diff options
| author | Arseney300 <Arseney300@gmail.com> | 2026-03-04 10:08:15 +0700 |
|---|---|---|
| committer | Arseney300 <Arseney300@gmail.com> | 2026-03-04 10:08:15 +0700 |
| commit | 5c72caedeed28af783890339100f316632ab08be (patch) | |
| tree | 10161369330e1e753e05058c9572ea94617f2e73 /authelia | |
| parent | 7d92d0f87afef181f719483030b907f578fdfbb2 (diff) | |
Add Netdata auth-request protection and fix Authelia rule ordering
- nginx: add /netdata/ location with auth_request and Cache-Control: no-store
to prevent browser-cached pages from triggering CORS errors on API calls
- nginx: add explicit Cookie header forwarding to all /_authelia-auth
subrequest locations (swave.lol, jenkins, gerrit server blocks)
- authelia: fix access_control rule ordering — move netdata/cockpit
one_factor rules before the general swave.lol bypass rule so they
are evaluated first (Authelia stops at first match)
- authelia: split blog/ghost bypass from swave.lol catch-all so the
main domain bypass only applies after protected paths are checked
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Diffstat (limited to 'authelia')
| -rw-r--r-- | authelia/config/configuration.yml | 27 |
1 files changed, 15 insertions, 12 deletions
diff --git a/authelia/config/configuration.yml b/authelia/config/configuration.yml index 4223001..494b4c4 100644 --- a/authelia/config/configuration.yml +++ b/authelia/config/configuration.yml @@ -51,33 +51,36 @@ access_control: - domain: auth.swave.lol policy: bypass - # Public services — no auth required + # blog/ghost subdomains — fully public - domain: - - swave.lol - blog.swave.lol - ghost.swave.lol policy: bypass - # Cgit — public read-only git browser - - domain: cgit.swave.lol - policy: bypass - - domain: swave.lol - resources: - - '^/cgit(/.*)?$' - policy: bypass - - # Netdata — requires login + # Netdata — requires login (must be before the general swave.lol bypass) - domain: swave.lol resources: - '^/netdata(/.*)?$' policy: one_factor - # Cockpit — requires login + # Cockpit — requires login (must be before the general swave.lol bypass) - domain: swave.lol resources: - '^/cockpit(/.*)?$' policy: one_factor + # Cgit — public read-only git browser + - domain: cgit.swave.lol + policy: bypass + - domain: swave.lol + resources: + - '^/cgit(/.*)?$' + policy: bypass + + # swave.lol main domain — public (Ghost blog), catch-all after protected resources above + - domain: swave.lol + policy: bypass + # Gerrit login — auth_request on /login/ injects X-Forwarded-User once, Gerrit # maintains its own session from there; anonymous users never hit /login/ directly - domain: gerrit.swave.lol |