Add Authelia SSO, Jenkins OIDC, Gerrit HTTP auth, and related config

- authelia/: Full Authelia stack (docker-compose, config, setup guide, nginx snippet)
  - Forward-auth for Netdata, Cockpit, Nexus, registry
  - OIDC provider for Jenkins (oic-auth plugin, authorization_policy: one_factor)
  - HTTP header auth for Gerrit (X-Forwarded-User on /login/ only)
  - authelia_network: 172.26.0.0/16
- nginx/nginx.conf:
  - auth.swave.lol server block
  - /_authelia-auth internal subrequest locations (resolver 127.0.0.11)
  - auth_request on Gerrit /login/, Jenkins, Nexus, registry
  - OIDC finishLogin bypass for Jenkins
  - swave.lol/gerrit and swave.lol/jenkins redirect to subdomains
  - proxy_redirect for Gerrit container hostname rewrites
- nginx/docker-compose.yaml: joined authelia_network
- nginx/run_certbot.sh: added auth.swave.lol
- jenkins/docker-compose.yaml: removed --prefix=/jenkins (Jenkins now at /)
- cockpit/nginx-authelia.conf, netdata/nginx-netdata.conf: added auth_request
- git-server/gerrit.config.example: Gerrit config template (real config gitignored)
- .gitignore: added users_database.yml, gerrit.config
- CLAUDE.md: updated Jenkins, Gerrit, Authelia entries; added key files
- doc/setup-guide.md: Authelia section, updated startup order and service table

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 files changed, 2 insertions, 0 deletions

diff --git a/netdata/nginx-netdata.conf b/netdata/nginx-netdata.conf
index 9151d4c..d0d5f06 100644
--- a/netdata/nginx-netdata.conf
+++ b/netdata/nginx-netdata.conf
@@ -10,6 +10,8 @@ location = /netdata {
 }
 
 location /netdata/ {
+    auth_request /_authelia-auth;
+    auth_request_set $authelia_user $upstream_http_remote_user;
     proxy_pass http://172.24.0.2:19999/;
     proxy_http_version 1.1;
     proxy_set_header Upgrade $http_upgrade;