Authelia: add storage encryption_key, drop deprecated jwt_secret and duplicate redirection url

Co-Authored-By: Claude Code <noreply@anthropic.com>

services/authelia/configuration.yml

@@ -1,9 +1,9 @@
 # Authelia configuration — https://www.authelia.com/configuration/prologue/introduction/
 #
-# Secrets (JWT_SECRET, RESET_JWT_SECRET, SESSION_SECRET, LDAP_ADMIN_PASSWORD,
+# Secrets (RESET_JWT_SECRET, SESSION_SECRET, LDAP_ADMIN_PASSWORD,
-# OIDC_HMAC_SECRET, OIDC_PORTAINER_SECRET) are resolved from the service's .env
+# OIDC_HMAC_SECRET, OIDC_PORTAINER_SECRET, STORAGE_ENCRYPTION_KEY) are resolved
-# by the installer and substituted into this file on install/update, so they are
+# from the service's .env by the installer and substituted into this file on
-# not committed here.
+# install/update, so they are not committed here.
 #
 # The OIDC signing key (jwks) cannot be injected via env/file secrets (Authelia
 # does not support that for this field), so it is read from /config/oidc-jwks.pem
@@ -12,8 +12,6 @@
 
 theme: dark
 
-jwt_secret: '${JWT_SECRET}'
-
 server:
   address: 'tcp://0.0.0.0:9091/'
   endpoints:
@@ -64,7 +62,6 @@ session:
   cookies:
     - domain: 'example.com'
       authelia_url: 'https://auth.example.com'
-      default_redirection_url: 'https://auth.example.com'
 
 regulation:
   max_retries: 3
@@ -72,6 +69,7 @@ regulation:
   ban_time: '5m'
 
 storage:
+  encryption_key: '${STORAGE_ENCRYPTION_KEY}'
   local:
     path: '/config/db.sqlite3'
 

services/authelia/metadata.json

@@ -33,8 +33,8 @@
   },
   "env": [
     {
-      "name": "JWT_SECRET",
+      "name": "STORAGE_ENCRYPTION_KEY",
-      "label": "JWT secret (auto-generated)",
+      "label": "Storage encryption key (auto-generated)",
       "generate": true
     },
     {