@lamalibre/create-lamaste 4.5.0 → 4.7.0

package/vendor/serverd/src/routes/management/tunnels.js

@@ -22,16 +22,20 @@ import {
   updateTunnel,
   TUNNEL_MAX_BODY_MB,
   grantedTunnelsFor,
+  hostnameHolder,
   TunnelError,
 } from '@lamalibre/lamaste/server';
 import {
   AGENT_LABEL_REGEX,
+  DomainNameSchema,
   INTERNAL_PLUGIN_PORT_RANGE,
   PLUGIN_AGENT_CN_PREFIX,
   RESERVED_TUNNEL_PORTS,
   isInternalPluginPort,
 } from '@lamalibre/lamaste';
 import { getConfig } from '../../lib/config.js';
+import { primaryDomainName, resolveActiveDomain } from '../../lib/domains.js';
+import { sendFailure } from '../../lib/app-error.js';
 import { readTunnels, readSites } from '../../lib/state.js';
 import { getAgentHostFactsHash, loadAgentRegistry } from '../../lib/mtls.js';
 import { getChiselCredentialIssuedAt } from '../../lib/chisel-users.js';
@@ -147,6 +151,9 @@ const CreateTunnelSchema = z
     agentLabel: AgentLabelSchema.optional(),
     accessMode: AccessModeSchema.optional().default('restricted'),
     maxBodySizeMb: MaxBodySizeSchema.optional(),
+    // The base domain the hostname is under (an active one; the primary
+    // when absent). An agent panel is always on the primary.
+    domain: DomainNameSchema.optional(),
   })
   .refine((d) => d.type !== 'plugin' || (d.pluginName && d.agentLabel), {
     message: 'pluginName and agentLabel are required for plugin tunnels',
@@ -220,10 +227,15 @@ function maxBodyCeiling(request) {
   return request.certRole === 'admin' ? TUNNEL_MAX_BODY_MB.max : TUNNEL_MAX_BODY_MB.agentMax;
 }
 
-/** A static site (or one of its aliases) that already answers on `fqdn`. */
+/**
+ * Core `createTunnel`'s `hostTaken`: the static site (or one of its
+ * aliases) that already answers on `fqdn` — two vhosts with one
+ * server_name make nginx pick silently. Asked under the tunnel lock, which
+ * every workflow giving a site a hostname holds too.
+ */
 async function siteServing(fqdn) {
-  const sites = await readSites();
-  return sites.find((s) => s.fqdn === fqdn || (s.aliases ?? []).includes(fqdn)) ?? null;
+  const holder = hostnameHolder(fqdn, { sites: await readSites() });
+  return holder ? `by a static site ('${holder.name}')` : null;
 }
 
 /**
@@ -336,6 +348,7 @@ export default async function tunnelRoutes(fastify, _opts) {
           tunnels: carried.map((t) => ({
             port: t.port,
             subdomain: t.subdomain,
+            fqdn: t.fqdn,
           })),
           // The agent-hosted plugins this agent hosts: the agent fetches a
           // plugin's config when it does not hold the secret issued at
@@ -495,15 +508,16 @@ export default async function tunnelRoutes(fastify, _opts) {
           error: 'Domain and email must be configured before creating tunnels',
         });
       }
-
-      // A static site (or one of its aliases) may already answer on this
-      // hostname; two vhosts with one server_name make nginx pick silently.
-      const fqdn = `${subdomain}.${config.domain}`;
-      if (await siteServing(fqdn)) {
-        return reply.code(400).send({
-          error: 'Failed to create tunnel',
-          details: `Domain '${fqdn}' is already served by a static site`,
-        });
+      let domain;
+      try {
+        domain = await resolveActiveDomain(body.domain);
+      } catch (err) {
+        return sendFailure(request, reply, err, 'Failed to read the domains');
+      }
+      if (type === 'panel' && domain !== (await primaryDomainName())) {
+        return reply
+          .code(400)
+          .send({ error: 'An agent panel is served on the primary domain only' });
       }
 
       try {
@@ -516,17 +530,25 @@ export default async function tunnelRoutes(fastify, _opts) {
           pluginName,
           agentLabel,
           maxBodySizeMb,
-          domain: config.domain,
+          domain,
+          // Under the tunnel lock: the domain may have been removed since.
+          assertDomainActive: async (d) => {
+            await resolveActiveDomain(d);
+          },
           email: config.email,
           nginx: nginxDeps,
           certbot: certbotDeps,
           chisel: chiselDeps,
           state: stateDeps,
           agents: agentDeps,
+          hostTaken: siteServing,
           logger: request.log,
         });
         return reply.code(201).send({ ok: true, tunnel });
       } catch (err) {
+        if (Number.isInteger(err.statusCode)) {
+          return sendFailure(request, reply, err, 'Failed to create tunnel');
+        }
         if (err instanceof TunnelError) {
           const status = tunnelErrorStatus(err.code);
           return reply.code(status).send({
@@ -592,7 +614,6 @@ export default async function tunnelRoutes(fastify, _opts) {
           agentLabel: body.agentLabel,
           accessMode: body.accessMode,
           maxBodySizeMb: body.maxBodySizeMb,
-          domain: config.domain,
           email: config.email,
           nginx: nginxDeps,
           certbot: certbotDeps,
@@ -600,6 +621,7 @@ export default async function tunnelRoutes(fastify, _opts) {
           state: stateDeps,
           agents: agentDeps,
           userSurface: userSurfaceDeps,
+          hostTaken: siteServing,
           logger: request.log,
           authorize: authorizeFor(request, 'change'),
         });
@@ -748,14 +770,6 @@ export default async function tunnelRoutes(fastify, _opts) {
         });
       }
 
-      const fqdn = `${subdomain}.${config.domain}`;
-      if (await siteServing(fqdn)) {
-        return reply.code(400).send({
-          error: 'Failed to expose agent panel',
-          details: `Domain '${fqdn}' is already served by a static site`,
-        });
-      }
-
       // Check if a panel tunnel already exists for this agent
       const existing = await readTunnels();
       const existingPanel = existing.find((t) => t.type === 'panel' && t.subdomain === subdomain);
@@ -780,6 +794,7 @@ export default async function tunnelRoutes(fastify, _opts) {
           chisel: chiselDeps,
           state: stateDeps,
           agents: agentDeps,
+          hostTaken: siteServing,
           logger: request.log,
         });
         return reply.code(201).send({ ok: true, tunnel });

package/vendor/serverd/src/routes/management/users.js

@@ -1,5 +1,10 @@
 import { z } from 'zod';
-import { USERNAME_MAX_LENGTH, USERNAME_MIN_LENGTH, USERNAME_REGEX } from '@lamalibre/lamaste';
+import {
+  USERNAME_MAX_LENGTH,
+  USERNAME_MIN_LENGTH,
+  USERNAME_REGEX,
+  isLamasteOwnedGroup,
+} from '@lamalibre/lamaste';
 import {
   readUsers,
   readUsersRaw,
@@ -9,7 +14,7 @@ import {
   writeTotpToDatabase,
 } from '../../lib/authelia.js';
 import { revokeUserRegistryTokens } from '../../lib/registry-credential.js';
-import { httpError } from '../../lib/app-error.js';
+import { httpError, sendFailure } from '../../lib/app-error.js';
 import { actorFromRequest } from '../../lib/actor.js';
 import { recordAuditBestEffort } from '../../lib/audit.js';
 import {
@@ -21,6 +26,19 @@ import {
   getDirectoryUser,
   usersFileError,
 } from '../../lib/directory.js';
+import {
+  MembershipInputSchema,
+  adminGroups,
+  adminGroupsOf,
+  assertAssignableGroups,
+  domainNames,
+  domainsByUser,
+  domainsForNewUser,
+  domainsOfUser,
+  externalMemberGroupsError,
+  normalizeMemberships,
+  setUserDomains,
+} from '../../lib/domains.js';
 
