_CONFIG,
-      '--',
-      username,
     ],
+    username,
+  );
+  if (result.status !== 0) {
+    // Authelia's error output does not echo the secret; its success output
+    // (a QR code / otpauth URI) does, so only failures are relayed.
+    throw new Error(
+      `authelia exited with status ${result.status}: ${(result.stderr || '').trim()}`,
+    );
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Authelia's per-user storage
+// ---------------------------------------------------------------------------
+
+/**
+ * Run `authelia <args> --config <config> [-- <username>]` as the Authelia
+ * service account, with the environment the service has (its storage
+ * encryption key comes from the configuration).
+ * Opening the database as root would leave root-owned journal files the
+ * service cannot write.
+ */
+function runAutheliaCli(args, username) {
+  const uid = lookupId('-u', AUTHELIA_USER);
+  const gid = lookupId('-g', AUTHELIA_USER);
+  const result = spawnSync(
+    AUTHELIA_BIN,
+    [...args, '--config', AUTHELIA_CONFIG, ...(username === undefined ? [] : ['--', username])],
     {
       uid,
       gid,
@@ -630,13 +697,156 @@ function autheliaTotp(username) {
     },
   );
   if (result.error) throw result.error;
-  if (result.status !== 0) {
-    // Authelia's error output does not echo the secret; its success output
-    // (a QR code / otpauth URI) does, so only failures are relayed.
+  return result;
+}
+
+/** Everything Authelia printed, to match a known refusal in. */
+function cliOutput(result) {
+  return `${result.stderr || ''}\n${result.stdout || ''}`;
+}
+
+/** Authelia's output with the username taken out: what this helper says may end up in a log. */
+function redacted(text, username) {
+  return String(text || '')
+    .trim()
+    .split(username)
+    .join('<username>');
+}
+
+/**
+ * Delete the user's TOTP configuration and every WebAuthn credential from
+ * Authelia's storage. Authelia 4.39 refuses to delete a TOTP configuration
+ * that does not exist (`no TOTP configuration for user`), which here means
+ * there is nothing to delete; deleting WebAuthn credentials by username
+ * succeeds whatever number there are.
+ */
+function autheliaPurgeSecondFactors(username) {
+  assertAutheliaUsername(username);
+  const totp = runAutheliaCli(['storage', 'user', 'totp', 'delete'], username);
+  if (totp.status !== 0 && !/no TOTP configuration for user/.test(cliOutput(totp))) {
     throw new Error(
-      `authelia exited with status ${result.status}: ${(result.stderr || '').trim()}`,
+      `authelia storage user totp delete exited with status ${totp.status}: ${redacted(totp.stderr, username)}`,
+    );
+  }
+  const webauthn = runAutheliaCli(['storage', 'user', 'webauthn', 'delete', '--all'], username);
+  if (webauthn.status !== 0) {
+    throw new Error(
+      `authelia storage user webauthn delete exited with status ${webauthn.status}: ${redacted(webauthn.stderr, username)}`,
+    );
+  }
+}
+
+/** A YAML scalar as yaml.v3 writes a username: plain, or quoted when it would read as another type. */
+function yamlScalar(text) {
+  const value = text.trim();
+  if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
+    try {
+      return JSON.parse(value);
+    } catch {
+      return null;
+    }
+  }
+  if (value.length >= 2 && value.startsWith("'") && value.endsWith("'")) {
+    return value.slice(1, -1).split("''").join("'");
+  }
+  return value;
+}
+
+/**
+ * Whether the YAML of `authelia storage user identifiers export` (a list of
+ * `{ service, sector_id, username, identifier }` under `identifiers`) names
+ * `username`.
+ */
+function exportNamesUsername(text, username) {
+  for (const line of String(text).split('\n')) {
+    const match = /^\s*(?:-\s+)?username:(.*)$/.exec(line);
+    if (match && yamlScalar(match[1]) === username) return true;
+  }
+  return false;
+}
+
+/** Overwrite a file with zeros, flush it, and remove it. */
+function shred(file) {
+  let fd = null;
+  try {
+    fd = fs.openSync(file, fs.constants.O_WRONLY | fs.constants.O_NOFOLLOW);
+    const { size } = fs.fstatSync(fd);
+    const zeros = Buffer.alloc(Math.min(size, 65536));
+    for (let written = 0; written < size; written += zeros.length) {
+      fs.writeSync(fd, zeros, 0, Math.min(zeros.length, size - written), written);
+    }
+    fs.fsyncSync(fd);
+  } catch (err) {
+    if (err.code !== 'ENOENT') throw err;
+  } finally {
+    if (fd !== null) fs.closeSync(fd);
+  }
+  unlinkIfPresent(file);
+}
+
+/** The largest export read back: well beyond any opaque identifier table Lamaste serves. */
+const MAX_IDENTIFIERS_EXPORT_BYTES = 32 * 1024 * 1024;
+
+/**
+ * Whether Authelia's storage holds an OpenID Connect opaque identifier for
+ * the username. Authelia's CLI has no lookup by username, so it exports the
+ * table (as the Authelia account) into a directory only that account and
+ * root can enter, on /run (memory, not disk); the file is read, checked,
+ * overwritten and removed, whatever happens. Prints `yes` or `no`.
+ */
+function autheliaHasOidcIdentifier(username) {
+  assertAutheliaUsername(username);
+  const uid = lookupId('-u', AUTHELIA_USER);
+  const gid = lookupId('-g', AUTHELIA_USER);
+  const dir = fs.mkdtempSync('/run/lamaste-priv-oidc-');
+  const file = path.join(dir, 'identifiers.yml');
+  try {
+    fs.chmodSync(dir, 0o700);
+    fs.chownSync(dir, uid, gid);
+    const result = runAutheliaCli(['storage', 'user', 'identifiers', 'export', '--file', file]);
+    if (result.status !== 0) {
+      // An empty table is not an export.
+      if (/no data to export/.test(cliOutput(result))) {
+        process.stdout.write('no\n');
+        return;
+      }
+      throw new Error(
+        `authelia storage user identifiers export exited with status ${result.status}: ${redacted(result.stderr, username)}`,
+      );
+    }
+    const st = fs.lstatSync(file);
+    if (!st.isFile() || st.uid !== uid)
+      throw new Error('the export is not the file Authelia wrote');
+    if (st.size > MAX_IDENTIFIERS_EXPORT_BYTES) throw new Error('the export is too large');
+    const named = exportNamesUsername(fs.readFileSync(file, 'utf8'), username);
+    process.stdout.write(named ? 'yes\n' : 'no\n');
+  } finally {
+    shred(file);
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+const AUTHELIA_USER_ACTIONS = new Set(['purge-second-factors', 'has-oidc-identifier']);
+
+/** `authelia-user <action> <username>`, checked before anything runs. */
+function parseAutheliaUserArgs(rest) {
+  if (rest.length !== 2) {
+    throw new UsageError(
+      'usage: authelia-user purge-second-factors|has-oidc-identifier <username>',
     );
   }
+  const [action, username] = rest;
+  if (!AUTHELIA_USER_ACTIONS.has(action)) {
+    throw new UsageError(`unknown authelia-user action: ${String(action).slice(0, 40)}`);
+  }
+  assertAutheliaUsername(username);
+  return { action, username };
+}
+
+function autheliaUser(rest) {
+  const { action, username } = parseAutheliaUserArgs(rest);
+  if (action === 'purge-second-factors') autheliaPurgeSecondFactors(username);
+  else autheliaHasOidcIdentifier(username);
 }
 
