| Age | Commit message (Collapse) | Author |
|---|
|
- nginx: add /netdata/ location with auth_request and Cache-Control: no-store
to prevent browser-cached pages from triggering CORS errors on API calls
- nginx: add explicit Cookie header forwarding to all /_authelia-auth
subrequest locations (swave.lol, jenkins, gerrit server blocks)
- authelia: fix access_control rule ordering — move netdata/cockpit
one_factor rules before the general swave.lol bypass rule so they
are evaluated first (Authelia stops at first match)
- authelia: split blog/ghost bypass from swave.lol catch-all so the
main domain bypass only applies after protected paths are checked
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
|
Nexus and registry.swave.lol now bypass Authelia entirely — Nexus
handles its own authentication for both the web UI and Docker clients.
auth_request removed from all nexus/registry nginx locations.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
|
- authelia/: Full Authelia stack (docker-compose, config, setup guide, nginx snippet)
- Forward-auth for Netdata, Cockpit, Nexus, registry
- OIDC provider for Jenkins (oic-auth plugin, authorization_policy: one_factor)
- HTTP header auth for Gerrit (X-Forwarded-User on /login/ only)
- authelia_network: 172.26.0.0/16
- nginx/nginx.conf:
- auth.swave.lol server block
- /_authelia-auth internal subrequest locations (resolver 127.0.0.11)
- auth_request on Gerrit /login/, Jenkins, Nexus, registry
- OIDC finishLogin bypass for Jenkins
- swave.lol/gerrit and swave.lol/jenkins redirect to subdomains
- proxy_redirect for Gerrit container hostname rewrites
- nginx/docker-compose.yaml: joined authelia_network
- nginx/run_certbot.sh: added auth.swave.lol
- jenkins/docker-compose.yaml: removed --prefix=/jenkins (Jenkins now at /)
- cockpit/nginx-authelia.conf, netdata/nginx-netdata.conf: added auth_request
- git-server/gerrit.config.example: Gerrit config template (real config gitignored)
- .gitignore: added users_database.yml, gerrit.config
- CLAUDE.md: updated Jenkins, Gerrit, Authelia entries; added key files
- doc/setup-guide.md: Authelia section, updated startup order and service table
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
|
Nexus provides artifact storage (Maven, raw, etc.) and a private Docker
registry at registry.swave.lol. Authelia forward-auth protects Gerrit,
Jenkins, and Nexus behind SSO. Includes setup guide, nginx config,
certbot domains, and a Jenkins pipeline example for artifact uploads.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
Add ghost.swave.lol as Ghost alias in nginx and certbot. Add default
server blocks that serve a styled 404 error page for any subdomain
not configured on the server.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
Use sub_filter to rewrite href/action attributes (both quote styles)
to include /cgit prefix, and proxy_redirect to catch cgit's HTTP
redirects. Fixes broken navigation on path-based access while leaving
cgit.swave.lol subdomain unaffected.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
Jenkins requires --prefix=/jenkins for path-based access on swave.lol.
Redirect subdomain root to /jenkins/ and proxy the prefix path to
Jenkins, avoiding double-prefix redirect loops.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
Gerrit joins git-network (repo access) and jenkins_network (build triggers),
uses the official gerritcodereview/gerrit image with persistent storage under
/var/gerrit, and is reverse-proxied via nginx at gerrit.swave.lol and
swave.lol/gerrit. Updated certbot, setup guide, and project docs accordingly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
The subdomain proxy was passing /jenkins to Jenkins which already
adds the prefix via --prefix=/jenkins, resulting in /jenkinsjenkins/.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
|
|
Cgit was generating links to /cgit.css which, when accessed via
swave.lol/cgit, routed to Ghost instead of the cgit container.
Set css/logo paths to /cgit-css/ in cgitrc and add a /cgit-css/
proxy location in the main nginx config.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
|
|
The commented-out 8000 port had extra indentation that made YAML
parse it as part of the 80:80 value, causing no ports to be published.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
Adds a lightweight cgit container (Alpine + fcgiwrap + nginx) that
auto-discovers bare repos via scan-path and serves them read-only.
Accessible at both cgit.swave.lol and swave.lol/cgit through the
main nginx reverse proxy.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
- Add jenkins_network to nginx compose (for reaching Jenkins container)
- Add jenkins.swave.lol server block in nginx.conf (subdomain access)
- Add /jenkins location on swave.lol (path-based access)
- Add jenkins.swave.lol to certbot certificate request
Jenkins is accessible via both https://jenkins.swave.lol
and https://swave.lol/jenkins
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
The SSL cert now covers both swave.lol and blog.swave.lol
to match the updated nginx server_name configuration.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
- Fix server_name from swave.com to swave.lol on SSL block
- Add blog.swave.lol as additional server_name
- Update SSL protocols to TLSv1.2 and TLSv1.3 only (remove deprecated TLSv1/1.1)
- Use modern cipher suite
- Add reverse proxy location block to forward requests to Ghost (ghost:2368)
- Add proper proxy headers (Host, X-Real-IP, X-Forwarded-For, X-Forwarded-Proto)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
Nginx needs access to ghost_network to reverse proxy
requests to the Ghost service.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
Add Docker configurations for Ghost, Git server, and Nginx services
with documentation and architecture diagrams.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
