Add Authelia SSO, Jenkins OIDC, Gerrit HTTP auth, and related config

- authelia/: Full Authelia stack (docker-compose, config, setup guide, nginx snippet)
  - Forward-auth for Netdata, Cockpit, Nexus, registry
  - OIDC provider for Jenkins (oic-auth plugin, authorization_policy: one_factor)
  - HTTP header auth for Gerrit (X-Forwarded-User on /login/ only)
  - authelia_network: 172.26.0.0/16
- nginx/nginx.conf:
  - auth.swave.lol server block
  - /_authelia-auth internal subrequest locations (resolver 127.0.0.11)
  - auth_request on Gerrit /login/, Jenkins, Nexus, registry
  - OIDC finishLogin bypass for Jenkins
  - swave.lol/gerrit and swave.lol/jenkins redirect to subdomains
  - proxy_redirect for Gerrit container hostname rewrites
- nginx/docker-compose.yaml: joined authelia_network
- nginx/run_certbot.sh: added auth.swave.lol
- jenkins/docker-compose.yaml: removed --prefix=/jenkins (Jenkins now at /)
- cockpit/nginx-authelia.conf, netdata/nginx-netdata.conf: added auth_request
- git-server/gerrit.config.example: Gerrit config template (real config gitignored)
- .gitignore: added users_database.yml, gerrit.config
- CLAUDE.md: updated Jenkins, Gerrit, Authelia entries; added key files
- doc/setup-guide.md: Authelia section, updated startup order and service table

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2 files changed, 162 insertions, 0 deletions

diff --git a/authelia/config/configuration.yml b/authelia/config/configuration.yml
new file mode 100644
index 0000000..ace649e
--- /dev/null
+++ b/authelia/config/configuration.yml
@@ -0,0 +1,134 @@
+---
+# Authelia configuration for swave.lol
+
+server:
+  address: 'tcp://0.0.0.0:9091'
+
+log:
+  level: info
+
+# Session cookie covers all *.swave.lol subdomains — one login, all services
+session:
+  name: authelia_session
+  expiration: 3600    # 1 hour
+  inactivity: 300     # 5 minutes idle timeout
+  remember_me: 1M
+  redis:
+    host: authelia-redis
+    port: 6379
+  cookies:
+    - domain: swave.lol
+      authelia_url: https://auth.swave.lol
+      default_redirection_url: https://swave.lol
+
+# SQLite storage — simple, no extra container needed
+storage:
+  local:
+    path: /data/db.sqlite3
+
+# Filesystem notifier — upgrade to SMTP later (see setup.md)
+notifier:
+  filesystem:
+    filename: /data/notification.txt
+
+# User database (argon2id hashed passwords)
+authentication_backend:
+  file:
+    path: /config/users_database.yml
+    password:
+      algorithm: argon2id
+      iterations: 3
+      memory: 65536
+      parallelism: 4
+      key_length: 32
+      salt_length: 16
+
+# Default deny — only explicitly bypassed or permitted resources are accessible
+access_control:
+  default_policy: deny
+  rules:
+    # Auth portal itself — must be accessible without auth
+    - domain: auth.swave.lol
+      policy: bypass
+
+    # Public services — no auth required
+    - domain:
+        - swave.lol
+        - blog.swave.lol
+        - ghost.swave.lol
+      policy: bypass
+
+    # Cgit — public read-only git browser
+    - domain: cgit.swave.lol
+      policy: bypass
+    - domain: swave.lol
+      resources:
+        - '^/cgit(/.*)?$'
+      policy: bypass
+
+    # Netdata — requires login
+    - domain: swave.lol
+      resources:
+        - '^/netdata(/.*)?$'
+      policy: one_factor
+
+    # Cockpit — requires login
+    - domain: swave.lol
+      resources:
+        - '^/cockpit(/.*)?$'
+      policy: one_factor
+
+    # Gerrit login — auth_request on /login/ injects X-Forwarded-User once, Gerrit
+    # maintains its own session from there; anonymous users never hit /login/ directly
+    - domain: gerrit.swave.lol
+      resources:
+        - '^/login(/.*)?$'
+      policy: one_factor
+
+    # Gerrit general — public read, no auth_request needed on other paths
+    - domain: gerrit.swave.lol
+      policy: bypass
+
+
+    # Jenkins — requires login (OIDC)
+    - domain: jenkins.swave.lol
+      policy: one_factor
+
+    # Nexus — requires login
+    - domain: nexus.swave.lol
+      policy: one_factor
+    - domain: swave.lol
+      resources:
+        - '^/nexus(/.*)?$'
+      policy: one_factor
+
+    # Docker registry — requires login
+    - domain: registry.swave.lol
+      policy: one_factor
+
+# OIDC provider — used by Jenkins for true SSO
+identity_providers:
+  oidc:
+    # HMAC secret loaded via AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE env var
+    # RSA key loaded from file via template below
+    jwks:
+      - key: |
+          OIDC_RSA_KEY_PLACEHOLDER
+    clients:
+      - client_id: jenkins
+        client_name: Jenkins CI
+        # Hash generated with: authelia crypto hash generate argon2 --password 'YOUR_SECRET'
+        client_secret: '$argon2id$v=19$m=65536,t=3,p=4$REPLACE_WITH_REAL_HASH'
+        authorization_policy: one_factor
+        redirect_uris:
+          - https://jenkins.swave.lol/securityRealm/finishLogin
+        scopes:
+          - openid
+          - profile
+          - email
+          - groups
+        grant_types:
+          - authorization_code
+        response_types:
+          - code
+        userinfo_signed_response_alg: none
diff --git a/authelia/config/users_database.yml.example b/authelia/config/users_database.yml.example
new file mode 100644
index 0000000..1cd73f3
--- /dev/null
+++ b/authelia/config/users_database.yml.example
@@ -0,0 +1,28 @@
+---
+# Authelia users database example
+#
+# Copy this file to users_database.yml and fill in real values.
+# The actual users_database.yml is gitignored (contains password hashes).
+#
+# Generate an argon2id hash for a password:
+#   docker run --rm authelia/authelia:latest authelia crypto hash generate argon2 --password 'yourpassword'
+#
+# Group membership controls access if you add group-based rules later.
+
+users:
+  admin:
+    displayname: Admin
+    # Replace with hash from: authelia crypto hash generate argon2 --password 'yourpassword'
+    password: '$argon2id$v=19$m=65536,t=3,p=4$REPLACE_WITH_REAL_HASH$REPLACE_WITH_REAL_HASH'
+    email: admin@swave.lol
+    groups:
+      - admins
+      - developers
+
+  # Example: add more users here
+  # alice:
+  #   displayname: Alice
+  #   password: '$argon2id$v=19$m=65536,t=3,p=4$...$...'
+  #   email: alice@swave.lol
+  #   groups:
+  #     - developers