🔐 Auth & TLS

Authelia access rule

File: /home/loca/dev/services/authelia/config/configuration.yml (root:root 644)

Edit procedure — stage in /tmp then install atomically:

sudo -n install -m 644 -o root -g root /tmp/configuration.yml /home/loca/dev/services/authelia/config/configuration.yml

YAML added inside access_control.rules:

    - domain: "cdsr.loca.zone"
      policy: one_factor

The rule sits alongside existing rules for auth.loca.zone, admin.loca.zone, omp.loca.zone, pwiz.loca.zone, trlm.loca.zone.

Why the wiki has no rule

Authelia runs with default_policy: bypass. An explicit rule for wiki.cdsr.loca.zone is intentionally omitted — the wiki remains public by omission while the app host becomes protected by explicit allowlisting.

Apply procedure

cd /home/loca/dev/services/authelia
sudo -n docker compose config
sudo -n docker compose restart
sudo -n docker compose ps

Authelia v4.39.20 restarts clean on loopback 127.0.0.1:51091. Session cookie domain loca.zone, authelia_url https://auth.loca.zone, expiration 1h, inactivity 5m.

Nginx topology

File: /etc/nginx/sites-available/cdsr.loca.zone (symlinked into sites-enabled), installed from deploy/cdsr.nginx.conf.

Four server blocks after Certbot:

• cdsr.loca.zone:443 — reverse proxy to http://127.0.0.1:52224
  • includes snippets/security-headers-app.conf
  • includes snippets/authelia-location.conf
  • location / protected by snippets/authelia-authrequest.conf
  • proxy_http_version 1.1, websocket headers (Upgrade, Connection), proxy_read_timeout 86400
• wiki.cdsr.loca.zone:443 — static root /home/loca/dev/wikis/cdsr/current
  • includes snippets/security-headers.conf
  • 1y immutable cache for css|js|png|webp|ico|json|woff2?|svg|map
  • try_files $uri $uri.html $uri/ =404
• cdsr.loca.zone:80 — ACME challenge from /var/www/html + 301 to HTTPS
• wiki.cdsr.loca.zone:80 — ACME challenge from /var/www/html + 301 to HTTPS

TLS certificate

Single lineage cdsr.loca.zone covering both hosts:

sudo -n certbot certonly --webroot -w /var/www/html --non-interactive --agree-tos -m admin@loca.zone --cert-name cdsr.loca.zone -d cdsr.loca.zone -d wiki.cdsr.loca.zone

Expiry: 2026-11-17, auto-renew scheduled. Certs at /etc/letsencrypt/live/cdsr.loca.zone/{fullchain,privkey}.pem.

If a partial lineage already exists, rerun with the same --cert-name and --expand instead of minting a second lineage.

sudo -n nginx -t emits a harmless pre-existing ssl_stapling warning about flxr.loca.zone — expected and safe to ignore.

Proof commands

# app host — unauthenticated redirect into Authelia
curl -sSI https://cdsr.loca.zone/
# -> HTTP/1.1 302
# -> Location: https://auth.loca.zone/?rd=https%3A%2F%2Fcdsr.loca.zone%2F&rm=HEAD
 
# wiki host — public, no auth redirect
curl -sSI https://wiki.cdsr.loca.zone/
# -> HTTP/1.1 200
# -> serves static content directly

Rollback / debug order if auth breaks

1. sudo -n nginx -t — config clean (ignore the pre-existing flxr ssl_stapling warning)
2. Confirm app 443 block includes both snippets:
   • include snippets/authelia-location.conf
   • location / { include snippets/authelia-authrequest.conf; ... }
3. Confirm Authelia rule present:
   • grep -A2 'domain: "cdsr.loca.zone"' /home/loca/dev/services/authelia/config/configuration.yml
4. Check Authelia container:
   • cd /home/loca/dev/services/authelia && sudo -n docker compose ps
   • cd /home/loca/dev/services/authelia && sudo -n docker compose logs --tail=50 authelia
5. Prove code-server itself is healthy (bypasses all auth/TLS):
   • curl -sf http://127.0.0.1:52224/healthz
   • should return {"status":"alive",...} when an editor session is active