docs: Authentik session lifetime investigation, fix docs, changelog

2026-06-06 23:45:59 +02:00
parent ebf521007d
commit ddc5e8771a
11 changed files with 486 additions and 2 deletions
--- a/investigations/2026-06-06-authentik-session-lifetime.md
+++ b/investigations/2026-06-06-authentik-session-lifetime.md
@@ -0,0 +1,101 @@
+# 2026-06-06 — Frequent Authentik login prompts fixed (session duration)
+
+## Summary
+
+User needed to re-authenticate to Authentik several times per day. Root cause was the Django session being configured as a **session cookie** (cleared on browser close) with a short 24-hour lifetime. Fixed by extending both the session cookie lifetime and the user_login stage session duration to 30 days.
+
+## Timeline
+
+- **2026-06-06 ~23:00** — User reports "having to login to authentik several times per day"
+- **~23:10** — Investigation begins: check Authentik OAuth2 provider settings, proxy session table, Django session config
+- **~23:20** — Found `SESSION_EXPIRE_AT_BROWSER_CLOSE=True` — the `authentik_session` cookie has no Max-Age, cleared on browser close
+- **~23:25** — Found the `user_login` stage has `session_duration=seconds=0`, which calls `session.set_expiry(0)` → `_session_expire_at_browser_close=True`
+- **~23:30** — Applied DB fix: updated `authentik_stages_user_login_userloginstage` → `session_duration='days=30'`
+- **~23:35** — Added `AUTHENTIK_SESSIONS__UNAUTHENTICATED_AGE=days=30` to `/opt/authentik.env` (maps to `sessions.unauthenticated_age` in Authentik config, setting `SESSION_COOKIE_AGE` to 30 days)
+- **~23:40** — Recreated container with `docker compose up -d` (restart doesn't re-read env file)
+- **~23:45** — Verified both changes took effect
+
+## Root cause
+
+Two independent but compounding issues:
+
+1. **`SESSION_EXPIRE_AT_BROWSER_CLOSE=True`** — hardcoded in `/authentik/root/settings.py`. Makes the `authentik_session` cookie a session cookie (no `Max-Age`), cleared when the browser closes. Cannot be changed via env vars or config files (hardcoded in Python source).
+
+2. **`user_login` stage `session_duration=seconds=0`** — the default-authentication-login stage called `session.set_expiry(0)`, which in Django sets `_session_expire_at_browser_close=True` on the session object, overriding any session cookie lifetime set via `SESSION_COOKIE_AGE`.
+
+3. **`sessions.unauthenticated_age=days=1`** (default) — `SESSION_COOKIE_AGE` was 86,400 seconds (24 hours), so even with the browser left open, the server-side session data expired after 24 hours with no way to extend it (`SESSION_SAVE_EVERY_REQUEST=False`).
+
+### Why forward-auth worked but OAuth2 didn't
+
+- **Forward-auth (Caddy-gated services)** — The `authentik_proxy_*` cookie is a *persistent* cookie with 24-hour validity, set by the Authentik proxy outpost. It survives browser restart. Caddy's forward-auth validates this cookie directly with the outpost API — no Django session needed.
+- **OAuth2 (Gitea, Jellyfin, etc.)** — These services redirect to `auth.hubris.network/application/o/authorize/`, which checks the Django session (`authentik_session` cookie). If the browser was closed, this cookie is gone → user is redirected to the login form.
