Add Authelia SSO, Jenkins OIDC, Gerrit HTTP auth, and related config

- authelia/: Full Authelia stack (docker-compose, config, setup guide, nginx snippet)
  - Forward-auth for Netdata, Cockpit, Nexus, registry
  - OIDC provider for Jenkins (oic-auth plugin, authorization_policy: one_factor)
  - HTTP header auth for Gerrit (X-Forwarded-User on /login/ only)
  - authelia_network: 172.26.0.0/16
- nginx/nginx.conf:
  - auth.swave.lol server block
  - /_authelia-auth internal subrequest locations (resolver 127.0.0.11)
  - auth_request on Gerrit /login/, Jenkins, Nexus, registry
  - OIDC finishLogin bypass for Jenkins
  - swave.lol/gerrit and swave.lol/jenkins redirect to subdomains
  - proxy_redirect for Gerrit container hostname rewrites
- nginx/docker-compose.yaml: joined authelia_network
- nginx/run_certbot.sh: added auth.swave.lol
- jenkins/docker-compose.yaml: removed --prefix=/jenkins (Jenkins now at /)
- cockpit/nginx-authelia.conf, netdata/nginx-netdata.conf: added auth_request
- git-server/gerrit.config.example: Gerrit config template (real config gitignored)
- .gitignore: added users_database.yml, gerrit.config
- CLAUDE.md: updated Jenkins, Gerrit, Authelia entries; added key files
- doc/setup-guide.md: Authelia section, updated startup order and service table

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 files changed, 116 insertions, 31 deletions

diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index 382ee62..7ac081c 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -115,27 +115,21 @@ server {
         proxy_redirect / /cgit/;
     }
 
-    # Gerrit via path prefix on main domain
-    location /gerrit {
-        auth_request /_authelia-auth;
-        auth_request_set $authelia_user $upstream_http_remote_user;
-        proxy_pass http://gerrit:8080/gerrit;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Forwarded-User $authelia_user;
+
+    # Gerrit — redirect to subdomain (Gerrit doesn't support subpath proxying)
+    location = /gerrit {
+        return 301 https://gerrit.swave.lol/;
+    }
+    location ~ ^/gerrit/(.*)$ {
+        return 301 https://gerrit.swave.lol/$1;
     }
 
-    # Jenkins via path prefix on main domain
-    location /jenkins {
-        auth_request /_authelia-auth;
-        auth_request_set $authelia_user $upstream_http_remote_user;
-        proxy_pass http://jenkins:8080/jenkins;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
+    # Jenkins — redirect to subdomain (strips /jenkins prefix)
+    location = /jenkins {
+        return 301 https://jenkins.swave.lol/;
+    }
+    location ~ ^/jenkins/(.*)$ {
+        return 301 https://jenkins.swave.lol/$1;
     }
 
     # Nexus via path prefix on main domain
@@ -162,7 +156,9 @@ server {
     # Authelia forward-auth subrequest endpoint
     location = /_authelia-auth {
         internal;
-        proxy_pass http://authelia:9091/api/verify;
+        resolver 127.0.0.11 valid=30s;
+        set $authelia_upstream http://authelia:9091/api/verify;
+        proxy_pass $authelia_upstream;
         proxy_pass_request_body off;
         proxy_set_header Content-Length "";
         proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
@@ -210,16 +206,19 @@ server {
 
     charset utf-8;
 
-    # Jenkins requires --prefix=/jenkins, so all URLs must go through /jenkins
-    # Redirect root to /jenkins, then proxy /jenkins to Jenkins
-    location = / {
-        return 302 https://$host/jenkins/;
+    # OIDC callback — must bypass auth_request so Jenkins can process the code/state
+    location = /securityRealm/finishLogin {
+        proxy_pass http://jenkins:8080/securityRealm/finishLogin;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
     }
 
