claude: update CLAUDE.mdHEADmaster

1 files changed, 6 insertions, 22 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index b8ea80f..c892d9f 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -84,17 +84,6 @@ Bastion is a self-hosted server system on Debian that runs multiple services in
 - Docker registry accessible at `https://registry.swave.lol`
 - Docker registry requires manual setup after first login: create a "docker (hosted)" repository with HTTP connector on port 5000
 
-### Netdata (monitoring)
-- Dir: `netdata/`
-- Compose: `netdata/docker-compose.yaml`
-- Image: `netdata/netdata:latest`
-- Network: `monitoring_network` (172.24.0.0/16, static IP 172.24.0.2), port 19999 internally
-- No host ports (accessed only via main nginx reverse proxy)
-- Accessible at `https://swave.lol/netdata/`
-- Auth: Authelia forward-auth (one_factor) — protected via nginx auth_request on the /netdata/ location
-- nginx proxies with `Cache-Control: no-store` to prevent browser caching (avoids CORS errors on cached API calls)
-- nginx-netdata.conf snippet: `netdata/nginx-netdata.conf`
-
 ### Authelia (SSO / authentication)
 - Dir: `authelia/`
 - Compose: `authelia/docker-compose.yaml`
@@ -104,18 +93,16 @@ Bastion is a self-hosted server system on Debian that runs multiple services in
 - Volumes: `/var/authelia/config`, `/var/authelia/data`, `/var/authelia/secrets` (ro), `/var/authelia/redis`
 - Secrets loaded from files in `/var/authelia/secrets/` (JWT, session, storage encryption, OIDC HMAC, OIDC RSA key)
 - Accessible at `https://auth.swave.lol`
-- Forward-auth (auth_request) for: Netdata, Cockpit, Gerrit (/login path), Jenkins
+- Forward-auth for: Gerrit, Jenkins, Nexus, Netdata, Cockpit
 - OIDC provider for Jenkins (full SSO)
 - HTTP header injection for Gerrit (`X-Forwarded-User`)
-- Nexus and Docker registry: bypass (Nexus handles its own auth)
 - Ghost and Cgit remain public (no auth)
 - Setup guide: `authelia/setup.md`
-- IMPORTANT: access_control rules are evaluated top-down, first match wins — specific resource rules (netdata, cockpit) must appear BEFORE the general `swave.lol` bypass rule
 
 ### Nginx (reverse proxy)
 - Dir: `nginx/`
 - Compose: `nginx/docker-compose.yaml`
-- Network: joins `git-network` (IP 172.22.0.254), `ghost_network`, `jenkins_network`, `monitoring_network`, `nexus_network`, `authelia_network`
+- Network: joins `git-network` (IP 172.22.0.254), `ghost_network`, `jenkins_network`, `nexus_network`, `authelia_network`
 - Ports: 80 (HTTP, redirects to HTTPS), 443 (HTTPS)
 - Config mounted from `/var/nginx/conf/` on host
 - SSL: Let's Encrypt certs via `run_certbot.sh`, dhparam at `/var/dh_param/`
@@ -123,14 +110,12 @@ Bastion is a self-hosted server system on Debian that runs multiple services in
 - Default catch-all server blocks return 404 error page for unknown subdomains
 - Error page: `nginx/error-pages/unknown-host.html`
 - IMPORTANT: SSL server blocks must be commented out for first run (before certs exist)
-- All `/_authelia-auth` subrequest locations explicitly set `proxy_set_header Cookie $http_cookie` to ensure session cookies reach Authelia
 
 ## Networking
 Each stack has its own Docker network. Nginx joins all of them to reverse proxy:
 - `git-network` — git-server + cgit + gerrit + nginx
 - `ghost_network` — ghost + ghost-db + nginx
 - `jenkins_network` — jenkins + git-server + gerrit + nginx
-- `monitoring_network` — netdata + nginx
 - `nexus_network` — nexus + nginx
 - `authelia_network` — authelia + authelia-redis + nginx
 
@@ -139,11 +124,10 @@ Each stack has its own Docker network. Nginx joins all of them to reverse proxy:
 2. Git Server (creates git-network)
 3. Ghost (creates ghost_network)
 4. Jenkins (creates jenkins_network)
-5. Netdata (creates monitoring_network)
-6. Nexus (creates nexus_network)
-7. Authelia (creates authelia_network)
-8. Gerrit (joins git-network + jenkins_network, both must exist)
-9. Nginx (joins all networks, must be last)
+5. Nexus (creates nexus_network)
+6. Authelia (creates authelia_network)
+7. Gerrit (joins git-network + jenkins_network, both must exist)
+8. Nginx (joins all networks, must be last)
 
 ## Key Files
 - `doc/setup-guide.md` — full build instructions from fresh Debian