Remove Authelia gate from Nexus and Docker registry

Nexus and registry.swave.lol now bypass Authelia entirely — Nexus
handles its own authentication for both the web UI and Docker clients.
auth_request removed from all nexus/registry nginx locations.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2 files changed, 8 insertions, 49 deletions

diff --git a/authelia/config/configuration.yml b/authelia/config/configuration.yml
index ace649e..4223001 100644
--- a/authelia/config/configuration.yml
+++ b/authelia/config/configuration.yml
@@ -94,17 +94,17 @@ access_control:
     - domain: jenkins.swave.lol
       policy: one_factor
 
-    # Nexus — requires login
+    # Nexus — bypass; Nexus handles its own authentication
     - domain: nexus.swave.lol
-      policy: one_factor
+      policy: bypass
     - domain: swave.lol
       resources:
         - '^/nexus(/.*)?$'
-      policy: one_factor
+      policy: bypass
 
-    # Docker registry — requires login
+    # Docker registry — bypass; Nexus handles its own Basic Auth for docker login
     - domain: registry.swave.lol
-      policy: one_factor
+      policy: bypass
 
 # OIDC provider — used by Jenkins for true SSO
 identity_providers:
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index 7ac081c..181a4cc 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -132,10 +132,8 @@ server {
         return 301 https://jenkins.swave.lol/$1;
     }
 
-    # Nexus via path prefix on main domain
+    # Nexus — no auth_request, Nexus handles its own authentication
     location /nexus {
-        auth_request /_authelia-auth;
-        auth_request_set $authelia_user $upstream_http_remote_user;
         proxy_pass http://nexus:8081/nexus;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
@@ -401,36 +399,14 @@ server {
         return 302 https://$host/nexus/;
     }
 
+    # No auth_request — Nexus handles its own authentication
     location /nexus {
-        auth_request /_authelia-auth;
-        auth_request_set $authelia_user $upstream_http_remote_user;
         proxy_pass http://nexus:8081/nexus;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
-
-    # Authelia forward-auth subrequest endpoint
-    location = /_authelia-auth {
-        internal;
-        resolver 127.0.0.11 valid=30s;
-        set $authelia_upstream http://authelia:9091/api/verify;
-        proxy_pass $authelia_upstream;
-        proxy_pass_request_body off;
-        proxy_set_header Content-Length "";
-        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
-        proxy_set_header X-Forwarded-Method $request_method;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Forwarded-Host $http_host;
-        proxy_set_header X-Forwarded-Uri $request_uri;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    }
-
-    error_page 401 = @authelia_login_redirect;
-    location @authelia_login_redirect {
-        return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri;
-    }
 }
 
 # Docker Registry — registry.swave.lol
@@ -466,9 +442,8 @@ server {
     client_max_body_size 2G;
     chunked_transfer_encoding on;
 
+    # No auth_request — Nexus handles Docker Basic Auth directly
     location / {
-        auth_request /_authelia-auth;
-        auth_request_set $authelia_user $upstream_http_remote_user;
         proxy_pass http://nexus:5000;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
@@ -476,22 +451,6 @@ server {
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 
-    # Authelia forward-auth subrequest endpoint
-    location = /_authelia-auth {
-        internal;
-        resolver 127.0.0.11 valid=30s;
-        set $authelia_upstream http://authelia:9091/api/verify;
-        proxy_pass $authelia_upstream;
-        proxy_pass_request_body off;
-        proxy_set_header Content-Length "";
-        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
-        proxy_set_header X-Forwarded-Method $request_method;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Forwarded-Host $http_host;
-        proxy_set_header X-Forwarded-Uri $request_uri;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    }
-
     error_page 401 = @authelia_login_redirect;
     location @authelia_login_redirect {
         return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri;