Skip to main content

06-mealie.md

kstack: book: Centerpoint Home Lab chapter: Documents & Organization page: Mealie tags: [mealie, recipes, meal-planning, oidc, authentik]

Overview

emptyMealie is a self-hosted recipe manager and meal planner. It imports recipes from URLs, supports manual entry, and provides a weekly meal plan interface. OIDC authentication is via Authentik, with auto-redirect enabled. The mealieaddons sidecar (Mealie Addons by razziel89) provides enhanced recipe retrieval, PDF export via Pandoc, and image embedding.

Access

Type URL Auth External https://recipe.jeevesconsults.ca Authentik OIDC + GeoBlock + CrowdSec Internal https://mealie.home.local Authentik OIDC (Step-CA TLS)

OIDC auto-redirect is enabled (OIDC_AUTO_REDIRECT: true) — the Mealie login form is bypassed and Authentik is shown directly.

Containers

Container Image Role mealie ghcr.io/mealie-recipes/mealie:latest Core application mealieaddons ghcr.io/razziel89/mealie-addons:latest Enhanced retrieval and export

mealie (application)

Key environment variables:

Variable Value / Notes BASE_URL https://recipe.jeevesconsults.ca OIDC_AUTH_ENABLED true OIDC_AUTO_REDIRECT true OIDC_PROVIDER_NAME Authentik OIDC_CONFIGURATION_URL https://auth.jeevesconsults.ca/application/o/mealie/.well-known/openid-configuration OIDC_CLIENT_ID cjTjv6CLnu0pT7qkkthDTjXmaVPYdxMfOKW9d5Wy OIDC_CLIENT_SECRET REDACTED OIDC_USER_GROUP family-friends OIDC_ADMIN_GROUP admins OIDC_SIGNUP_ENABLED false OIDC_REMEMBER_ME true ALLOW_SIGNUP false SMTP_HOST smtp.gmail.com SMTP_PORT 587 SMTP_AUTH_STRATEGY TLS SMTP_USER jeeves5454@gmail.com SMTP_PASSWORD REDACTED SMTP_FROM_EMAIL jeeves5454@gmail.com PUID / PGID 1000 TZ America/Toronto

Bind mounts:

Host Path Container Path Purpose /home/jeeves/docker/mealie/data /app/data Database and assets

mealieaddons

Mealie Addons provides enhanced recipe scraping, Pandoc-based PDF/EPUB export, and image embedding for recipes.

Key environment variables:

Variable Value / Notes MEALIE_BASE_URL https://recipe.jeevesconsults.ca MEALIE_RETRIEVAL_URL http://mealie:9000 MA_SELF_URL http://localhost:9000 MA_LISTEN_INTERFACE :9000 MA_IMAGE_ACTION embed MA_TIMEOUT_SECS 60 MA_RETRIEVAL_LIMIT 5 GIN_MODE release PANDOC_FLAGS --epub-title-page=false

No bind mounts — stateless.

Traefik route:

traefik.http.routers.mealieaddons.rule: Host(`mealieaddons.home.local`)
traefik.http.routers.mealieaddons.entrypoints: websecure
traefik.http.routers.mealieaddons.tls.certresolver: step-ca
traefik.http.services.mealieaddons.loadbalancer.server.port: 9000

Traefik Labels (mealie)

traefik.http.routers.mealie-ext.rule: Host(`recipe.jeevesconsults.ca`)
traefik.http.routers.mealie-ext.entrypoints: websecure
traefik.http.routers.mealie-ext.tls.certresolver: letsencrypt
traefik.http.routers.mealie-ext.middlewares: plex-geoblock@file,crowdsec-bouncer@file,mealie-headers
traefik.http.routers.mealie-ext.service: mealie-svc

traefik.http.routers.mealie-int.rule: Host(`mealie.home.local`)
traefik.http.routers.mealie-int.entrypoints: websecure
traefik.http.routers.mealie-int.tls.certresolver: step-ca
traefik.http.routers.mealie-int.service: mealie-svc

traefik.http.middlewares.mealie-headers.headers.customrequestheaders.X-Forwarded-Proto: https
traefik.http.services.mealie-svc.loadbalancer.server.port: 9000

Notes / Gotchas

    OIDC_USER_GROUP: family-friends limits OIDC login to members of that Authentik group. Users not in this group can be denied access even with valid Authentik credentials. Manage group membership in Authentik admin. The X-Forwarded-Proto: https header middleware is required for Mealie to generate correct OIDC redirect URIs. Without it, HTTPS URLs will not form correctly and the OIDC flow will fail. Mealie uses SQLite by default when no external database is configured. The database file lives in /app/data. Back up this directory before upgrades. mealieaddons is accessible at mealieaddons.home.local — this is the URL to configure in Mealie settings for the enhanced importer.

    Last Updated: 2026-06-17

    Back to top