From b3e748477daa41eeb25985dd8a04ee199b577d13 Mon Sep 17 00:00:00 2001
From: colin <colin@nixc.us>
Date: Wed, 11 Jun 2025 16:13:51 -0400
Subject: [PATCH] Completely disable OIDC provider temporarily - Comment out
 all OIDC configuration in identity providers and clients - Remove OIDC
 secrets from stack to eliminate template processing issues - This should get
 Authelia running with basic auth only

---
 authelia-config.tar.gz                        | Bin 0 -> 4666 bytes
 .../configuration.identity.providers.yml      |  39 +++---
 .../config/configuration.oidc.clients.yml     | 121 +++++++++---------
 stack.production.yml                          |  38 +++---
 4 files changed, 101 insertions(+), 97 deletions(-)
 create mode 100644 authelia-config.tar.gz

diff --git a/authelia-config.tar.gz b/authelia-config.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..b047e4e6002e850577d3ddbc1b8fb30fc439bd34
GIT binary patch
literal 4666
zcmYk9cRbX8{J`za8A-B=lf)M}Bf{AuB70;dd#}riGeXFok&J91lyTzD-pM9(xU<ey
z_PNhbkKg0>c>Ml;Js!{Z`~7;q#^cG8Kt;r~sO3yVx+}lyi+SYRQT?Q}7?0o?^vcMO
zcWN?WMhaGn2b6yM2I)99b>H24>TzOrgIY_@uq39$U8wO7MNl|?%n(a_L=_Yvr*)f1
zODn@(zd;pku_>4gCQ_9S-%}50R5GDkXx{Vo{-VN2retcY3Y9z&)TFtzM>~M4BEeMg
zye`bls%p#`q~M*j3NrN<_7sZoYoM4<RFvH)n>mJDSexG8?wH7lF&kR^D3q|<=>=jC
z(V?|kDux!_(wy%^cNUPr3zn1dgu2&OQVY9zXF{#3(3Smt$kQ;0AV8UO9xua*Xd&@~
zC(BPZ9&~zzg&d$0fiom<WpxI9ehVDy;O(IhhAK;p!tMP<JvnEKeuu9{2y+$oTQR0b
z%V)#Q6{7~&mjjAxr^wZ^jx9<>;)-isVc$w{oA{l)_0hrDMjney4M=?C5U)?@EPl3e
zz2a(1Ij#d)?~2aOkVQl%{D3OJ#xve!TL*KWu;xse2E@P2#Ipnq?f{V_M|FD{Rkuzo
z37F%$Tci+gowi0=&g}(w)xCj5f)H8DRr4(4FwjG{7{P6ZCQLe*V^3_DzVr}STpJ9k
z{Vw;XRfK{1sr^0%OEkfdRqbCi<rkc|Dc@WAk<=H!UVrt(<}PX%*&ZWv=|vfAOM0pI
zjLZ{YCDz`7ny0ZUVNcN2v1WwIsr?5uEfH6g(AFzcvXYYmnfQx2*a+A1ze5W%7U0oD
z&A`d+^&KSFW<=(Z=%)FlUMA~5jzMVZmB2u}*=)=C>BZeFKou8YN8)J<xHR<bB6;t$
z5m>vA+G{5l?j<dr6x@$PlrUY13f^u8Xox+5T}k^jxE+<J9tfKR@E?IFihk@Om2IU6
z<t~W(MmNY`*_l@#;*ql;^K&Nyq!mQ0`AT{oP)h^Gc9Bcn->(9mXd{vmnxjeARSYvY
zPYQ(N<3ID_s1NW+yYK~g2>tLba(C<cx&?FaN_;}qk3RrS1pB34#$QC42~K>cOHzM>
z81;{iChQ?C2rxlD02R!f4BQ|=|F*O$^gm7)r7ty-ZAB2?+655thbdM1ztJUeSHJcC
z#oJGe^Sa?R1E9Y9NBYj{x^rBg92duY-X35WaYc)#%NBGE$;BN|-0?W6dec6ahVu<O
z`%c-jsFulz(bH^aZ%V6AM`FEPvzfXgy5oAW)RnO|pWs4F32R?09qG~hY+sV~6;n->
zITta7;@mB*qCOseEi>e0YqitA>+9KM#&cZN&Y0e~S?xV;GOo9zlzqWQ_};`FIz$jK
zn&(R>48EDX)&!)VA;DT;pkNqIjM@d-W8_W%zhgzuOK2wC+!W>sun{Nxfs$8Ro2rHp
zHjcY}FX7MI0M~OiiHB_fEgrA&P;nRd$YLzFF<$kq>%nW;gVbOWvAvI&<DthRptS?v
zFIa+J8b#Xi8>z1Pjw?|&@iE{(ik2(n>=#u+qsyJK3DWHapz5>hB0-cSYYxb*a?Kst
z1x!KOSa?DkaNTPTPsjFv_?~@$jl_SYeV~5x2?rO;TxTN(|C<=cTMB0p9%PSt^rI+B