+
+## Changes applied
+
+### 1. Database — `authentik_stages_user_login_userloginstage`
+
+```sql
+UPDATE authentik_stages_user_login_userloginstage
+SET session_duration = 'days=30'
+WHERE stage_ptr_id = (
+    SELECT stage_uuid FROM authentik_flows_stage 
+    WHERE name = 'default-authentication-login'
+);
+```
+
+This causes the login stage to call `session.set_expiry(timedelta(days=30))`, which:
+- Sets `_session_expire_at_browser_close=False` for that session
+- Sets the session cookie `Max-Age` to 30 days (persistent cookie)
+- Sets the server-side session expiry to 30 days
+
+### 2. Environment — `AUTHENTIK_SESSIONS__UNAUTHENTICATED_AGE`
+
+Added to `/opt/authentik.env`:
+
+```
+AUTHENTIK_SESSIONS__UNAUTHENTICATED_AGE=days=30
+```
+
+This maps to config key `sessions.unauthenticated_age`, which Authentik's `settings.py` reads via:
+
+```python
+SESSION_COOKIE_AGE = timedelta_from_string(
+    CONFIG.get("sessions.unauthenticated_age", "days=1")
+).total_seconds()
+```
+
+Result: `SESSION_COOKIE_AGE` = 2,592,000 seconds (30 days). This is a fallback for sessions that don't go through the `user_login` stage or when the stage's explicit `set_expiry` doesn't apply.
+
+## Verification
+
+```python
+# Inside authentik-server container:
+import os
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "authentik.root.settings")
+import django
+django.setup()
+from django.conf import settings
+print("SESSION_COOKIE_AGE:", settings.SESSION_COOKIE_AGE)  # → 2592000.0
+print("SESSION_EXPIRE_AT_BROWSER_CLOSE:", settings.SESSION_EXPIRE_AT_BROWSER_CLOSE)  # → True
+
+from authentik.stages.user_login.models import UserLoginStage
+stage = UserLoginStage.objects.filter(name="default-authentication-login").first()
+print("session_duration:", stage.session_duration)  # → "days=30"
+```
+
+## Open questions
+
+- `SESSION_COOKIE_SECURE=False` — Should be `True` since Authentik is HTTPS-only, but the custom `SessionMiddleware.is_secure()` method dynamically sets the cookie's `secure` flag based on the request, so it's fine.
+- 30 days is generous. Could be reduced to 7-14 days if desired. Change the DB value and env var accordingly.
+
+## Related
+
+- [Container 106 — auth-outpost](../containers/106-auth-outpost.md)
+- [Authentik VPS migration](2026-05-31-authentik-vps-migration.md)
+- [Ingress (VPS Traefik)](../infrastructure/ingress.md)
+- `.hermes/plans/2026-06-06_232200-authentik-frequent-login-fix.md` — original plan
+
+## Changelog
+
+### 2026-06-06 — created
+Documented the session lifetime investigation, root cause, and applied fixes.
--- a/investigations/2026-06-06-caddyfile-truncation.md
+++ b/investigations/2026-06-06-caddyfile-truncation.md
@@ -0,0 +1,61 @@
+# Investigation: Caddyfile truncation — all LAN services down (2026-06-06)
+
+**Date:** 2026-06-06
+**Status:** resolved
+**Duration:** ~10 hours (from last known good state ~12:39 UTC to restoration ~22:40 UTC)
+
+## Symptom
+
+All `*.hubris.network` URLs except `photos.hubris.network` and `auth.hubris.network` returned `tlsv1 alert internal error` or TCP timeouts from LAN/mesh clients. `dig @192.168.8.2` and `dig @100.122.255.254` both resolved to `192.168.8.175` correctly — DNS was fine. The issue was at the Caddy level.
+
+## Root cause
+
+The Caddyfile on LXC 121 was manually edited directly on the filesystem (not via the `dtoro/caddy-conf` git repo), reducing it from 260 lines/30+ site blocks to 43 lines with only 3 photo-related site blocks: `photos.hubris.network`, `prism.hubris.network`, and `photos2.hubris.network`.
