docs: update CLAUDE.md with Netdata service and auth notes

- Add Netdata service entry (monitoring_network, auth_request, Cache-Control)
- Fix Authelia forward-auth list (Nexus is bypass, not forward-auth)
- Add rule ordering warning to Authelia entry
- Add Cookie header forwarding note to Nginx entry
- Add monitoring_network to networking and startup order sections

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 files changed, 22 insertions, 6 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index c892d9f..b8ea80f 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -84,6 +84,17 @@ Bastion is a self-hosted server system on Debian that runs multiple services in
 - Docker registry accessible at `https://registry.swave.lol`
 - Docker registry requires manual setup after first login: create a "docker (hosted)" repository with HTTP connector on port 5000
 
+### Netdata (monitoring)
+- Dir: `netdata/`
+- Compose: `netdata/docker-compose.yaml`
+- Image: `netdata/netdata:latest`
+- Network: `monitoring_network` (172.24.0.0/16, static IP 172.24.0.2), port 19999 internally
+- No host ports (accessed only via main nginx reverse proxy)
+- Accessible at `https://swave.lol/netdata/`
+- Auth: Authelia forward-auth (one_factor) — protected via nginx auth_request on the /netdata/ location
+- nginx proxies with `Cache-Control: no-store` to prevent browser caching (avoids CORS errors on cached API calls)
+- nginx-netdata.conf snippet: `netdata/nginx-netdata.conf`
+
 ### Authelia (SSO / authentication)
 - Dir: `authelia/`
 - Compose: `authelia/docker-compose.yaml`
@@ -93,16 +104,18 @@ Bastion is a self-hosted server system on Debian that runs multiple services in
 - Volumes: `/var/authelia/config`, `/var/authelia/data`, `/var/authelia/secrets` (ro), `/var/authelia/redis`
 - Secrets loaded from files in `/var/authelia/secrets/` (JWT, session, storage encryption, OIDC HMAC, OIDC RSA key)
 - Accessible at `https://auth.swave.lol`
-- Forward-auth for: Gerrit, Jenkins, Nexus, Netdata, Cockpit
+- Forward-auth (auth_request) for: Netdata, Cockpit, Gerrit (/login path), Jenkins
 - OIDC provider for Jenkins (full SSO)
 - HTTP header injection for Gerrit (`X-Forwarded-User`)
+- Nexus and Docker registry: bypass (Nexus handles its own auth)
 - Ghost and Cgit remain public (no auth)
 - Setup guide: `authelia/setup.md`
+- IMPORTANT: access_control rules are evaluated top-down, first match wins — specific resource rules (netdata, cockpit) must appear BEFORE the general `swave.lol` bypass rule
 
 ### Nginx (reverse proxy)
 - Dir: `nginx/`
 - Compose: `nginx/docker-compose.yaml`
-- Network: joins `git-network` (IP 172.22.0.254), `ghost_network`, `jenkins_network`, `nexus_network`, `authelia_network`
+- Network: joins `git-network` (IP 172.22.0.254), `ghost_network`, `jenkins_network`, `monitoring_network`, `nexus_network`, `authelia_network`
 - Ports: 80 (HTTP, redirects to HTTPS), 443 (HTTPS)
 - Config mounted from `/var/nginx/conf/` on host
 - SSL: Let's Encrypt certs via `run_certbot.sh`, dhparam at `/var/dh_param/`
@@ -110,12 +123,14 @@ Bastion is a self-hosted server system on Debian that runs multiple services in
 - Default catch-all server blocks return 404 error page for unknown subdomains
 - Error page: `nginx/error-pages/unknown-host.html`
 - IMPORTANT: SSL server blocks must be commented out for first run (before certs exist)
+- All `/_authelia-auth` subrequest locations explicitly set `proxy_set_header Cookie $http_cookie` to ensure session cookies reach Authelia
 
 ## Networking
 Each stack has its own Docker network. Nginx joins all of them to reverse proxy:
 - `git-network` — git-server + cgit + gerrit + nginx
 - `ghost_network` — ghost + ghost-db + nginx
 - `jenkins_network` — jenkins + git-server + gerrit + nginx
+- `monitoring_network` — netdata + nginx
 - `nexus_network` — nexus + nginx
 - `authelia_network` — authelia + authelia-redis + nginx
 
@@ -124,10 +139,11 @@ Each stack has its own Docker network. Nginx joins all of them to reverse proxy:
 2. Git Server (creates git-network)
 3. Ghost (creates ghost_network)
 4. Jenkins (creates jenkins_network)
-5. Nexus (creates nexus_network)
-6. Authelia (creates authelia_network)
-7. Gerrit (joins git-network + jenkins_network, both must exist)
-8. Nginx (joins all networks, must be last)
+5. Netdata (creates monitoring_network)
+6. Nexus (creates nexus_network)
+7. Authelia (creates authelia_network)
+8. Gerrit (joins git-network + jenkins_network, both must exist)
+9. Nginx (joins all networks, must be last)
 
 ## Key Files
 - `doc/setup-guide.md` — full build instructions from fresh Debian