zJOm^ji+C2+ZpGY+Cs~Zfb*u!6!A{E-6mdlH)ZJf%J`ht~5sCdIaQJ*EFnQlZKN~|o
zgRp=NmMZ~X1K$ve9862tWZq5b66Bz(nmRUy<#r(xUie`f|98KbK6!=@dw~dYWzv2>
ziciFqw1WJ*f1cO#j{izxx9g5+7%N~p*&AOec(;DK3#$3kSmqP<>${Y0ok*@zcI@Ub
zo4QPeL^<hVS}|Ajqk|FRk&%IVjCjuHBDW-Z6K(+UhKE|MjP#EhA(=Kf0(!e|^gq$}
ze6czowr-QDX;%K#*pHcu4f>D2LWNZBm01Ku@SicSu%JIOcl$L3ua5Q_F~m{upv!fL
zQftNfE(h`to4cBTh_HMil`=ZyQc9b$RGk0K)q_&3p1wFLih<#GXj8kWm*JBwvUZ4v
zSyJ7k&+B}@-z-@rw5)bQC??s@6nu3<VQ-9s&mAszO6C>X5E30OA79TR<Q(#?q`kc0
z-w`tWOYL9huBH`r0nv{7Z|q6m2?gNl`1=D!fROAg5KVM?Jqc$10#XyCLTgY3KqeJ#
z%sU3h63}}u*74<K)7w=R`r8d<aaCPQ*S*_{M>_2igw||~r&_OU49>0!lu=)W4?5p|
zV<Yd-US#J87)|A1S3$#sy^Gy<664CHedF3xb`JQa{H*}ui0xRWZK94#QtU<67B5J{
zwgjE2sq$uM;G}bf$ZO@G`ib2}vsZ47*H}kh!#)VJZj0>?eEiaGue{f%ZVF?^?*N`D
zjjxz~psZFA|I0sG_kmffgq4WVCepP=Rl5iue4~gbFS}x}PboI;;t|U4uc&}RFA?E0
zltx%ijel$9U~GDb^wrW){suJAE3AsJvN2@p1sv#UQ?^s@d8_72=Q!csN>(IGCKEf3
zZ{~tudU0#>G~pSu7@_sg^ip(WqHNW`vp*tS!l}<Cd`Wb^WU-q_aQNIWa-n(REbgQN
zeOpLJIao8;y=5`GFY~)Aw=(a&R*<+PWb|HoM$>aKjgm*)ze4DGh~SfM%pGt{8lbWh
zz08Bg_+!1CDAjY|e8owQuI{f3N~cc`Bx*G7)95V1_I{#HKa}_@_e(UjsIgNrG0f(C
zo!>TLp5l0)C3ArB?zJ<}%)^tV%m|Gq#q`t)q7y0BS>Bpg<15O8t+YCulM)_B07P;T
zI%Dc+@NEz3{(#4{?1%-QkHbINCqBl7>Z-8h=!XtY_rq&*Rmv}7T-z}7@n5_s0<~D<
zZdyQK8X6T`Io5OJp^PWl$-KcMP*eTIm8xj45c_g1aMpu`{rR-p@I%U+4@zX{PVeck
zYnr?-C0>v_6*LoQ=Py?N%89Z;pMg5{oVsW<(Vy*gTJC9tObi#lF^(map)}!D{pa8@
z_or?Z;xR$J4E}GpFLWP){nP|slY}gaLCFI^d(I5NBHdaaR4nQ-XX?A6z@XVV)5vKH
zt`U~8VHJ(V6zqUkTx7P?bO4DA2AST?!m&J%4}8KkeBNFL1k*;)fC=5f*}ipm?jbty
zuj22seN}?7)y5cHgv@ajnP$f3UtjDNZ1qfnaF#6}Zh46Q-vT$;IE6nWehr9{*v@Mq
zv_w%DgSZ+<eZu78hXLM7nMA}hwxSjYE)vPvc1G;ZNN>clEgZLg*PE9U5Q)%Mx!rok
z-A2!x)}Z;fe4COK5{W*0_<*a^%bO&zi2ax&U8Un8pGhI*1eO6)#H21YN*o`_B$CMs
zEgn?Uy_KY?JQ#^hU1)qY+~RKib@eTOphyy^X9!$*|9dxx9-Q?A)S~iJU&BwNkvhXD
z)__g<vR(<3_>g>l>Ld26Uz{VwO3Ion6YT|ea$FT8X8909)ICe#EBDGC(Zg(K)?mO%
z?{Q~F90iWMKN>ngwz~CZuJ`8ldmY$vjyo4oxy!Luk})Zl_$m2jqv9BaW4}+nv)sZi
z&G%C5vj!h8MA9fuTLKlu$M>|ei0f+YuDBU)^eE#)qhVUgB*7W~Qx5vrAxK8LX2Im~
z(}9PCvzH4k9{G!3fBCmRA>K<|ym5$nEm2sG>O>`rzu?PJj?&R3)dFXJei?kI2P4v<
ztIeJ7rbon>h;dH{MoC)gu6kVJ%Fa6+zKZC1Dp(uRAl*WBJ}v!iQfD47a4>B%q=t6h
zc&R*VONYitYGF5WsGoJs47%OqXb^T5ZXk!ar;&YC52k}!@%33ldNnjQWvxlbxJ5`j
zkM(1F@&{#tz1vdb(pa}N#>L36AP^|is8(?-)$}T+@qxno_$ScYU;Mvn)lSn9+!eT$
z`NxvOQ*(Y(QI3m2NS8f8ibllLMWq<1Nlcu|NA^t;B~L4fu^+Po0OGrAL1@Sf;-RPL
zuSRy8uThL4Qu^$%)&3M0+2wD~<<lDmxv~qGSq~r=bj6re(OA{I3H?bI^SgY_H4D$X
zV1~-!KX-5(J^>}tY4dCb9^1L#`*A$6x{S09nyZ0HPLX9T<;8j|;-n)DhjbIAfyDe-
z`)C<qi@ZNlEV)0$X%wq@1n|9ky~4<>Lm7@AKCk3H`?_lOi`_GMBp?40hN3C&4;DU2
z#?&~w2KE<+S{A>gkQ~UV-;W)a@U-X^;ctGg*gX^+s(zdP=fku52(z0HD(>XUJ=yA1
