multistreaming: scenes/composition, installer build support, service updates

- multistreaming (new): RTMP ingest + multi-platform fan-out with pluggable providers (Twitch/YouTube/Kick/custom), zero-knowledge key vaults, Authelia OIDC auth, shared rooms with editor/streamer roles, single-use invites, per-account streaming grants, and scenes & composition (grid/PiP layouts, text/image overlays, per-output audio routing).
- installer: support Dockerfile build in metadata (not just image) and RSA key generation for the Authelia OIDC JWKS.
- authelia: add OIDC provider with portainer + multistreaming clients (public + PKCE).
- services: remove allprox; add nginx-proxy-manager and portainer; update lldap; regenerate catalog.

services/authelia/configuration.yml

@@ -1,8 +1,14 @@
 # Authelia configuration — https://www.authelia.com/configuration/prologue/introduction/
 #
-# Secrets (JWT_SECRET, RESET_JWT_SECRET, SESSION_SECRET, LDAP_ADMIN_PASSWORD) are
-# resolved from the service's .env by the installer and substituted into this file
-# on install/update, so they are not committed here.
+# Secrets (JWT_SECRET, RESET_JWT_SECRET, SESSION_SECRET, LDAP_ADMIN_PASSWORD,
+# OIDC_HMAC_SECRET, OIDC_PORTAINER_SECRET) are resolved from the service's .env
+# by the installer and substituted into this file on install/update, so they are
+# not committed here.
+#
+# The OIDC signing key (jwks) cannot be injected via env/file secrets (Authelia
+# does not support that for this field), so it is read from /config/oidc-jwks.pem
+# using the `template` file filter (enabled via X_AUTHELIA_CONFIG_FILTERS).
+# The installer generates that file on first install and never rotates it.
 
 theme: dark
 
@@ -41,8 +47,11 @@ access_control:
   rules:
     - domain: 'auth.example.com'
       policy: bypass
-    - domain: 'portal.example.com'
-      policy: one_factor
+    # Everything else on your domain is SSO-protected (one factor by default).
+    # Apps that talk to Authelia via OIDC (Portainer) are NOT governed by these
+    # rules — their 2FA requirement lives in the client's authorization_policy.
+    # Apps behind forward-auth (multistreaming, lldap, …) use these rules; bump a
+    # specific host to two_factor if you want 2FA on it too.
     - domain: '*.example.com'
       policy: one_factor
 
@@ -55,7 +64,7 @@ session:
   cookies:
     - domain: 'example.com'
       authelia_url: 'https://auth.example.com'
-      default_redirection_url: 'https://portal.example.com'
+      default_redirection_url: 'https://auth.example.com'
 
 regulation:
   max_retries: 3
@@ -69,3 +78,54 @@ storage:
 notifier:
   filesystem:
     filename: '/config/notification.txt'
+
+identity_providers:
+  oidc:
+    hmac_secret: '${OIDC_HMAC_SECRET}'
+    jwks:
+      - key_id: 'homelab'
+        algorithm: 'RS256'
+        use: 'sig'
+        key: |
+          {{- fileContent "/config/oidc-jwks.pem" | nindent 10 }}
+    clients:
+      - client_id: 'portainer'
+        client_name: 'Portainer'
+        client_secret: '${OIDC_PORTAINER_SECRET}'
+        public: false
+        redirect_uris:
+          - 'https://portainer.example.com'
+        scopes:
+          - 'openid'
+          - 'profile'
+          - 'groups'
+          - 'email'
+        grant_types:
+          - 'refresh_token'
+          - 'authorization_code'
+        response_types:
+          - 'code'
+        response_modes:
+          - 'form_post'
+          - 'query'
+        authorization_policy: 'two_factor'
+      - client_id: 'multistreaming'
+        client_name: 'Multistreaming'
+        # Public client: the panel is a browser SPA. No client_secret — it is
+        # protected by PKCE (S256) instead, which is required for public clients.
+        public: true
+        redirect_uris:
+          - 'https://streaming.example.com/api/auth/oidc/callback'
+        scopes:
+          - 'openid'
+          - 'profile'
+          - 'email'
+        grant_types:
+          - 'authorization_code'
+        response_types:
+          - 'code'
+        response_modes:
+          - 'query'
+        require_pkce: true
+        pkce_challenge_method: 'S256'
+        authorization_policy: 'two_factor'