DISABLE_AUTH env var (single-user / SSO bypass)

[Someguysomewhere1]

Feature Request: Disable built-in authentication for reverse proxy setups

Use case

Many self-hosted users run Grimmory behind a reverse proxy with authentication already handled at that layer (e.g. Cloudflare Access, Authelia, Authentik, Organizr). In these setups — especially single-user installs — Grimmory's own login page is redundant friction.

Requested feature

One or both of the following:

Option A — DISABLE_AUTH environment variable
A simple env var (e.g. DISABLE_AUTH=true) that skips the login page entirely and grants access as the default/admin user. Similar to how Kavita, Calibre-Web and other self-hosted apps handle this.

Why not just use OIDC?

OIDC is great for multi-user setups, but for single-user instances already behind a trusted auth layer, it introduces unnecessary complexity (registering OAuth clients, managing tokens, etc.).

Expected behaviour

• DISABLE_AUTH=true: Grimmory loads directly to the main UI, no login prompt

Workaround today

None — there is no DISABLE_AUTH flag, no header trust, and no guest/auto-login mode.

[astappiev]

Option B is already present (I have implemented it in one of the earliest PRs to Booklore)

grimmory/docs/forward-auth-with-proxy.md

Lines 14 to 32 in 4e9cf79

	# Allows Forward Auth
	REMOTE_AUTH_ENABLED=true
	# Enable automatic user creation (recommended)
	REMOTE_AUTH_CREATE_NEW_USERS=true
	# Header names (your proxy will specify what header names to use)
	REMOTE_AUTH_HEADER_USER=Remote-User # Username (required)
	REMOTE_AUTH_HEADER_NAME=Remote-Name # Display name
	REMOTE_AUTH_HEADER_EMAIL=Remote-Email # Email address
	REMOTE_AUTH_HEADER_GROUPS=Remote-Groups # Groups/roles
	# Admin group name (optional)
	REMOTE_AUTH_ADMIN_GROUP=admin # Specify this if you want a group to automatically get admin rights
	# Groups delimiter pattern (optional)
	REMOTE_AUTH_GROUPS_DELIMITER=\\s+ # Regex pattern for splitting groups. Default: "\\s+" (whitespace)
	# Use "\\s*,\\s*" for comma-separated groups
	# Use "\\s*;\\s*" for semicolon-separated groups

However, right now, it doesn't work anymore (at left for me, I was looking for an issue about that).

Upd: created an issue and PR to fix it #388.

[obviouslyallie]

I'm going to move this to features as if Option B is implemented. Leaving this open for Option A — DISABLE_AUTH environment variable

[imnotjames]

Removed option B from description.