zZ4A+2C56wLB|K`Ms$bFxy=yYkmjWTAhfefZJenB*3}JB>aB(=`ri8*kL+IW5;QzN<
zBvav5%lq*EC>(#lT@cSEd!Jaby2<Ky$r1g<-8IE;n708qJXD{x@e*11X9LPgQrTFb
z5b@4z#J=<8aFDIVxfOmpubOAMf3(I2_A1!!b&K=IkqZg1y?1um+l=va&+`UP;0zPc
zJfZ|d&n?-LQ8lG>+c+zoxnMPN`k0stdO;uHP7m3GO=q>3*$2<kGMWdMmiehu=vE~(
zGn9ko+i_$DqNz)Ex=dL~&lWV~bB%7U1X7@E!hP>$EaPlxGxP5sx81XGw(Qmjh3x1d
zZoS&useLoF7Q$>Fu0?%W_8=`1^%vEvjWn{{IWAV15P-2(dr^SjGW!45YCXBhXqT!d
zP|cYgo(;(q&PkH0wNLsT>o8rNvxUXeWyw2oU{tDuf<q?cyh`a*^PBW3*I%E6qq|DE
zMN3%l;>v@lW-U2SF|Zs{>2%Q=sL_p%-#Yk9GV4lZddNdQGKDy2-9Yk2O`euv-7;hk
z>_@tfIsb%Nw7Q5)eru4l1gm2c#9y`CX)~9bf>7!i$VsQ@*kX&*q;tRdU;D{>=lsn_
zs)Q)EPrCJ~KT|NUP(J@)?lJ-WSo>YN$z915N|NSx4+STB-?e@X4()UQXsx5BG2<{o
zez98j4zeXtv#Rql3F0TbPz=*%31h2UIBvil&+J~{%ILApo?(gG>O*C^i|dv{TKA4w
zv|BrIofI>O@N@Uy;YG>1W1e~F56!y7ham!8_Yk~F<AJF^Ic}4l1UtWy{9W+v`Dn8X
z9D@JJ*Ir`G?iq+|@s+nOoGU+DcBU5KT-%8LWW4At(GMD2dBdKhNmCxgE10(yU*aDl
znv~_EJ|Vk8pY|U>X3FSTabdqRk&!GWbfD3ivtCMX#Xx)42_JA674Nrty)v>D02M>y
zFaUXL`4HV6BZ)zBY(;!OL>mztl-4(p2@(8bfWdTb*&*q29glA>yx`kqT^9Ul-U8r2
zAk5m?8sleS2-~4NYn);aWgj2FATWQ=c}Sjj5Y)5HMClX#a_rkv?%OxBXUS)zezYXW
z%Wwp!%fBRQ8R7mI^oxxG%6CT#768sqI(IuXE?Nl@p`Eb^OPP2lAF}yaBJKU0^qP6B
zXVnJ-$>YbU(~e9JYzpRRC51moCsQEonYa-4gItSBc=<*kWD|sxwOkyyqp_84o^!l1
z2X=>DW&Z+pJcOQi-u-+@aB2V!Hh`O?iv+ZrnG4{h1p1r-w4Oq>(|!~H&#8o81C5rm
zZpv0ntyci<MI0VdiJovPG#x~ygaVD=`;mQUz>=(ITaTqU;OJ;03bu-@DyI2+mE15?
z0GQKxUwYNOP$vW&{%@!ruU&k<;@W;m#1Cz((tG0Xby2ydJ;VGnRrYiA;6GJ!Fdy0j
zio5>6X^Afg(yt7DNDj_BT*NrRAE}o~>;4{+^OGi$vBJJ^f0_3cEE-pqZK}y<#1*ZS
z`7yg@bs&D;)j&@cQ0SrhkO&^Vxs>vYE}l{Vm#(r<#G;O!^5^7e!URAk8HRVhUaZVw
zB?k+ie{o7*7Co2mTUi+sm2X5cn7IO8`^U)~Soqtjt}%f1|D^`o3{0LvwPc}yDV6XK
zfYIUU3@mX0sN=p?py!KMro+fW*ZC`(^?zf{7YV%g9ndx$ezCwf49A-lFD(+AEfCmX
ziAbRO&hiOht#X|hUrO81OPdTBHy}!O4T=0b1t#E=XF=@e@YG9SdEe<2eulk-GhOQ%
zwkTtV0i~VZQ=}N!ML=87*<M{s;K3>M2HC&Q8+ZXgpM%^P0aMAi1wakOe2v9P#%;in
uVb?EW3j}O_uH)fPuVHsn9us){2DB%KBS<M3IGacT&`jKP1<^7Q(f<H9(SPay

literal 0
HcmV?d00001

diff --git a/docker/authelia/config/configuration.identity.providers.yml b/docker/authelia/config/configuration.identity.providers.yml
index 659924a..5e84e93 100644
--- a/docker/authelia/config/configuration.identity.providers.yml
+++ b/docker/authelia/config/configuration.identity.providers.yml
@@ -1,19 +1,20 @@
-identity_providers:
-  oidc:
-    lifespans:
-      access_token: 1h
-      authorize_code: 1m
-      id_token: 1h
-      refresh_token: 90m
-    enable_client_debug_messages: false
-    enforce_pkce: public_clients_only
-    cors:
-      endpoints:
-        - authorization
-        - token
-        - revocation
-        - introspection