 const CreateUserSchema = z.object({
   username: z
@@ -34,7 +52,11 @@ const CreateUserSchema = z.object({
   displayname: z.string().min(1).max(100),
   email: z.string().email(),
   password: z.string().min(8).max(128),
-  groups: z.array(z.string()).optional().default([]),
+  groups: z.array(z.string()).max(100).optional().default([]),
+  // The domains the user is a member of — a name (a member) or
+  // `{ name, kind }` — required while the relay has two or more; with one,
+  // the user becomes its member.
+  domains: z.array(MembershipInputSchema).max(50).optional(),
 });
 
 const UsernameParamSchema = z.object({
@@ -50,10 +72,14 @@ const UpdateUserSchema = z
     displayname: z.string().min(1).max(100).optional(),
     email: z.string().email().optional(),
     password: z.string().min(8).max(128).optional(),
-    groups: z.array(z.string()).optional(),
+    groups: z.array(z.string()).max(100).optional(),
     // Authelia's `disabled: true`: the user cannot sign in, every plugin
     // audience shows them disabled, and the user surface refuses them.
     disabled: z.boolean().optional(),
+    // The domains the user is a member of afterwards — exactly these (the
+    // difference applied in one transaction, each membership audited): a
+    // name (a member) or `{ name, kind }`.
+    domains: z.array(MembershipInputSchema).max(50).optional(),
   })
   .refine((data) => Object.keys(data).length > 0, {
     message: 'At least one field must be provided',
@@ -76,17 +102,28 @@ async function readUsersOrFail() {
   }
 }
 
-async function writeUsersOrFail(usersData) {
+async function writeUsersOrFail(usersData, opts) {
   try {
-    await writeUsers(usersData);
+    await writeUsers(usersData, opts);
   } catch (err) {
     throw httpError('Failed to update user database', 500, { cause: err });
   }
 }
 
-/** The user's groups as a sorted list (users.yml may hold none). */
-function groupsOf(entry) {
-  return Array.isArray(entry?.groups) ? [...entry.groups].sort() : [];
+/**
+ * The groups an administrator gave a user as a sorted list — the groups
+ * Lamaste owns left out (users.yml may hold none). `domains`: every domain
+ * record.
+ */
+function groupsOf(entry, domains) {
+  return adminGroups(entry?.groups, domains).sort();
+}
+
+/** The groups Lamaste owns that a users.yml entry holds — kept by every edit. */
+function ownedGroupsOf(entry, domains) {
+  return Array.isArray(entry?.groups)
+    ? entry.groups.filter((g) => isLamasteOwnedGroup(g, domains))
+    : [];
 }
 
 /** Whether two lists hold the same strings. */
@@ -101,22 +138,6 @@ function isEnabledAdmin(entry) {
   );
 }
 
-/**
- * Answer a refusal a users change threw (an error with `statusCode`: its
- * message and `code`), or a 500 for anything else — logged either way when
- * it is the panel's own failure.
- */
-function sendFailure(request, reply, err, fallback) {
-  if (Number.isInteger(err.statusCode)) {
-    if (err.statusCode >= 500) request.log.error(err.cause ?? err, err.message);
-    return reply
-      .code(err.statusCode)
-      .send({ error: err.message, ...(err.code ? { code: err.code } : {}) });
-  }
-  request.log.error(err, fallback);
-  return reply.code(500).send({ error: fallback });
-}
-
 export default async function usersRoutes(fastify, _opts) {
   // GET /api/users — list all users (no sensitive fields): users.yml's, with
   // each one's directory id (null until the directory has seen them, within
@@ -130,13 +151,17 @@ export default async function usersRoutes(fastify, _opts) {
       try {
         const users = await readUsers();
         const directory = await directoryUsersByUsername();
+        const memberships = await domainsByUser();
+        const domains = await domainNames();
         const listed = users
           .map((user) => {
             const known = directory.get(user.username);
             return {
               ...user,
+              groups: groupsOf(user, domains),
               userId: known?.userId ?? null,
               status: known?.status ?? (user.disabled ? 'disabled' : 'active'),
+              domains: (known && memberships.get(known.userId)) ?? [],
             };
           })
           .sort((a, b) => a.username.localeCompare(b.username));
@@ -160,6 +185,17 @@ export default async function usersRoutes(fastify, _opts) {
     async (request, reply) => {
       const body = CreateUserSchema.parse(request.body);
 
+      let domains;
+      try {
+        assertAssignableGroups(body.groups);
+        domains = await domainsForNewUser(body.domains, { required: true });
+        if (body.groups.length > 0 && domains.some((m) => m.kind === 'external')) {
+          throw externalMemberGroupsError(400);
+        }
+      } catch (err) {
+        return sendFailure(request, reply, err, 'Failed to read the domains');
+      }
+
       try {
         // Refused before a password is hashed; checked again under the lock.
         if ((await readUsersOrFail()).users[body.username]) {
@@ -198,6 +234,7 @@ export default async function usersRoutes(fastify, _opts) {
             // A removed user's grants, groups and second factors under the
             // username go first; a username with an OIDC identity is refused.
             creates: [body.username],
+            domains: { [body.username]: domains },
             expect: (users) => users[body.username]?.password === hash,
           },
         ));
@@ -217,6 +254,7 @@ export default async function usersRoutes(fastify, _opts) {
           disabled: false,
           userId: created?.userId ?? null,
           status: 'active',
+          domains: created ? await domainsOfUser(created.userId) : [],
         },
         ...(warnings.length > 0 ? { warnings } : {}),
       });
@@ -248,68 +286,149 @@ export default async function usersRoutes(fastify, _opts) {
         }
       }
 
+      const domains = await domainNames();
+
       /** Whether users.yml's entry holds every field this request set. */
       const intended = (entry) =>
         entry !== undefined &&
         entry !== null &&
         (body.displayname === undefined || entry.displayname === body.displayname) &&
         (body.email === undefined || entry.email === body.email) &&
-        (body.groups === undefined || sameList(groupsOf(entry), [...body.groups].sort())) &&
+        (body.groups === undefined ||
+          sameList(groupsOf(entry, domains), [...body.groups].sort())) &&
         (passwordHash === undefined || entry.password === passwordHash) &&
         (body.disabled === undefined || (entry.disabled === true) === body.disabled);
 
+      const { domains: memberOf, ...fields } = body;
+      const memberships = memberOf === undefined ? undefined : normalizeMemberships(memberOf);
+      const known = await findDirectoryUser(username);
+      const userId = known?.userId ?? null;
+      if (memberships !== undefined && !userId) {
+        return reply.code(409).send({
+          error: 'The directory has not seen this user yet — try again within a minute',
+          code: 'user_not_in_directory',
+        });
+      }
+      const current = userId ? await domainsOfUser(userId) : [];
+      const external = (memberships ?? current).some((m) => m.kind === 'external');
+      // Refused before anything is written: groups kept or given to a user
+      // who is (or becomes) an external member. Checked again under the
+      // users lock, by each step.
+      if (external) {
+        let groups = body.groups;
+        if (groups === undefined) {
+          try {
+            groups = await adminGroupsOf(username);
+          } catch (err) {
+            return sendFailure(request, reply, err, 'Failed to read user database');
+          }
+        }
+        if (groups.length > 0) {
+          return sendFailure(request, reply, externalMemberGroupsError(409), 'Refused');
+        }
+      }
+      // A user leaving every external membership with groups given in the
+      // same request: the memberships first, then the groups (each step is
+      // checked against the other under the users lock).
+      const membershipsFirst =
+        memberships !== undefined && !external && current.some((m) => m.kind === 'external');
+
+      const warnings = [];
+      const changeMemberships = async () => {
+        if (memberships === undefined) return;
+        const membership = await setUserDomains(userId, memberships, {
+          actor: actorFromRequest(request),
+          logger: request.log,
+        });
+        warnings.push(...(membership.warnings ?? []));
+      };
+      if (membershipsFirst) {
+        try {
+          await changeMemberships();
+        } catch (err) {
+          return sendFailure(request, reply, err, 'Failed to change the memberships');
+        }
+      }
+
       let outcome;
       let before = null;
       try {
-        outcome = await changeUsers(
-          async () => {
-            const usersData = await readUsersOrFail();
-            const user = usersData.users[username];
-            if (!user) throw httpError('User not found', 404);
-            // As it was before this request (a second attempt finds it changed already).
-            before ??= { groups: groupsOf(user), disabled: user.disabled === true };
-            if (body.disabled === true && isEnabledAdmin(user)) {
-              const enabledAdmins = Object.values(usersData.users).filter(isEnabledAdmin).length;
-              if (enabledAdmins <= 1) {
-                throw httpError('Cannot disable the last enabled administrator', 400, {
-                  code: 'last_admin',
-                });
+        // Only memberships change: users.yml is not written, the user is read.
+        if (Object.keys(fields).length === 0) {
+          const usersData = await readUsersOrFail();
+          const user = usersData.users[username];
+          if (!user) throw httpError('User not found', 404);
+          before = { groups: groupsOf(user, domains), disabled: user.disabled === true };
+          outcome = { result: user, warnings: [], persisted: true };
+        } else
+          outcome = await changeUsers(
+            async () => {
+              const usersData = await readUsersOrFail();
+              const user = usersData.users[username];
+              if (!user) throw httpError('User not found', 404);
+              // As it was before this request (a second attempt finds it changed already).
+              before ??= { groups: groupsOf(user, domains), disabled: user.disabled === true };
+              if (body.groups !== undefined) {
+                assertAssignableGroups(body.groups, before.groups);
+                // Checked under the users lock, which a change of kind takes too.
+                if (
+                  body.groups.length > 0 &&
+                  userId &&
+                  (await domainsOfUser(userId)).some((m) => m.kind === 'external')
+                ) {
+                  throw externalMemberGroupsError(409);
+                }
+              }
+              if (body.disabled === true && isEnabledAdmin(user)) {
+                const enabledAdmins = Object.values(usersData.users).filter(isEnabledAdmin).length;
+                if (enabledAdmins <= 1) {
+                  throw httpError('Cannot disable the last enabled administrator', 400, {
+                    code: 'last_admin',
+                  });
+                }
               }
-            }
-
-            if (body.displayname !== undefined) user.displayname = body.displayname;
-            if (body.email !== undefined) user.email = body.email;
-            if (body.groups !== undefined) user.groups = body.groups;
-            if (passwordHash !== undefined) user.password = passwordHash;
-            if (body.disabled === true) user.disabled = true;
-            if (body.disabled === false) delete user.disabled;
 