-    location /jenkins {
+    location / {
         auth_request /_authelia-auth;
         auth_request_set $authelia_user $upstream_http_remote_user;
-        proxy_pass http://jenkins:8080/jenkins;
+        proxy_pass http://jenkins:8080;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -229,7 +228,9 @@ server {
     # Authelia forward-auth subrequest endpoint
     location = /_authelia-auth {
         internal;
-        proxy_pass http://authelia:9091/api/verify;
+        resolver 127.0.0.11 valid=30s;
+        set $authelia_upstream http://authelia:9091/api/verify;
+        proxy_pass $authelia_upstream;
         proxy_pass_request_body off;
         proxy_set_header Content-Length "";
         proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
@@ -317,21 +318,37 @@ server {
 
     charset utf-8;
 
-    location / {
+    # /login/ — auth_request fires here, X-Forwarded-User injected, Gerrit creates session
+    location /login {
         auth_request /_authelia-auth;
         auth_request_set $authelia_user $upstream_http_remote_user;
-        proxy_pass http://gerrit:8080;
+        proxy_pass http://gerrit:8080/login;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_set_header X-Forwarded-User $authelia_user;
+        proxy_redirect http://gerrit:8080/ https://gerrit.swave.lol/;
+        proxy_redirect ~^http://[^/]+/(.*)$ https://gerrit.swave.lol/$1;
+    }
+
+    # All other paths — no auth_request, anonymous access allowed, Gerrit session cookie handles login state
+    location / {
+        proxy_pass http://gerrit:8080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_redirect http://gerrit:8080/ https://gerrit.swave.lol/;
+        proxy_redirect ~^http://[^/]+/(.*)$ https://gerrit.swave.lol/$1;
     }
 
     # Authelia forward-auth subrequest endpoint
     location = /_authelia-auth {
         internal;
-        proxy_pass http://authelia:9091/api/verify;
+        resolver 127.0.0.11 valid=30s;
+        set $authelia_upstream http://authelia:9091/api/verify;
+        proxy_pass $authelia_upstream;
         proxy_pass_request_body off;
         proxy_set_header Content-Length "";
         proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
@@ -397,7 +414,9 @@ server {
     # Authelia forward-auth subrequest endpoint
     location = /_authelia-auth {
         internal;
-        proxy_pass http://authelia:9091/api/verify;
+        resolver 127.0.0.11 valid=30s;
+        set $authelia_upstream http://authelia:9091/api/verify;
+        proxy_pass $authelia_upstream;
         proxy_pass_request_body off;
         proxy_set_header Content-Length "";
         proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
@@ -448,10 +467,76 @@ server {
     chunked_transfer_encoding on;
 
     location / {
+        auth_request /_authelia-auth;
+        auth_request_set $authelia_user $upstream_http_remote_user;
         proxy_pass http://nexus:5000;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
+
+    # Authelia forward-auth subrequest endpoint
+    location = /_authelia-auth {
+        internal;
+        resolver 127.0.0.11 valid=30s;
+        set $authelia_upstream http://authelia:9091/api/verify;
+        proxy_pass $authelia_upstream;
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+        proxy_set_header X-Forwarded-Method $request_method;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Uri $request_uri;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+
+    error_page 401 = @authelia_login_redirect;
+    location @authelia_login_redirect {
+        return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri;
+    }
+}
+
+# Authelia — auth.swave.lol
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+
+    server_name auth.swave.lol;
+
+    server_tokens off;
+
+    ssl_certificate /var/letsencrypt/etc/live/swave.lol/fullchain.pem;
+    ssl_certificate_key /var/letsencrypt/etc/live/swave.lol/privkey.pem;
+
+    ssl_buffer_size 8k;
+
+    ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+
+    ssl_ecdh_curve secp384r1;
+    ssl_session_tickets off;
+
+    # OCSP stapling
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    resolver 8.8.8.8;
+
+    charset utf-8;
+
+    location / {
+        resolver 127.0.0.11 valid=30s;
+        set $authelia_upstream http://authelia:9091;
+        proxy_pass $authelia_upstream;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $http_host;
+    }
 }