-        - userinfo
-      allowed_origins:
-        - "*"
-      allowed_origins_from_client_redirect_uris: false
\ No newline at end of file
+# TEMPORARILY DISABLED - OIDC provider causing startup issues
+# identity_providers:
+#   oidc:
+#     lifespans:
+#       access_token: 1h
+#       authorize_code: 1m
+#       id_token: 1h
+#       refresh_token: 90m
+#     enable_client_debug_messages: false
+#     enforce_pkce: public_clients_only
+#     cors:
+#       endpoints:
+#         - authorization
+#         - token
+#         - revocation
+#         - introspection
+#         - userinfo
+#       allowed_origins:
+#         - "*"
+#       allowed_origins_from_client_redirect_uris: false
\ No newline at end of file
diff --git a/docker/authelia/config/configuration.oidc.clients.yml b/docker/authelia/config/configuration.oidc.clients.yml
index 131d60e..650e7b8 100644
--- a/docker/authelia/config/configuration.oidc.clients.yml
+++ b/docker/authelia/config/configuration.oidc.clients.yml
@@ -1,60 +1,61 @@
-identity_providers:
-  oidc:
-    hmac_secret: {{ secret "/run/secrets/IDENTITY_PROVIDERS_OIDC_HMAC_SECRET" }}
-    jwks:
-      - key: {{ secret "/run/secrets/IDENTITY_PROVIDERS_OIDC_JWKS_KEY" | mindent 10 "|" | msquote }}
-
-    authorization_policies:
-
-      headscale:
-        default_policy: deny
-        rules:
-          - policy: one_factor
-            subject: group:headscale
-# To generate secrets: 
-# docker exec -it authelia authelia crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986
-    clients:
-
-      - client_id: headscale
-        client_name: Headscale
-        client_secret: {{ secret "/run/secrets/CLIENT_SECRET_HEADSCALE" }}
-        public: false
-        authorization_policy: headscale
-        consent_mode: implicit
-        scopes:
-          - openid
-          - email
-          - profile
-        redirect_uris:
-          - https://headscale.{{ env "TRAEFIK_DOMAIN" }}/oidc/callback
-          - https://headscale.{{ env "TRAEFIK_DOMAIN" }}/admin/oidc/callback # headplane on same domain as headscale
-          # - https://headplane.{{ env "TRAEFIK_DOMAIN" }}/admin/oidc/callback # headplane on it's own domain
-        userinfo_signed_response_alg: none
-      - client_id: headadmin
-        client_name: headadmin
-        client_secret: {{ secret "/run/secrets/CLIENT_SECRET_HEADADMIN" }}
-        public: false
-        authorization_policy: one_factor
-        consent_mode: implicit
-        scopes:
-          - openid
-          - email
-          - profile
-        redirect_uris:
-          - https://headadmin.{{ env "TRAEFIK_DOMAIN" }}/oidc_callback
-        userinfo_signed_response_alg: none
-
-      - client_id: portainer
-        client_name: Portainer
-        client_secret: {{ secret "/run/secrets/CLIENT_SECRET_PORTAINER" }}
-        public: false
-        authorization_policy: one_factor
-        consent_mode: implicit
-        scopes:
-          - openid
-          - email
-          - profile
-          - groups
-        redirect_uris:
-          - https://portainer.{{ env "TRAEFIK_DOMAIN" }}/
-        userinfo_signed_response_alg: none
\ No newline at end of file
+# TEMPORARILY DISABLED - OIDC clients causing template processing issues
+# identity_providers:
+#   oidc:
+#     hmac_secret: {{ secret "/run/secrets/IDENTITY_PROVIDERS_OIDC_HMAC_SECRET" }}
+#     jwks:
+#       - key: {{ secret "/run/secrets/IDENTITY_PROVIDERS_OIDC_JWKS_KEY" | mindent 10 "|" | msquote }}
+# 
+#     authorization_policies:
+# 
+#       headscale:
+#         default_policy: deny
+#         rules:
+#           - policy: one_factor
+#             subject: group:headscale
+# # To generate secrets: 
+# # docker exec -it authelia authelia crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986
+#     clients:
+# 
+#       - client_id: headscale
+#         client_name: Headscale
+#         client_secret: {{ secret "/run/secrets/CLIENT_SECRET_HEADSCALE" }}
+#         public: false
+#         authorization_policy: headscale
+#         consent_mode: implicit
+#         scopes:
+#           - openid
+#           - email
+#           - profile
+#         redirect_uris:
+#           - https://headscale.{{ env "TRAEFIK_DOMAIN" }}/oidc/callback
+#           - https://headscale.{{ env "TRAEFIK_DOMAIN" }}/admin/oidc/callback # headplane on same domain as headscale
+#           # - https://headplane.{{ env "TRAEFIK_DOMAIN" }}/admin/oidc/callback # headplane on it's own domain
+#         userinfo_signed_response_alg: none
+#       - client_id: headadmin
+#         client_name: headadmin
+#         client_secret: {{ secret "/run/secrets/CLIENT_SECRET_HEADADMIN" }}
+#         public: false
+#         authorization_policy: one_factor
+#         consent_mode: implicit
+#         scopes:
+#           - openid
+#           - email
+#           - profile
+#         redirect_uris:
+#           - https://headadmin.{{ env "TRAEFIK_DOMAIN" }}/oidc_callback
+#         userinfo_signed_response_alg: none
+# 
+#       - client_id: portainer
+#         client_name: Portainer
+#         client_secret: {{ secret "/run/secrets/CLIENT_SECRET_PORTAINER" }}