-            await writeUsersOrFail(usersData);
-            return user;
-          },
-          {
-            actor: actorFromRequest(request),
-            logger: request.log,
-            // Authelia's own password reset may rewrite users.yml under the
-            // change: it is checked after the restart, and made once more.
-            expect: (users) => intended(users[username]),
-          },
-        );
+              if (body.displayname !== undefined) user.displayname = body.displayname;
+              if (body.email !== undefined) user.email = body.email;
+              if (body.groups !== undefined) {
+                user.groups = [...body.groups, ...ownedGroupsOf(user, domains)];
+              }
+              if (passwordHash !== undefined) user.password = passwordHash;
+              if (body.disabled === true) user.disabled = true;
+              if (body.disabled === false) delete user.disabled;
+
+              await writeUsersOrFail(usersData);
+              return user;
+            },
+            {
+              actor: actorFromRequest(request),
+              logger: request.log,
+              // Authelia's own password reset may rewrite users.yml under the
+              // change: it is checked after the rendering, and made once more.
+              expect: (users) => intended(users[username]),
+            },
+          );
       } catch (err) {
         return sendFailure(request, reply, err, 'Failed to update user database');
       }
 
       const user = outcome.result;
       const disabled = user.disabled === true;
-      const warnings = [...outcome.warnings];
-      const known = await findDirectoryUser(username);
-      const userId = known?.userId ?? null;
+      warnings.push(...outcome.warnings);
+
+      if (!membershipsFirst) {
+        try {
+          await changeMemberships();
+        } catch (err) {
+          return sendFailure(request, reply, err, 'Failed to change the memberships');
+        }
+      }
 
