Running vars check using Nix-based executor...
Executing shared generators...
Executing shared generator: authelia-oidc-punchcard-punchcard
+ set -euo pipefail
+ PATH=/nix/store/jp7xqawrs8pjdn3v2qxrgrn6cc7siij2-coreutils-9.10/bin:/nix/store/qg9is7wkbb6yp394pcj3hy5kiv66dl7v-openssl-3.6.1-bin/bin:/nix/store/y7skv1sshl83r9qysxgiqrqkm050h21y-authelia-4.39.12/bin:/nix/store/qsmjr5i3mp9pzpf66za9iyjf03hbpy2j-gnused-4.9/bin:/nix/store/jp7xqawrs8pjdn3v2qxrgrn6cc7siij2-coreutils-9.10/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ mkdir -p /output
+ openssl rand -hex 32
+ sed 's/^Digest: //'
++ cat /output/client_secret
+ authelia crypto hash generate argon2 --password 5967d1fea43293460d38891c69953729eb2757f8f13935587f76f04eb4709739
✓ Generated shared file: authelia-oidc-punchcard-punchcard/client_secret
✓ Generated shared file: authelia-oidc-punchcard-punchcard/client_secret_hash
✓ Shared Generator authelia-oidc-punchcard-punchcard completed
Executing shared generator: pki-root-ca
+ set -euo pipefail
+ PATH=/nix/store/qg9is7wkbb6yp394pcj3hy5kiv66dl7v-openssl-3.6.1-bin/bin:/nix/store/jp7xqawrs8pjdn3v2qxrgrn6cc7siij2-coreutils-9.10/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ openssl genrsa -out /output/ca.key 4096
+ openssl req -x509 -new -nodes -key /output/ca.key -sha256 -days 3650 -subj '/CN=Clan Root CA' -out /output/ca.crt
✓ Generated shared file: pki-root-ca/ca.crt
✓ Generated shared file: pki-root-ca/ca.key
✓ Shared Generator pki-root-ca completed
✓ Shared generators completed
Processing machine: server
Generator execution order: authelia -> authelia-user-alice -> cert-auth -> cert-punchcard -> state-version
Executing generator: authelia
+ set -euo pipefail
+ PATH=/nix/store/jp7xqawrs8pjdn3v2qxrgrn6cc7siij2-coreutils-9.10/bin:/nix/store/qg9is7wkbb6yp394pcj3hy5kiv66dl7v-openssl-3.6.1-bin/bin:/nix/store/jp7xqawrs8pjdn3v2qxrgrn6cc7siij2-coreutils-9.10/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ mkdir -p /output
+ openssl rand -hex 64
+ openssl rand -hex 64
+ openssl rand -hex 64
+ openssl rand -hex 64
+ openssl genrsa -out /output/oidc-jwks-key 4096
✓ Generated file: authelia/jwt-secret
✓ Generated file: authelia/oidc-hmac-secret
✓ Generated file: authelia/oidc-jwks-key
✓ Generated file: authelia/session-secret
✓ Generated file: authelia/storage-encryption-key
✓ Generator authelia completed
Executing generator: authelia-user-alice
+ set -euo pipefail
+ PATH=/nix/store/jp7xqawrs8pjdn3v2qxrgrn6cc7siij2-coreutils-9.10/bin:/nix/store/y7skv1sshl83r9qysxgiqrqkm050h21y-authelia-4.39.12/bin:/nix/store/xg04qf17057i9c7npmvacvza3s791wh2-python3.13-xkcdpass-1.30.0/bin:/nix/store/qsmjr5i3mp9pzpf66za9iyjf03hbpy2j-gnused-4.9/bin:/nix/store/jp7xqawrs8pjdn3v2qxrgrn6cc7siij2-coreutils-9.10/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ mkdir -p /output
+ xkcdpass -n 7 -d-
+ sed 's/^Digest: //'
++ cat /output/password
+ authelia crypto hash generate argon2 --password relock-manifesto-shack-eastbound-nastily-giggle-sporting
✓ Generated file: authelia-user-alice/password
✓ Generated file: authelia-user-alice/password-hash
✓ Generator authelia-user-alice completed
Executing generator: cert-auth
+ set -euo pipefail
+ PATH=/nix/store/qg9is7wkbb6yp394pcj3hy5kiv66dl7v-openssl-3.6.1-bin/bin:/nix/store/jp7xqawrs8pjdn3v2qxrgrn6cc7siij2-coreutils-9.10/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ openssl genrsa -out /output/auth.key 4096
+ openssl req -new -key /output/auth.key -subj /CN=auth.test.clan -out endpoint.csr
+ printf subjectAltName=DNS:auth.test.clan
+ openssl x509 -req -in endpoint.csr -CA /input/pki-root-ca/ca.crt -CAkey /input/pki-root-ca/ca.key -CAcreateserial -days 365 -sha256 -extfile san.cnf -out /output/auth.crt
Certificate request self-signature ok
subject=CN=auth.test.clan
+ cat /output/auth.crt /input/pki-root-ca/ca.crt
✓ Generated file: cert-auth/auth.crt
✓ Generated file: cert-auth/auth.fullchain.crt
✓ Generated file: cert-auth/auth.key
✓ Generator cert-auth completed
Executing generator: cert-punchcard
+ set -euo pipefail
+ PATH=/nix/store/qg9is7wkbb6yp394pcj3hy5kiv66dl7v-openssl-3.6.1-bin/bin:/nix/store/jp7xqawrs8pjdn3v2qxrgrn6cc7siij2-coreutils-9.10/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ openssl genrsa -out /output/punchcard.key 4096
+ openssl req -new -key /output/punchcard.key -subj /CN=punchcard.test.clan -out endpoint.csr
+ printf subjectAltName=DNS:punchcard.test.clan
+ openssl x509 -req -in endpoint.csr -CA /input/pki-root-ca/ca.crt -CAkey /input/pki-root-ca/ca.key -CAcreateserial -days 365 -sha256 -extfile san.cnf -out /output/punchcard.crt
Certificate request self-signature ok
subject=CN=punchcard.test.clan
+ cat /output/punchcard.crt /input/pki-root-ca/ca.crt
✓ Generated file: cert-punchcard/punchcard.crt
✓ Generated file: cert-punchcard/punchcard.fullchain.crt
✓ Generated file: cert-punchcard/punchcard.key
✓ Generator cert-punchcard completed
Executing generator: state-version
+ set -euo pipefail
+ PATH=/nix/store/jp7xqawrs8pjdn3v2qxrgrn6cc7siij2-coreutils-9.10/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ echo -n 26.05
✓ Generated file: state-version/version
✓ Generator state-version completed
✓ Machine server completed
✓ All vars checks completed successfully