+#         public: false
+#         authorization_policy: one_factor
+#         consent_mode: implicit
+#         scopes:
+#           - openid
+#           - email
+#           - profile
+#           - groups
+#         redirect_uris:
+#           - https://portainer.{{ env "TRAEFIK_DOMAIN" }}/
+#         userinfo_signed_response_alg: none
\ No newline at end of file
diff --git a/stack.production.yml b/stack.production.yml
index 4c0c26f..3bcb43e 100644
--- a/stack.production.yml
+++ b/stack.production.yml
@@ -10,24 +10,26 @@ secrets:
     external: true
   IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET:
     external: true
-  IDENTITY_PROVIDERS_OIDC_HMAC_SECRET:
-    external: true
-  IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY:
-    external: true
-  IDENTITY_PROVIDERS_OIDC_JWKS_KEY:
-    external: true
+  # TEMPORARILY DISABLED - OIDC provider disabled
+  # IDENTITY_PROVIDERS_OIDC_HMAC_SECRET:
+  #   external: true
+  # IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY:
+  #   external: true
+  # IDENTITY_PROVIDERS_OIDC_JWKS_KEY:
+  #   external: true
   NOTIFIER_SMTP_PASSWORD:
     external: true
   SESSION_SECRET:
     external: true
   STORAGE_ENCRYPTION_KEY:
     external: true
-  CLIENT_SECRET_HEADSCALE:
-    external: true
-  CLIENT_SECRET_HEADADMIN:
-    external: true
-  CLIENT_SECRET_PORTAINER:
-    external: true
+  # TEMPORARILY DISABLED - OAuth clients disabled
+  # CLIENT_SECRET_HEADSCALE:
+  #   external: true
+  # CLIENT_SECRET_HEADADMIN:
+  #   external: true
+  # CLIENT_SECRET_PORTAINER:
+  #   external: true
   # TEMPORARILY DISABLED - Gitea OAuth (not ready yet)
   # CLIENT_SECRET_GITEA:
   #   external: true
@@ -63,15 +65,15 @@ services:
     secrets:
       - AUTHENTICATION_BACKEND_LDAP_PASSWORD
       - IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET
-      - IDENTITY_PROVIDERS_OIDC_HMAC_SECRET
-      - IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY
-      - IDENTITY_PROVIDERS_OIDC_JWKS_KEY
+      # - IDENTITY_PROVIDERS_OIDC_HMAC_SECRET
+      # - IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY
+      # - IDENTITY_PROVIDERS_OIDC_JWKS_KEY
       - NOTIFIER_SMTP_PASSWORD
       - SESSION_SECRET
       - STORAGE_ENCRYPTION_KEY
-      - CLIENT_SECRET_HEADSCALE
-      - CLIENT_SECRET_HEADADMIN
-      - CLIENT_SECRET_PORTAINER
+      # - CLIENT_SECRET_HEADSCALE
+      # - CLIENT_SECRET_HEADADMIN
+      # - CLIENT_SECRET_PORTAINER
     environment: *authelia-env
     dns:
       - 1.1.1.1 # Cloudflare