       // Disabling is offboarding, which the change did as the directory saw
       // the user become disabled (`changeUsers`): sessions ended, registry
       // tokens revoked. Registry scopes are granted at login from feria-*
       // groups too: losing one must not leave a valid token behind either.
-      const groupsAfter = groupsOf(user);
+      const groupsAfter = groupsOf(user, domains);
       const groupsChanged = body.groups !== undefined && !sameList(before.groups, groupsAfter);
       if (groupsChanged && !(disabled && !before.disabled)) {
         try {
@@ -348,10 +467,11 @@ export default async function usersRoutes(fastify, _opts) {
           username,
           displayname: user.displayname,
           email: user.email,
-          groups: user.groups || [],
+          groups: groupsAfter,
           disabled,
           userId,
           status: disabled ? 'disabled' : 'active',
+          domains: userId ? await domainsOfUser(userId) : [],
         },
         ...(outcome.persisted ? {} : { persisted: false }),
         ...(warnings.length > 0 ? { warnings } : {}),
@@ -386,7 +506,7 @@ export default async function usersRoutes(fastify, _opts) {
               throw httpError('Cannot delete the last user', 400);
             }
             delete usersData.users[username];
-            await writeUsersOrFail(usersData);
+            await writeUsersOrFail(usersData, { deleting: [username] });
           },
           {
             actor,

package/vendor/serverd/src/routes/management.js

@@ -13,12 +13,14 @@ import ticketRoutes from './management/tickets.js';
 import identityRoutes from './management/identity.js';
 import identityDirectoryRoutes from './management/identity-directory.js';
 import pluginIdentityRoutes from './management/plugin-identity.js';
+import pluginWebSurfaceRoutes from './management/plugin-web-surface.js';
 import storageRoutes from './management/storage.js';
 import gatekeeperProxyRoutes from './management/gatekeeper-proxy.js';
 import agentsRoutes from './management/agents.js';
 import registryCredentialRoutes from './management/registry-credential.js';
 import auditRoutes from './management/audit.js';
 import agentPanelAuthzRoutes from './management/agent-panel-authz.js';
+import domainRoutes from './management/domains.js';
 
 export default async function managementRoutes(fastify, _opts) {
   fastify.addHook('onRequest', managementOnly());
@@ -37,10 +39,12 @@ export default async function managementRoutes(fastify, _opts) {
   await fastify.register(identityRoutes);
   await fastify.register(identityDirectoryRoutes);
   await fastify.register(pluginIdentityRoutes);
+  await fastify.register(pluginWebSurfaceRoutes);
   await fastify.register(storageRoutes);
   await fastify.register(gatekeeperProxyRoutes);
   await fastify.register(agentsRoutes);
   await fastify.register(registryCredentialRoutes);
   await fastify.register(auditRoutes);
   await fastify.register(agentPanelAuthzRoutes);
+  await fastify.register(domainRoutes);
 }

package/vendor/serverd/src/routes/onboarding/dns.js

@@ -1,21 +1,7 @@
-import dns from 'node:dns/promises';
-import { CORE_SUBDOMAINS } from '@lamalibre/lamaste';
+import { CORE_SUBDOMAINS, DNS_WILDCARD_PROBE_LABEL } from '@lamalibre/lamaste';
+import { resolveHostA as resolveA } from '@lamalibre/lamaste/server';
 import { getConfig, updateConfig } from '../../lib/config.js';
 
-/**
- * Resolve A records for a hostname, returning an empty array on expected DNS errors.
- */
-async function resolveA(hostname) {
-  try {
-    return await dns.resolve4(hostname);
-  } catch (err) {
-    if (err.code === 'ENOTFOUND' || err.code === 'ENODATA' || err.code === 'ETIMEOUT') {
-      return [];
-    }
-    throw err;
-  }
-}
-
 /**
  * Build a human-readable diagnostic message for the DNS verification result.
  */
@@ -69,7 +55,7 @@ export default async function dnsRoute(fastify, _opts) {
     const [coreResolved, apexResolvedIps, wildcardResolvedIps] = await Promise.all([
       Promise.all(coreNames.map((name) => resolveA(name))),
       resolveA(domain),
-      resolveA(`test-lamaste-check.${domain}`),
+      resolveA(`${DNS_WILDCARD_PROBE_LABEL}.${domain}`),
     ]);
 
     const records = coreNames.map((name, i) => {

package/vendor/serverd/src/routes/onboarding/provision.js

@@ -12,6 +12,7 @@ import { migrateChiselCredentialsIfNeeded } from '../../lib/chisel-users.js';
 import { loadAgentRegistry } from '../../lib/mtls.js';
 import { setChiselRunningPinnedRelease } from '../../lib/chisel-runtime.js';
 import { changeUsers } from '../../lib/directory.js';
+import { ensurePrimaryDomain, syncDomainAccess } from '../../lib/domains.js';
 