 /**
@@ -879,6 +1089,9 @@ function main(argv) {
       if (rest.length !== 1) throw new UsageError('usage: authelia-totp <username>');
       autheliaTotp(rest[0]);
       return;
+    case 'authelia-user':
+      autheliaUser(rest);
+      return;
     case 'self-update':
       if (rest.length !== 1) throw new UsageError('usage: self-update <version>');
       selfUpdate(rest[0]);
@@ -910,6 +1123,9 @@ if (require.main === module) {
     AUTHELIA_CLI_ENV,
     assertHookRoute,
     HOOK_ROUTE_RE,
+    assertAutheliaUsername,
+    parseAutheliaUserArgs,
+    exportNamesUsername,
     main,
   };
 }

package/src/index.js

@@ -148,6 +148,7 @@ ${b('2. Remove nginx configuration')}
   ${c('sudo rm /etc/nginx/sites-enabled/lamalibre-lamaste-*')}
   ${c('sudo rm /etc/nginx/sites-available/lamalibre-lamaste-*')}
   ${c('sudo rm /etc/nginx/snippets/lamalibre-lamaste-*')}
+  ${c('sudo rm /etc/nginx/conf.d/lamalibre-lamaste-*')}
   ${c('sudo nginx -t && sudo systemctl reload nginx')}
 
