From 0bddaa55786b3c76e68141ec4b07a81066ed9569 Mon Sep 17 00:00:00 2001 From: rope Date: Sun, 18 Oct 2026 09:56:00 +0100 Subject: [PATCH] authelia: admin sites fred-only Co-Authored-By: Claude Opus 5.5 --- services/authelia.nix | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/services/authelia.nix b/services/authelia.nix index 9a01d7e..f383b55 100644 --- a/services/authelia.nix +++ b/services/authelia.nix @@ -1,6 +1,9 @@ # services/authelia.nix — Native Authelia SSO # Secrets live in /var/secrets/authelia (root:authelia-main, 640) — see readme. { config, lib, pkgs, ... }: +let + admin = [ "user:fred" ]; +in { config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") { @@ -26,23 +29,25 @@ access_control = { default_policy = "deny"; + # Admin tools are fred-only (`admin`); any other account, i.e. kayla, + # only reaches the shared household sites. rules = [ { domain = "frigate.nordhammer.it"; policy = "one_factor"; } { domain = "camera.nordhammer.it"; policy = "one_factor"; } # { domain = "7dtd.nordhammer.it"; policy = "one_factor"; } # 7DTD disabled - { domain = "adguard.nordhammer.it"; policy = "one_factor"; } - { domain = "router.nordhammer.it"; policy = "one_factor"; } - { domain = "sonarr.nordhammer.it"; policy = "one_factor"; } - { domain = "radarr.nordhammer.it"; policy = "one_factor"; } - { domain = "bazarr.nordhammer.it"; policy = "one_factor"; } - { domain = "prowlarr.nordhammer.it"; policy = "one_factor"; } - { domain = "torrent.nordhammer.it"; policy = "one_factor"; } - { domain = "profilarr.nordhammer.it"; policy = "one_factor"; } - { domain = "shelfarr.nordhammer.it"; policy = "one_factor"; } - { domain = "sabnzbd.nordhammer.it"; policy = "one_factor"; } - { domain = "code.nordhammer.it"; policy = "one_factor"; } + { domain = "adguard.nordhammer.it"; policy = "one_factor"; subject = admin; } + { domain = "router.nordhammer.it"; policy = "one_factor"; subject = admin; } + { domain = "sonarr.nordhammer.it"; policy = "one_factor"; subject = admin; } + { domain = "radarr.nordhammer.it"; policy = "one_factor"; subject = admin; } + { domain = "bazarr.nordhammer.it"; policy = "one_factor"; subject = admin; } + { domain = "prowlarr.nordhammer.it"; policy = "one_factor"; subject = admin; } + { domain = "torrent.nordhammer.it"; policy = "one_factor"; subject = admin; } + { domain = "profilarr.nordhammer.it"; policy = "one_factor"; subject = admin; } + { domain = "shelfarr.nordhammer.it"; policy = "one_factor"; subject = admin; } + { domain = "sabnzbd.nordhammer.it"; policy = "one_factor"; subject = admin; } + { domain = "code.nordhammer.it"; policy = "one_factor"; subject = admin; } { domain = "reddit.nordhammer.it"; policy = "one_factor"; } - { domain = "panel.nordhammer.it"; policy = "one_factor"; } + { domain = "panel.nordhammer.it"; policy = "one_factor"; subject = admin; } { domain = "stardew.nordhammer.it"; policy = "one_factor"; } # Health data: only the two people the app knows about. { domain = "flowtrack.nordhammer.it"; policy = "one_factor"; subject = [ "user:kayla" "user:fred" ]; }