+
+### Timeline
+
+| Time (UTC+2) | Event |
+|---|---|
+| Jun 04 23:43 | Last successful git-push deploy — full Caddyfile (260 lines) |
+| Jun 06 ~12:00 | Caddyfile manually edited locally, truncating to 3 sites |
+| Jun 06 12:39 | Deploy webhook triggered → `git pull --ff-only` failed: "Your local changes would be overwritten" |
+| Jun 06 14:13 | Deploy webhook triggered again → `deploy ok` (the truncated file was committed or merged somehow) |
+| Jun 06 22:34 | Investigation began |
+| Jun 06 22:43 | Caddyfile restored from `origin/master`, `systemctl reload caddy` |
+
+### Evidence
+
+- `git diff HEAD -- Caddyfile` on LXC 121: `+3 / -159` lines
+- Git reflog: HEAD at `32575ce` (fix: sab port 8081→8082), working tree diverged
+- Backup file `Caddyfile.bak.1780263919`: 225 lines, full original config
+- `git stash list` shows one auto-stash entry
+- `origin/master` at `1b977aa`: 260 lines, all site blocks present
+
+### Secondary root cause found during investigation
+
+**elementsynapse (LXC 118)** had `iface eth0 inet dhcp` internally despite `pct set 118 --net0 ... ip=192.168.8.239/24`. On DHCP lease renewal, dhclient grabbed `.244` from Technitium's pool. Caddy's `reverse_proxy 192.168.8.239:8008` was hitting a dead IP.
+
+This is the same class of drift as the June 5th incidents (paperless, HAOS, apps, mule-images). Elementsynapse was missed during the 2026-06-02 static-IP migration.
+
+## Fix applied
+
+1. **Caddyfile** → `git checkout --force origin/master -- Caddyfile` + `systemctl reload caddy`
+2. **elementsynapse** → replaced `iface eth0 inet dhcp` with static, killed dhclient, verified connectivity
+
+## Permanent safeguards (all deployed)
+
+| Safeguard | Location | What it does |
+|---|---|---|
+| Site-count guard | `/etc/caddy/scripts/deploy.sh` | Refuses reload if <20 `hubris.network` site blocks |
+| Dirty-tree auto-stash | `/etc/caddy/scripts/deploy.sh` | Stashes local edits before git pull |
+| Auto-backup | `/etc/caddy/scripts/deploy.sh` | Saves Caddyfile.bak.<timestamp> before any change, keeps 5 |
+| Caddy backend health | `/etc/cron.d/caddy-backend-health` on hubris | Runs `check-caddy-backends.sh` every 10 min |
+| DNS sync | `/etc/cron.d/dns-sync` on LXC 107 | Runs `dns-sync.py` every 10 min (was missing since 2026-06-04) |
+
+## Related
+
+- [DHCP drift investigation (previous incident)](2026-06-05-homelab-dhcp-drift.md)
+- [Caddy (121)](../containers/121-caddy.md)
+- [elementsynapse (118)](../containers/118-elementsynapse.md)
+- [dns-sync script](../scripts/dns-sync.py)
+- [check-caddy-backends script](../scripts/check-caddy-backends.sh)
--- a/investigations/index.md
+++ b/investigations/index.md
@@ -6,7 +6,8 @@ Time-stamped incident reports and experiments. One entry per incident; the entry

 | Date         | Title                                                              | Status        |
 | ------------ | ------------------------------------------------------------------ | ------------- |
-| 2026-05-31   | [Authentik migrated from LXC 124 to the VPS](2026-05-31-authentik-vps-migration.md) | Resolved; LXC 124 Authentik in ~2-week dual-run before decommission |
+|| 2026-06-06   | [Frequent Authentik login prompts — session lifetime fix](2026-06-06-authentik-session-lifetime.md) | Resolved — `session_duration=days=30`, `SESSION_COOKIE_AGE=30d` |
+|| 2026-05-31   | [Authentik migrated from LXC 124 to the VPS](2026-05-31-authentik-vps-migration.md) | Resolved; LXC 124 Authentik in ~2-week dual-run before decommission |
 | 2026-06-03   | [Moonlight/Sunshine streaming — WiFi jitter](2026-06-03-moonlight-sunshine-wifi-jitter.md) | Mitigations applied; definitive fix requires wiring mac-mini via Ethernet |
 | 2026-04-21   | [Hubris crash loop — thermal + USB drive](2026-04-21-hubris-crash-loop.md) | Drive removal A/B test passing as of 2026-04-28 (3+ days uptime) |