99 lines
4.0 KiB
Markdown
99 lines
4.0 KiB
Markdown
---
|
|
title: 🔐 Auth & TLS
|
|
description: Authelia access rule, nginx four-block topology, shared certificate lineage, proof commands, and rollback/debug order for the code-server SSO-gated stack.
|
|
source: verified deployment on the loca operator host, 2026-08-19
|
|
reviewed: 2026-08-19
|
|
---
|
|
|
|
# 🔐 Auth & TLS
|
|
|
|
## Authelia access rule
|
|
|
|
File: `/home/loca/dev/services/authelia/config/configuration.yml` (root:root 644)
|
|
|
|
Edit procedure — stage in `/tmp` then install atomically:
|
|
```bash
|
|
sudo -n install -m 644 -o root -g root /tmp/configuration.yml /home/loca/dev/services/authelia/config/configuration.yml
|
|
```
|
|
|
|
YAML added inside `access_control.rules`:
|
|
```yaml
|
|
- domain: "cdsr.loca.zone"
|
|
policy: one_factor
|
|
```
|
|
|
|
The rule sits alongside existing rules for `auth.loca.zone`, `admin.loca.zone`, `omp.loca.zone`, `pwiz.loca.zone`, `trlm.loca.zone`.
|
|
|
|
## Why the wiki has no rule
|
|
|
|
Authelia runs with `default_policy: bypass`. An explicit rule for `wiki.cdsr.loca.zone` is intentionally omitted — the wiki remains public by omission while the app host becomes protected by explicit allowlisting.
|
|
|
|
## Apply procedure
|
|
|
|
```bash
|
|
cd /home/loca/dev/services/authelia
|
|
sudo -n docker compose config
|
|
sudo -n docker compose restart
|
|
sudo -n docker compose ps
|
|
```
|
|
|
|
Authelia v4.39.20 restarts clean on loopback `127.0.0.1:51091`. Session cookie domain `loca.zone`, `authelia_url https://auth.loca.zone`, expiration 1h, inactivity 5m.
|
|
|
|
## Nginx topology
|
|
|
|
File: `/etc/nginx/sites-available/cdsr.loca.zone` (symlinked into `sites-enabled`), installed from `deploy/cdsr.nginx.conf`.
|
|
|
|
Four server blocks after Certbot:
|
|
- `cdsr.loca.zone:443` — reverse proxy to `http://127.0.0.1:52224`
|
|
- includes `snippets/security-headers-app.conf`
|
|
- includes `snippets/authelia-location.conf`
|
|
- `location /` protected by `snippets/authelia-authrequest.conf`
|
|
- `proxy_http_version 1.1`, websocket headers (`Upgrade`, `Connection`), `proxy_read_timeout 86400`
|
|
- `wiki.cdsr.loca.zone:443` — static root `/home/loca/dev/wikis/cdsr/current`
|
|
- includes `snippets/security-headers.conf`
|
|
- 1y immutable cache for `css|js|png|webp|ico|json|woff2?|svg|map`
|
|
- `try_files $uri $uri.html $uri/ =404`
|
|
- `cdsr.loca.zone:80` — ACME challenge from `/var/www/html` + 301 to HTTPS
|
|
- `wiki.cdsr.loca.zone:80` — ACME challenge from `/var/www/html` + 301 to HTTPS
|
|
|
|
## TLS certificate
|
|
|
|
Single lineage `cdsr.loca.zone` covering both hosts:
|
|
```bash
|
|
sudo -n certbot certonly --webroot -w /var/www/html --non-interactive --agree-tos -m admin@loca.zone --cert-name cdsr.loca.zone -d cdsr.loca.zone -d wiki.cdsr.loca.zone
|
|
```
|
|
|
|
Expiry: 2026-11-17, auto-renew scheduled. Certs at `/etc/letsencrypt/live/cdsr.loca.zone/{fullchain,privkey}.pem`.
|
|
|
|
If a partial lineage already exists, rerun with the same `--cert-name` and `--expand` instead of minting a second lineage.
|
|
|
|
`sudo -n nginx -t` emits a harmless pre-existing `ssl_stapling` warning about `flxr.loca.zone` — expected and safe to ignore.
|
|
|
|
## Proof commands
|
|
|
|
```bash
|
|
# app host — unauthenticated redirect into Authelia
|
|
curl -sSI https://cdsr.loca.zone/
|
|
# -> HTTP/1.1 302
|
|
# -> Location: https://auth.loca.zone/?rd=https%3A%2F%2Fcdsr.loca.zone%2F&rm=HEAD
|
|
|
|
# wiki host — public, no auth redirect
|
|
curl -sSI https://wiki.cdsr.loca.zone/
|
|
# -> HTTP/1.1 200
|
|
# -> serves static content directly
|
|
```
|
|
|
|
## Rollback / debug order if auth breaks
|
|
|
|
1. `sudo -n nginx -t` — config clean (ignore the pre-existing flxr ssl_stapling warning)
|
|
2. Confirm app 443 block includes both snippets:
|
|
- `include snippets/authelia-location.conf`
|
|
- `location / { include snippets/authelia-authrequest.conf; ... }`
|
|
3. Confirm Authelia rule present:
|
|
- `grep -A2 'domain: "cdsr.loca.zone"' /home/loca/dev/services/authelia/config/configuration.yml`
|
|
4. Check Authelia container:
|
|
- `cd /home/loca/dev/services/authelia && sudo -n docker compose ps`
|
|
- `cd /home/loca/dev/services/authelia && sudo -n docker compose logs --tail=50 authelia`
|
|
5. Prove code-server itself is healthy (bypasses all auth/TLS):
|
|
- `curl -sf http://127.0.0.1:52224/healthz`
|
|
- should return `{"status":"alive",...}` when an editor session is active |