 ${b('3. Remove Lamaste directories and binaries')}

package/src/lib/backend-cookie.js

@@ -0,0 +1,65 @@
+import { execa } from 'execa';
+import { constants } from 'node:fs';
+import { mkdir, open, rm } from 'node:fs/promises';
+import path from 'node:path';
+import { BACKEND_COOKIE_MAP_FILE, renderBackendCookieMap } from '@lamalibre/lamaste';
+import { writeFileNoFollow } from './ownership.js';
+
+/**
+ * The http-level nginx map that keeps Authelia's session cookie from every
+ * tunnel and agent backend (core `renderBackendCookieMap`: the cookie name
+ * Authelia is configured with, stripped pair by pair, no `Cookie` header at
+ * all when one is left). Every vhost the panel renders for a tunnel or an
+ * agent panel sets `Cookie` from its variable, so nginx refuses those vhosts
+ * (`nginx -t`) while the map is missing: it is installed before the panel
+ * first writes one — on a fresh install with nginx's own configuration, on
+ * a redeploy before the panel restarts and re-renders the vhosts it finds.
+ */
+
+const OWNER = Object.freeze({ mode: 0o644, uid: 0, gid: 0 });
+
+/** The installed map's text, or null when there is none; never through a symlink. */
+async function readInstalled() {
+  let fh;
+  try {
+    fh = await open(BACKEND_COOKIE_MAP_FILE, constants.O_RDONLY | constants.O_NOFOLLOW);
+  } catch (err) {
+    if (err.code === 'ENOENT') return null;
+    throw err;
+  }
+  try {
+    return await fh.readFile('utf8');
+  } finally {
+    await fh.close();
+  }
+}
+
+/**
+ * Install or refresh the map as {@link BACKEND_COOKIE_MAP_FILE} — root-owned
+ * 0644, written atomically and never through a symlink — then test nginx
+ * and reload it. Idempotent. On a failed `nginx -t` the previous file (or
+ * its absence) is restored and the error thrown: without the map no tunnel
+ * vhost can be written, so the caller stops. Run as root.
+ *
+ * @param {{ reload?: boolean }} [options] - reload nginx afterwards (default true)
+ * @returns {Promise<{ changed: boolean }>}
+ */
+export async function ensureBackendCookieMap({ reload = true } = {}) {
+  const content = renderBackendCookieMap();
+  const previous = await readInstalled();
+  if (previous === content) return { changed: false };
+
+  await mkdir(path.dirname(BACKEND_COOKIE_MAP_FILE), { recursive: true, mode: 0o755 });
+  await writeFileNoFollow(BACKEND_COOKIE_MAP_FILE, content, OWNER);
+  try {
+    await execa('nginx', ['-t']);
+  } catch (err) {
+    if (previous === null) await rm(BACKEND_COOKIE_MAP_FILE, { force: true });
+    else await writeFileNoFollow(BACKEND_COOKIE_MAP_FILE, previous, OWNER);
+    throw new Error(
+      `nginx rejected the map that keeps Authelia's session cookie from tunnel backends; left as it was:\n${err.stderr || err.message}`,
+    );
+  }
+  if (reload) await execa('systemctl', ['reload', 'nginx']);
+  return { changed: true };
+}