 // Module-level state for provisioning
 const emitter = new EventEmitter();
@@ -115,24 +116,16 @@ async function runProvisioning(log) {
         'Authelia is not installed. Run `npx @lamalibre/create-lamaste` on the server to repair the installation.',
       );
     }
-    emitProgress('install-authelia', 'running', 'Writing configuration...');
-
-    const secrets = {
-      jwtSecret: crypto.randomBytes(32).toString('hex'),
-      sessionSecret: crypto.randomBytes(32).toString('hex'),
-      storageEncryptionKey: crypto.randomBytes(32).toString('hex'),
-    };
-    await authelia.writeAutheliaConfig(domain, secrets);
-
     emitProgress('install-authelia', 'running', 'Creating admin user...');
     adminPassword = crypto.randomBytes(16).toString('base64url');
     // Through the users lock, and into the user directory — which reconciles
-    // with users.yml from here on. Authelia starts next, so no restart.
+    // with users.yml from here on. The domain is rendered below, once it
+    // exists.
     const created = await changeUsers(() => authelia.createUser('admin', adminPassword), {
       actor: 'lamaste',
       logger: log,
       creates: ['admin'],
-      restartAuthelia: false,
+      renderDomains: false,
       // Authelia's storage does not exist before its first start.
       autheliaStorage: false,
     });
@@ -140,6 +133,21 @@ async function runProvisioning(log) {
       log.warn({ step: warning.step }, warning.message);
     }
 
+    // The primary domain with the administrator as its member — rendered
+    // into users.yml's groups and Gatekeeper's projection before Authelia
+    // first starts, so its first configuration already admits them (the
+    // configuration it is rendered from is the one written here: nothing to
+    // restart). The panel renders every later change.
+    emitProgress('install-authelia', 'running', 'Writing configuration...');
+    await ensurePrimaryDomain({ logger: log });
+    const secrets = {
+      jwtSecret: crypto.randomBytes(32).toString('hex'),
+      sessionSecret: crypto.randomBytes(32).toString('hex'),
+      storageEncryptionKey: crypto.randomBytes(32).toString('hex'),
+    };
+    await authelia.writeAutheliaConfig(domain, secrets);
+    await syncDomainAccess({ logger: log });
+
     emitProgress('install-authelia', 'running', 'Starting Authelia service...');
     await authelia.startAuthelia();
     emitProgress('install-authelia', 'done', 'Authelia configured and running');
@@ -156,7 +164,7 @@ async function runProvisioning(log) {
     await nginx.writePanelVhost(domain);
 
     emitProgress('configure-nginx', 'running', 'Writing auth vhost...');
-    await nginx.writeAuthVhost(domain);
+    await nginx.writeAuthVhost(domain, { primary: true });
 
     emitProgress('configure-nginx', 'running', 'Writing tunnel vhost...');
     await nginx.writeTunnelVhost(domain);
@@ -166,7 +174,6 @@ async function runProvisioning(log) {
 
     emitProgress('configure-nginx', 'running', 'Enabling sites...');
     await nginx.enableSite('lamalibre-lamaste-panel-domain');
-    await nginx.enableSite('lamalibre-lamaste-auth');
     await nginx.enableSite('lamalibre-lamaste-tunnel');
 
     emitProgress('configure-nginx', 'running', 'Testing nginx configuration...');
@@ -217,6 +224,8 @@ async function runProvisioning(log) {
     // Step 6: Finalize
     emitProgress('finalize', 'running', 'Updating configuration...');
     await updateConfig({ onboarding: { status: 'COMPLETED' } });
+    // Gatekeeper's projection of the domain (Authelia holds it already).
+    await syncDomainAccess({ logger: log });
 
     const result = {
       adminUsername: 'admin',