From 5c72caedeed28af783890339100f316632ab08be Mon Sep 17 00:00:00 2001
From: Arseney300 <Arseney300@gmail.com>
Date: Wed, 4 Mar 2026 10:08:15 +0700
Subject: Add Netdata auth-request protection and fix Authelia rule ordering
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- nginx: add /netdata/ location with auth_request and Cache-Control: no-store
  to prevent browser-cached pages from triggering CORS errors on API calls
- nginx: add explicit Cookie header forwarding to all /_authelia-auth
  subrequest locations (swave.lol, jenkins, gerrit server blocks)
- authelia: fix access_control rule ordering — move netdata/cockpit
  one_factor rules before the general swave.lol bypass rule so they
  are evaluated first (Authelia stops at first match)
- authelia: split blog/ghost bypass from swave.lol catch-all so the
  main domain bypass only applies after protected paths are checked

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 authelia/config/configuration.yml | 27 +++++++++++++++------------
 nginx/nginx.conf                  | 25 +++++++++++++++++++++++++
 2 files changed, 40 insertions(+), 12 deletions(-)

diff --git a/authelia/config/configuration.yml b/authelia/config/configuration.yml
index 4223001..494b4c4 100644
--- a/authelia/config/configuration.yml
+++ b/authelia/config/configuration.yml
@@ -51,33 +51,36 @@ access_control:
     - domain: auth.swave.lol
       policy: bypass
 
-    # Public services — no auth required
+    # blog/ghost subdomains — fully public
     - domain:
-        - swave.lol
         - blog.swave.lol
         - ghost.swave.lol
       policy: bypass
 
-    # Cgit — public read-only git browser
-    - domain: cgit.swave.lol
-      policy: bypass
-    - domain: swave.lol
-      resources:
-        - '^/cgit(/.*)?$'
-      policy: bypass
-
-    # Netdata — requires login
+    # Netdata — requires login (must be before the general swave.lol bypass)
     - domain: swave.lol
       resources:
         - '^/netdata(/.*)?$'
       policy: one_factor
 
-    # Cockpit — requires login
+    # Cockpit — requires login (must be before the general swave.lol bypass)
     - domain: swave.lol
       resources:
         - '^/cockpit(/.*)?$'
       policy: one_factor
 
+    # Cgit — public read-only git browser
+    - domain: cgit.swave.lol
+      policy: bypass
+    - domain: swave.lol
+      resources:
+        - '^/cgit(/.*)?$'
+      policy: bypass
+
+    # swave.lol main domain — public (Ghost blog), catch-all after protected resources above
+    - domain: swave.lol
+      policy: bypass
+
     # Gerrit login — auth_request on /login/ injects X-Forwarded-User once, Gerrit
     # maintains its own session from there; anonymous users never hit /login/ directly
     - domain: gerrit.swave.lol
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index 181a4cc..2c9f4cf 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -132,6 +132,28 @@ server {
         return 301 https://jenkins.swave.lol/$1;
     }
 
+    # Netdata — requires Authelia login
+    location = /netdata {
+        return 301 /netdata/;
+    }
+
+    location /netdata/ {
+        auth_request /_authelia-auth;
+        auth_request_set $authelia_user $upstream_http_remote_user;
+        proxy_pass http://172.24.0.2:19999/;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Server $host;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_read_timeout 86400;
+        # Prevent browser caching — ensures fresh requests always hit auth_request
+        add_header Cache-Control "no-store" always;
+    }
+
     # Nexus — no auth_request, Nexus handles its own authentication
     location /nexus {
         proxy_pass http://nexus:8081/nexus;
@@ -159,6 +181,7 @@ server {
         proxy_pass $authelia_upstream;
         proxy_pass_request_body off;
         proxy_set_header Content-Length "";
+        proxy_set_header Cookie $http_cookie;
         proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
         proxy_set_header X-Forwarded-Method $request_method;
         proxy_set_header X-Forwarded-Proto $scheme;
@@ -231,6 +254,7 @@ server {
         proxy_pass $authelia_upstream;
         proxy_pass_request_body off;
         proxy_set_header Content-Length "";
+        proxy_set_header Cookie $http_cookie;
         proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
         proxy_set_header X-Forwarded-Method $request_method;
         proxy_set_header X-Forwarded-Proto $scheme;
@@ -349,6 +373,7 @@ server {
         proxy_pass $authelia_upstream;
         proxy_pass_request_body off;
         proxy_set_header Content-Length "";
+        proxy_set_header Cookie $http_cookie;
         proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
         proxy_set_header X-Forwarded-Method $request_method;
         proxy_set_header X-Forwarded-Proto $scheme;
-- 
cgit v1.2.3