package/src/lib/ip-panel-vhost.js

@@ -0,0 +1,208 @@
+import { execa } from 'execa';
+import { constants } from 'node:fs';
+import { open } from 'node:fs/promises';
+import { writeFileNoFollow } from './ownership.js';
+
+/** Site name of the IP-based panel vhost (`https://<ip>:9292`). */
+export const IP_PANEL_SITE = 'lamalibre-lamaste-panel-ip';
+
+const AVAILABLE = `/etc/nginx/sites-available/${IP_PANEL_SITE}`;
+
+/**
+ * Request headers every location proxying to the panel sets: a relay
+ * assertion reaches the panel only from a plugin's user surface on a tunnel
+ * vhost, set from Gatekeeper's answer — never one a client sent here.
+ */
+const ASSERTION_CLEARED = `
+        # A relay assertion comes only from Gatekeeper, on a plugin's user surface
+        proxy_set_header X-Lamalibre-Relay-Assertion "";`;
+
+/**
+ * The IP-based panel vhost: mTLS on 9292 with the self-signed certificate
+ * create-lamaste made for the relay's address. The panel disables it while
+ * its 2FA is on (`sites-enabled` link only). Pure.
+ *
+ * @param {string} pkiDir
+ * @returns {string}
+ */
+export function generateIpPanelVhost(pkiDir) {
+  return `# Rate limit zone for public enrollment endpoint (5 requests/minute per IP)
+limit_req_zone $binary_remote_addr zone=enroll:1m rate=5r/m;
+
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+server {
+    listen 9292 ssl;
+    server_name _;
+
+    ssl_certificate ${pkiDir}/self-signed.pem;
+    ssl_certificate_key ${pkiDir}/self-signed-key.pem;
+
+    include /etc/nginx/snippets/lamalibre-lamaste-mtls.conf;
+
+    # SSL settings
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+    ssl_prefer_server_ciphers on;
+
+    # Show certificate help page when client cert is missing or invalid
+    error_page 495 496 /cert-help.html;
+    location = /cert-help.html {
+        root /opt/lamalibre/lamaste/lamaste-server-ui;
+        internal;
+    }
+
+    # Proxy to serverd (mTLS required — reject if cert missing or invalid)
+    location / {
+        if ($ssl_client_verify != SUCCESS) {
+            return 496;
+        }
+        proxy_pass http://127.0.0.1:3100;
+
+        # Client cert headers — set from nginx TLS variables, never passed through from client
+        proxy_set_header X-SSL-Client-Verify $ssl_client_verify;
+        proxy_set_header X-SSL-Client-DN $ssl_client_s_dn;
+        proxy_set_header X-SSL-Client-Serial $ssl_client_serial;
+
+        # Strip Authelia identity headers — not trusted on mTLS vhost
+        proxy_set_header Remote-User "";
+        proxy_set_header Remote-Groups "";
+        proxy_set_header Remote-Name "";
+        proxy_set_header Remote-Email "";${ASSERTION_CLEARED}
+
+        # Standard proxy headers
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # Public API paths (no mTLS verification check).
+    # ssl_verify_client is 'optional' at server level, so TLS handshake
+    # succeeds without a cert. These locations skip the $ssl_client_verify
+    # check and clear cert headers so the backend sees no client identity.
+    location /api/enroll {
+        limit_req zone=enroll burst=5 nodelay;
+        proxy_pass http://127.0.0.1:3100;
+        proxy_http_version 1.1;
+
+        # Clear cert headers so the backend sees no client cert
+        proxy_set_header X-SSL-Client-Verify "";
+        proxy_set_header X-SSL-Client-DN "";
+        proxy_set_header X-SSL-Client-Serial "";
+
+        # Strip Authelia identity headers — not trusted on public endpoint
+        proxy_set_header Remote-User "";
+        proxy_set_header Remote-Groups "";
+        proxy_set_header Remote-Name "";
+        proxy_set_header Remote-Email "";${ASSERTION_CLEARED}
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location /api/invite {
+        proxy_pass http://127.0.0.1:3100;
+        proxy_http_version 1.1;
+
+        proxy_set_header X-SSL-Client-Verify "";
+        proxy_set_header X-SSL-Client-DN "";
+        proxy_set_header X-SSL-Client-Serial "";
+
+        # Strip Authelia identity headers — not trusted on public endpoint
+        proxy_set_header Remote-User "";
+        proxy_set_header Remote-Groups "";
+        proxy_set_header Remote-Name "";
+        proxy_set_header Remote-Email "";${ASSERTION_CLEARED}
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # API paths with WebSocket upgrade support (mTLS required)
+    location /api {
+        if ($ssl_client_verify != SUCCESS) {
+            return 496;
+        }
+        proxy_pass http://127.0.0.1:3100;
+        proxy_http_version 1.1;
+
+        # Client cert headers — set from nginx TLS variables, never passed through from client
+        proxy_set_header X-SSL-Client-Verify $ssl_client_verify;
+        proxy_set_header X-SSL-Client-DN $ssl_client_s_dn;
+        proxy_set_header X-SSL-Client-Serial $ssl_client_serial;
+
+        # Strip Authelia identity headers — not trusted on mTLS vhost
+        proxy_set_header Remote-User "";
+        proxy_set_header Remote-Groups "";
+        proxy_set_header Remote-Name "";
+        proxy_set_header Remote-Email "";${ASSERTION_CLEARED}
+
+        # Standard proxy headers
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # WebSocket: only upgrade when client requests it
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+    }
+}
+`;
+}
+
+/** The installed vhost's text, or null when there is none; never through a symlink. */
+async function readInstalled() {
+  let fh;
+  try {
+    fh = await open(AVAILABLE, constants.O_RDONLY | constants.O_NOFOLLOW);
+  } catch (err) {
+    if (err.code === 'ENOENT') return null;
+    throw err;
+  }
+  try {
+    return await fh.readFile('utf8');
+  } finally {
+    await fh.close();
+  }
+}
+
+/**
+ * Bring an installed IP-based panel vhost in line with what
+ * {@link generateIpPanelVhost} renders now — the redeploy path; a fresh
+ * install writes it itself. Only its text changes: its `sites-enabled` link
+ * (the panel's 2FA unlinks it) stays as it is, and a relay without the vhost
+ * gets none. Written atomically as root, never through a symlink; on a
+ * failed `nginx -t` the previous text is restored and the error thrown.
+ * Run as root.
+ *
+ * @param {string} pkiDir
+ * @param {{ reload?: boolean }} [options] - reload nginx afterwards (default true)
+ * @returns {Promise<{ changed: boolean }>}
+ */
+export async function refreshIpPanelVhost(pkiDir, { reload = true } = {}) {
+  const previous = await readInstalled();
+  const content = generateIpPanelVhost(pkiDir);
+  if (previous === null || previous === content) return { changed: false };
+
+  const owner = { mode: 0o644, uid: 0, gid: 0 };
+  await writeFileNoFollow(AVAILABLE, content, owner);
+  try {
+    await execa('nginx', ['-t']);
+  } catch (err) {
+    await writeFileNoFollow(AVAILABLE, previous, owner);
+    throw new Error(
+      `nginx rejected the refreshed IP panel vhost; left as it was:\n${err.stderr || err.message}`,
+    );
+  }
+  if (reload) await execa('systemctl', ['reload', 'nginx']);
+  return { changed: true };
+}

