Running vars check using Nix-based executor...
Executing shared generators...
Executing shared generator: authelia-oidc-punchcard-punchcard
+ set -euo pipefail
+ PATH=/nix/store/gph17gb73p6qbrqqjnypfjj5npf0ldyx-coreutils-9.11/bin:/nix/store/gqv7phqvmll7dprdmya6102ph64wvj0h-openssl-3.6.3-bin/bin:/nix/store/d3ra8isyv80vkrpp6z8whx2x9f3xzbid-authelia-4.39.20/bin:/nix/store/svl89366pvzz5s3myh1fjniz9l0x17fh-gnused-4.10/bin:/nix/store/gph17gb73p6qbrqqjnypfjj5npf0ldyx-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ mkdir -p /output
+ openssl rand -hex 32
+ sed 's/^Digest: //'
++ cat /output/client_secret
+ authelia crypto hash generate argon2 --password 1acc5eb7f1c321ef51103a02b8e9793d39860fdb2cc71596617920729cd97967
✓ Generated shared file: authelia-oidc-punchcard-punchcard/client_secret
✓ Generated shared file: authelia-oidc-punchcard-punchcard/client_secret_hash
✓ Shared Generator authelia-oidc-punchcard-punchcard completed
Executing shared generator: pki-root-ca
+ set -euo pipefail
+ PATH=/nix/store/gqv7phqvmll7dprdmya6102ph64wvj0h-openssl-3.6.3-bin/bin:/nix/store/gph17gb73p6qbrqqjnypfjj5npf0ldyx-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ openssl genrsa -out /output/ca.key 4096
+ openssl req -x509 -new -nodes -key /output/ca.key -sha256 -days 3650 -subj '/CN=Clan Root CA' -out /output/ca.crt
✓ Generated shared file: pki-root-ca/ca.crt
✓ Generated shared file: pki-root-ca/ca.key
✓ Shared Generator pki-root-ca completed
✓ Shared generators completed
Processing machine: server
Generator execution order: authelia -> authelia-user-alice -> cert-auth -> cert-punchcard -> state-version
Executing generator: authelia
+ set -euo pipefail
+ PATH=/nix/store/gph17gb73p6qbrqqjnypfjj5npf0ldyx-coreutils-9.11/bin:/nix/store/gqv7phqvmll7dprdmya6102ph64wvj0h-openssl-3.6.3-bin/bin:/nix/store/gph17gb73p6qbrqqjnypfjj5npf0ldyx-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ mkdir -p /output
+ openssl rand -hex 64
+ openssl rand -hex 64
+ openssl rand -hex 64
+ openssl rand -hex 64
+ openssl genrsa -out /output/oidc-jwks-key 4096
✓ Generated file: authelia/jwt-secret
✓ Generated file: authelia/oidc-hmac-secret
✓ Generated file: authelia/oidc-jwks-key
✓ Generated file: authelia/session-secret
✓ Generated file: authelia/storage-encryption-key
✓ Generator authelia completed
Executing generator: authelia-user-alice
+ set -euo pipefail
+ PATH=/nix/store/gph17gb73p6qbrqqjnypfjj5npf0ldyx-coreutils-9.11/bin:/nix/store/d3ra8isyv80vkrpp6z8whx2x9f3xzbid-authelia-4.39.20/bin:/nix/store/pgbl42r1nhkpqjjnb0fism6sw58p1s2j-python3.13-xkcdpass-1.30.0/bin:/nix/store/svl89366pvzz5s3myh1fjniz9l0x17fh-gnused-4.10/bin:/nix/store/gph17gb73p6qbrqqjnypfjj5npf0ldyx-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ mkdir -p /output
+ xkcdpass -n 7 -d-
+ sed 's/^Digest: //'
++ cat /output/password
+ authelia crypto hash generate argon2 --password friday-factual-sulfur-pyramid-shiny-conduit-recount
✓ Generated file: authelia-user-alice/password
✓ Generated file: authelia-user-alice/password-hash
✓ Generator authelia-user-alice completed
Executing generator: cert-auth
+ set -euo pipefail
+ PATH=/nix/store/gqv7phqvmll7dprdmya6102ph64wvj0h-openssl-3.6.3-bin/bin:/nix/store/gph17gb73p6qbrqqjnypfjj5npf0ldyx-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ openssl genrsa -out /output/auth.key 4096
+ openssl req -new -key /output/auth.key -subj /CN=auth.test.clan -out endpoint.csr
+ printf subjectAltName=DNS:auth.test.clan
+ openssl x509 -req -in endpoint.csr -CA /input/pki-root-ca/ca.crt -CAkey /input/pki-root-ca/ca.key -CAcreateserial -days 365 -sha256 -extfile san.cnf -out /output/auth.crt
Certificate request self-signature ok
subject=CN=auth.test.clan
+ cat /output/auth.crt /input/pki-root-ca/ca.crt
✓ Generated file: cert-auth/auth.crt
✓ Generated file: cert-auth/auth.fullchain.crt
✓ Generated file: cert-auth/auth.key
✓ Generator cert-auth completed
Executing generator: cert-punchcard
+ set -euo pipefail
+ PATH=/nix/store/gqv7phqvmll7dprdmya6102ph64wvj0h-openssl-3.6.3-bin/bin:/nix/store/gph17gb73p6qbrqqjnypfjj5npf0ldyx-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ openssl genrsa -out /output/punchcard.key 4096
+ openssl req -new -key /output/punchcard.key -subj /CN=punchcard.test.clan -out endpoint.csr
+ printf subjectAltName=DNS:punchcard.test.clan
+ openssl x509 -req -in endpoint.csr -CA /input/pki-root-ca/ca.crt -CAkey /input/pki-root-ca/ca.key -CAcreateserial -days 365 -sha256 -extfile san.cnf -out /output/punchcard.crt
Certificate request self-signature ok
subject=CN=punchcard.test.clan
+ cat /output/punchcard.crt /input/pki-root-ca/ca.crt
✓ Generated file: cert-punchcard/punchcard.crt
✓ Generated file: cert-punchcard/punchcard.fullchain.crt
✓ Generated file: cert-punchcard/punchcard.key
✓ Generator cert-punchcard completed
Executing generator: state-version
+ set -euo pipefail
+ PATH=/nix/store/gph17gb73p6qbrqqjnypfjj5npf0ldyx-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ echo -n 26.05
✓ Generated file: state-version/version
✓ Generator state-version completed
✓ Machine server completed
✓ All vars checks completed successfully