# 06-mealie.md

kstack:
  book: Centerpoint Home Lab
  chapter: Documents & Organization
  page: Mealie
  tags: [mealie, recipes, meal-planning, oidc, authentik]
---

## Overview

Mealie is a self-hosted recipe manager and meal planner. It imports recipes from
URLs, supports manual entry, and provides a weekly meal plan interface. OIDC
authentication is via Authentik, with auto-redirect enabled. The `mealieaddons`
sidecar (Mealie Addons by razziel89) provides enhanced recipe retrieval, PDF
export via Pandoc, and image embedding.

## Access

| Type     | URL                                     | Auth                          |
|----------|-----------------------------------------|-------------------------------|
| External | `https://recipe.jeevesconsults.ca`      | Authentik OIDC + GeoBlock + CrowdSec |
| Internal | `https://mealie.home.local`             | Authentik OIDC (Step-CA TLS) |

OIDC auto-redirect is enabled (`OIDC_AUTO_REDIRECT: true`) — the Mealie login
form is bypassed and Authentik is shown directly.

## Containers

| Container      | Image                                    | Role                          |
|----------------|------------------------------------------|-------------------------------|
| `mealie`       | `ghcr.io/mealie-recipes/mealie:latest`   | Core application              |
| `mealieaddons` | `ghcr.io/razziel89/mealie-addons:latest` | Enhanced retrieval and export |

### mealie (application)

**Key environment variables:**

| Variable                      | Value / Notes                                                         |
|-------------------------------|-----------------------------------------------------------------------|
| `BASE_URL`                    | `https://recipe.jeevesconsults.ca`                                    |
| `OIDC_AUTH_ENABLED`           | `true`                                                                |
| `OIDC_AUTO_REDIRECT`          | `true`                                                                |
| `OIDC_PROVIDER_NAME`          | `Authentik`                                                           |
| `OIDC_CONFIGURATION_URL`      | `https://auth.jeevesconsults.ca/application/o/mealie/.well-known/openid-configuration` |
| `OIDC_CLIENT_ID`              | `cjTjv6CLnu0pT7qkkthDTjXmaVPYdxMfOKW9d5Wy`                           |
| `OIDC_CLIENT_SECRET`          | **REDACTED**                                                          |
| `OIDC_USER_GROUP`             | `family-friends`                                                      |
| `OIDC_ADMIN_GROUP`            | `admins`                                                              |
| `OIDC_SIGNUP_ENABLED`         | `false`                                                               |
| `OIDC_REMEMBER_ME`            | `true`                                                                |
| `ALLOW_SIGNUP`                | `false`                                                               |
| `SMTP_HOST`                   | `smtp.gmail.com`                                                      |
| `SMTP_PORT`                   | `587`                                                                 |
| `SMTP_AUTH_STRATEGY`          | `TLS`                                                                 |
| `SMTP_USER`                   | `jeeves5454@gmail.com`                                                |
| `SMTP_PASSWORD`               | **REDACTED**                                                          |
| `SMTP_FROM_EMAIL`             | `jeeves5454@gmail.com`                                                |
| `PUID` / `PGID`               | `1000`                                                                |
| `TZ`                          | `America/Toronto`                                                     |

**Bind mounts:**

| Host Path                          | Container Path | Purpose             |
|------------------------------------|----------------|---------------------|
| `/home/jeeves/docker/mealie/data`  | `/app/data`    | Database and assets |

### mealieaddons

Mealie Addons provides enhanced recipe scraping, Pandoc-based PDF/EPUB export,
and image embedding for recipes.

**Key environment variables:**

| Variable              | Value / Notes                             |
|-----------------------|-------------------------------------------|
| `MEALIE_BASE_URL`     | `https://recipe.jeevesconsults.ca`        |
| `MEALIE_RETRIEVAL_URL` | `http://mealie:9000`                     |
| `MA_SELF_URL`         | `http://localhost:9000`                   |
| `MA_LISTEN_INTERFACE` | `:9000`                                   |
| `MA_IMAGE_ACTION`     | `embed`                                   |
| `MA_TIMEOUT_SECS`     | `60`                                      |
| `MA_RETRIEVAL_LIMIT`  | `5`                                       |
| `GIN_MODE`            | `release`                                 |
| `PANDOC_FLAGS`        | `--epub-title-page=false`                 |

No bind mounts — stateless.

**Traefik route:**

```yaml
traefik.http.routers.mealieaddons.rule: Host(`mealieaddons.home.local`)
traefik.http.routers.mealieaddons.entrypoints: websecure
traefik.http.routers.mealieaddons.tls.certresolver: step-ca
traefik.http.services.mealieaddons.loadbalancer.server.port: 9000
```

## Traefik Labels (mealie)

```yaml
traefik.http.routers.mealie-ext.rule: Host(`recipe.jeevesconsults.ca`)
traefik.http.routers.mealie-ext.entrypoints: websecure
traefik.http.routers.mealie-ext.tls.certresolver: letsencrypt
traefik.http.routers.mealie-ext.middlewares: plex-geoblock@file,crowdsec-bouncer@file,mealie-headers
traefik.http.routers.mealie-ext.service: mealie-svc

traefik.http.routers.mealie-int.rule: Host(`mealie.home.local`)
traefik.http.routers.mealie-int.entrypoints: websecure
traefik.http.routers.mealie-int.tls.certresolver: step-ca
traefik.http.routers.mealie-int.service: mealie-svc

traefik.http.middlewares.mealie-headers.headers.customrequestheaders.X-Forwarded-Proto: https
traefik.http.services.mealie-svc.loadbalancer.server.port: 9000
```

## Notes / Gotchas

- `OIDC_USER_GROUP: family-friends` limits OIDC login to members of that Authentik
  group. Users not in this group can be denied access even with valid Authentik
  credentials. Manage group membership in Authentik admin.
- The `X-Forwarded-Proto: https` header middleware is required for Mealie to
  generate correct OIDC redirect URIs. Without it, HTTPS URLs will not form
  correctly and the OIDC flow will fail.
- Mealie uses SQLite by default when no external database is configured. The
  database file lives in `/app/data`. Back up this directory before upgrades.
- `mealieaddons` is accessible at `mealieaddons.home.local` — this is the URL
  to configure in Mealie settings for the enhanced importer.

---
*Last Updated: 2026-06-17*