Skip to main content

06-mealie.md

kstack: book: Centerpoint Home Lab chapter: Documents & Organization page: Mealie tags: [mealie, recipes, meal-planning, oidc, authentik]

Overview

Mealie is a self-hosted recipe manager and meal planner. It imports recipes from URLs, supports manual entry, and provides a weekly meal plan interface. OIDC authentication is via Authentik, with auto-redirect enabled. The mealieaddons sidecar (Mealie Addons by razziel89) provides enhanced recipe retrieval, PDF export via Pandoc, and image embedding.

Access

Type URL Auth
External https://recipe.jeevesconsults.ca Authentik OIDC + GeoBlock + CrowdSec
Internal https://mealie.home.local Authentik OIDC (Step-CA TLS)

OIDC auto-redirect is enabled (OIDC_AUTO_REDIRECT: true) — the Mealie login form is bypassed and Authentik is shown directly.

Containers

Container Image Role
mealie ghcr.io/mealie-recipes/mealie:latest Core application
mealieaddons ghcr.io/razziel89/mealie-addons:latest Enhanced retrieval and export

mealie (application)

Key environment variables:

Variable Value / Notes
BASE_URL https://recipe.jeevesconsults.ca
OIDC_AUTH_ENABLED true
OIDC_AUTO_REDIRECT true
OIDC_PROVIDER_NAME Authentik
OIDC_CONFIGURATION_URL https://auth.jeevesconsults.ca/application/o/mealie/.well-known/openid-configuration
OIDC_CLIENT_ID cjTjv6CLnu0pT7qkkthDTjXmaVPYdxMfOKW9d5Wy
OIDC_CLIENT_SECRET REDACTED
OIDC_USER_GROUP family-friends
OIDC_ADMIN_GROUP admins
OIDC_SIGNUP_ENABLED false
OIDC_REMEMBER_ME true
ALLOW_SIGNUP false
SMTP_HOST smtp.gmail.com
SMTP_PORT 587
SMTP_AUTH_STRATEGY TLS
SMTP_USER jeeves5454@gmail.com
SMTP_PASSWORD REDACTED
SMTP_FROM_EMAIL jeeves5454@gmail.com
PUID / PGID 1000
TZ America/Toronto

Bind mounts:

Host Path Container Path Purpose
/home/jeeves/docker/mealie/data /app/data Database and assets

mealieaddons

Mealie Addons provides enhanced recipe scraping, Pandoc-based PDF/EPUB export, and image embedding for recipes.

Key environment variables:

Variable Value / Notes
MEALIE_BASE_URL https://recipe.jeevesconsults.ca
MEALIE_RETRIEVAL_URL http://mealie:9000
MA_SELF_URL http://localhost:9000
MA_LISTEN_INTERFACE :9000
MA_IMAGE_ACTION embed
MA_TIMEOUT_SECS 60
MA_RETRIEVAL_LIMIT 5
GIN_MODE release
PANDOC_FLAGS --epub-title-page=false

No bind mounts — stateless.

Traefik route:

traefik.http.routers.mealieaddons.rule: Host(`mealieaddons.home.local`)
traefik.http.routers.mealieaddons.entrypoints: websecure
traefik.http.routers.mealieaddons.tls.certresolver: step-ca
traefik.http.services.mealieaddons.loadbalancer.server.port: 9000

Traefik Labels (mealie)

traefik.http.routers.mealie-ext.rule: Host(`recipe.jeevesconsults.ca`)
traefik.http.routers.mealie-ext.entrypoints: websecure
traefik.http.routers.mealie-ext.tls.certresolver: letsencrypt
traefik.http.routers.mealie-ext.middlewares: plex-geoblock@file,crowdsec-bouncer@file,mealie-headers
traefik.http.routers.mealie-ext.service: mealie-svc

traefik.http.routers.mealie-int.rule: Host(`mealie.home.local`)
traefik.http.routers.mealie-int.entrypoints: websecure
traefik.http.routers.mealie-int.tls.certresolver: step-ca
traefik.http.routers.mealie-int.service: mealie-svc

traefik.http.middlewares.mealie-headers.headers.customrequestheaders.X-Forwarded-Proto: https
traefik.http.services.mealie-svc.loadbalancer.server.port: 9000

Notes / Gotchas

  • OIDC_USER_GROUP: family-friends limits OIDC login to members of that Authentik group. Users not in this group can be denied access even with valid Authentik credentials. Manage group membership in Authentik admin.
  • The X-Forwarded-Proto: https header middleware is required for Mealie to generate correct OIDC redirect URIs. Without it, HTTPS URLs will not form correctly and the OIDC flow will fail.
  • Mealie uses SQLite by default when no external database is configured. The database file lives in /app/data. Back up this directory before upgrades.
  • mealieaddons is accessible at mealieaddons.home.local — this is the URL to configure in Mealie settings for the enhanced importer.

Last Updated: 2026-06-17

No comments to display

Back to top