From 0a904c2e055a753ec8627075399140f6250e4c95 Mon Sep 17 00:00:00 2001 From: Arseney300 Date: Wed, 4 Mar 2026 10:11:13 +0700 Subject: docs: update CLAUDE.md with Netdata service and auth notes - Add Netdata service entry (monitoring_network, auth_request, Cache-Control) - Fix Authelia forward-auth list (Nexus is bypass, not forward-auth) - Add rule ordering warning to Authelia entry - Add Cookie header forwarding note to Nginx entry - Add monitoring_network to networking and startup order sections Co-Authored-By: Claude Sonnet 4.6 --- CLAUDE.md | 28 ++++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index c892d9f..b8ea80f 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -84,6 +84,17 @@ Bastion is a self-hosted server system on Debian that runs multiple services in - Docker registry accessible at `https://registry.swave.lol` - Docker registry requires manual setup after first login: create a "docker (hosted)" repository with HTTP connector on port 5000 +### Netdata (monitoring) +- Dir: `netdata/` +- Compose: `netdata/docker-compose.yaml` +- Image: `netdata/netdata:latest` +- Network: `monitoring_network` (172.24.0.0/16, static IP 172.24.0.2), port 19999 internally +- No host ports (accessed only via main nginx reverse proxy) +- Accessible at `https://swave.lol/netdata/` +- Auth: Authelia forward-auth (one_factor) — protected via nginx auth_request on the /netdata/ location +- nginx proxies with `Cache-Control: no-store` to prevent browser caching (avoids CORS errors on cached API calls) +- nginx-netdata.conf snippet: `netdata/nginx-netdata.conf` + ### Authelia (SSO / authentication) - Dir: `authelia/` - Compose: `authelia/docker-compose.yaml` @@ -93,16 +104,18 @@ Bastion is a self-hosted server system on Debian that runs multiple services in - Volumes: `/var/authelia/config`, `/var/authelia/data`, `/var/authelia/secrets` (ro), `/var/authelia/redis` - Secrets loaded from files in `/var/authelia/secrets/` (JWT, session, storage encryption, OIDC HMAC, OIDC RSA key) - Accessible at `https://auth.swave.lol` -- Forward-auth for: Gerrit, Jenkins, Nexus, Netdata, Cockpit +- Forward-auth (auth_request) for: Netdata, Cockpit, Gerrit (/login path), Jenkins - OIDC provider for Jenkins (full SSO) - HTTP header injection for Gerrit (`X-Forwarded-User`) +- Nexus and Docker registry: bypass (Nexus handles its own auth) - Ghost and Cgit remain public (no auth) - Setup guide: `authelia/setup.md` +- IMPORTANT: access_control rules are evaluated top-down, first match wins — specific resource rules (netdata, cockpit) must appear BEFORE the general `swave.lol` bypass rule ### Nginx (reverse proxy) - Dir: `nginx/` - Compose: `nginx/docker-compose.yaml` -- Network: joins `git-network` (IP 172.22.0.254), `ghost_network`, `jenkins_network`, `nexus_network`, `authelia_network` +- Network: joins `git-network` (IP 172.22.0.254), `ghost_network`, `jenkins_network`, `monitoring_network`, `nexus_network`, `authelia_network` - Ports: 80 (HTTP, redirects to HTTPS), 443 (HTTPS) - Config mounted from `/var/nginx/conf/` on host - SSL: Let's Encrypt certs via `run_certbot.sh`, dhparam at `/var/dh_param/` @@ -110,12 +123,14 @@ Bastion is a self-hosted server system on Debian that runs multiple services in - Default catch-all server blocks return 404 error page for unknown subdomains - Error page: `nginx/error-pages/unknown-host.html` - IMPORTANT: SSL server blocks must be commented out for first run (before certs exist) +- All `/_authelia-auth` subrequest locations explicitly set `proxy_set_header Cookie $http_cookie` to ensure session cookies reach Authelia ## Networking Each stack has its own Docker network. Nginx joins all of them to reverse proxy: - `git-network` — git-server + cgit + gerrit + nginx - `ghost_network` — ghost + ghost-db + nginx - `jenkins_network` — jenkins + git-server + gerrit + nginx +- `monitoring_network` — netdata + nginx - `nexus_network` — nexus + nginx - `authelia_network` — authelia + authelia-redis + nginx @@ -124,10 +139,11 @@ Each stack has its own Docker network. Nginx joins all of them to reverse proxy: 2. Git Server (creates git-network) 3. Ghost (creates ghost_network) 4. Jenkins (creates jenkins_network) -5. Nexus (creates nexus_network) -6. Authelia (creates authelia_network) -7. Gerrit (joins git-network + jenkins_network, both must exist) -8. Nginx (joins all networks, must be last) +5. Netdata (creates monitoring_network) +6. Nexus (creates nexus_network) +7. Authelia (creates authelia_network) +8. Gerrit (joins git-network + jenkins_network, both must exist) +9. Nginx (joins all networks, must be last) ## Key Files - `doc/setup-guide.md` — full build instructions from fresh Debian -- cgit v1.2.3