Add Netdata auth-request protection and fix Authelia rule ordering

- nginx: add /netdata/ location with auth_request and Cache-Control: no-store
  to prevent browser-cached pages from triggering CORS errors on API calls
- nginx: add explicit Cookie header forwarding to all /_authelia-auth
  subrequest locations (swave.lol, jenkins, gerrit server blocks)
- authelia: fix access_control rule ordering — move netdata/cockpit
  one_factor rules before the general swave.lol bypass rule so they
  are evaluated first (Authelia stops at first match)
- authelia: split blog/ghost bypass from swave.lol catch-all so the
  main domain bypass only applies after protected paths are checked

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 files changed, 25 insertions, 0 deletions

diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index 181a4cc..2c9f4cf 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -132,6 +132,28 @@ server {
         return 301 https://jenkins.swave.lol/$1;
     }
 
+    # Netdata — requires Authelia login
+    location = /netdata {
+        return 301 /netdata/;
+    }
+
+    location /netdata/ {
+        auth_request /_authelia-auth;
+        auth_request_set $authelia_user $upstream_http_remote_user;
+        proxy_pass http://172.24.0.2:19999/;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Server $host;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_read_timeout 86400;
+        # Prevent browser caching — ensures fresh requests always hit auth_request
+        add_header Cache-Control "no-store" always;
+    }
+
     # Nexus — no auth_request, Nexus handles its own authentication
     location /nexus {
         proxy_pass http://nexus:8081/nexus;
@@ -159,6 +181,7 @@ server {
         proxy_pass $authelia_upstream;
         proxy_pass_request_body off;
         proxy_set_header Content-Length "";
+        proxy_set_header Cookie $http_cookie;
         proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
         proxy_set_header X-Forwarded-Method $request_method;
         proxy_set_header X-Forwarded-Proto $scheme;
@@ -231,6 +254,7 @@ server {
         proxy_pass $authelia_upstream;
         proxy_pass_request_body off;
         proxy_set_header Content-Length "";
+        proxy_set_header Cookie $http_cookie;
         proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
         proxy_set_header X-Forwarded-Method $request_method;
         proxy_set_header X-Forwarded-Proto $scheme;
@@ -349,6 +373,7 @@ server {
         proxy_pass $authelia_upstream;
         proxy_pass_request_body off;
         proxy_set_header Content-Length "";
+        proxy_set_header Cookie $http_cookie;
         proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
         proxy_set_header X-Forwarded-Method $request_method;
         proxy_set_header X-Forwarded-Proto $scheme;