package/src/lib/service-config.js

@@ -111,8 +111,10 @@ lamaste ALL=(root) NOPASSWD: /usr/sbin/nginx -t
 # --- root-owned programs that validate their own arguments ---
 # lamaste-priv: install/enable/remove the panel's nginx vhosts (every directive
 # checked against an allow-list — nginx opens the files a vhost names as
-# root), store a TOTP secret with Authelia's CLI as the Authelia user, and
-# start a self-update (create-lamaste@<version>) in a transient unit.
+# root); with Authelia's CLI as the Authelia user, store a TOTP secret, delete
+# a user's second factors and check for a user's OIDC opaque identifier
+# (usernames validated); and start a self-update (create-lamaste@<version>)
+# in a transient unit.
 lamaste ALL=(root) NOPASSWD: /usr/local/sbin/lamaste-priv
 # Let's Encrypt: certbot and openssl with fixed flags, hostnames and email
 # validated. See scripts/lamaste-certbot, scripts/lamaste-cert-info.
@@ -203,7 +205,7 @@ export const AUTHELIA_OIDC_KEY_PATH = `${AUTHELIA_CONFIG_DIR}/oidc-issuer.pem`;
  * Authelia's configuration is rendered as a Go template: that is how it
  * reads the OIDC issuer key (`{{ secret "…" }}`) without the panel, which
  * writes the configuration, ever holding the key. Set on the unit and on
- * every `authelia` CLI invocation (lamaste-priv authelia-totp).
+ * every `authelia` CLI invocation (lamaste-priv authelia-totp, authelia-user).
  */
 export const AUTHELIA_CONFIG_FILTERS_ENV = 'X_AUTHELIA_CONFIG_FILTERS=template';
 export const AUTHELIA_LOG_DIR = '/var/log/authelia';