rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

authelia: admin sites fred-only

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
rope 2026-10-18 09:56:00 +01:00
parent 1e1883ce45
commit 0bddaa5578
1 changed files with 17 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

29
services/authelia.nix
View file

@ -1,6 +1,9 @@
# services/authelia.nix — Native Authelia SSO # services/authelia.nix — Native Authelia SSO
# Secrets live in /var/secrets/authelia (root:authelia-main, 640) — see readme. # Secrets live in /var/secrets/authelia (root:authelia-main, 640) — see readme.
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
let
admin = [ "user:fred" ];
in
{ {
config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") { config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
@ -26,23 +29,25 @@
access_control = { access_control = {
default_policy = "deny"; default_policy = "deny";
# Admin tools are fred-only (`admin`); any other account, i.e. kayla,
# only reaches the shared household sites.
rules = [ rules = [
{ domain = "frigate.nordhammer.it"; policy = "one_factor"; } { domain = "frigate.nordhammer.it"; policy = "one_factor"; }
{ domain = "camera.nordhammer.it"; policy = "one_factor"; } { domain = "camera.nordhammer.it"; policy = "one_factor"; }
# { domain = "7dtd.nordhammer.it"; policy = "one_factor"; } # 7DTD disabled # { domain = "7dtd.nordhammer.it"; policy = "one_factor"; } # 7DTD disabled
{ domain = "adguard.nordhammer.it"; policy = "one_factor"; } { domain = "adguard.nordhammer.it"; policy = "one_factor"; subject = admin; }
{ domain = "router.nordhammer.it"; policy = "one_factor"; } { domain = "router.nordhammer.it"; policy = "one_factor"; subject = admin; }
{ domain = "sonarr.nordhammer.it"; policy = "one_factor"; } { domain = "sonarr.nordhammer.it"; policy = "one_factor"; subject = admin; }
{ domain = "radarr.nordhammer.it"; policy = "one_factor"; } { domain = "radarr.nordhammer.it"; policy = "one_factor"; subject = admin; }
{ domain = "bazarr.nordhammer.it"; policy = "one_factor"; } { domain = "bazarr.nordhammer.it"; policy = "one_factor"; subject = admin; }
{ domain = "prowlarr.nordhammer.it"; policy = "one_factor"; } { domain = "prowlarr.nordhammer.it"; policy = "one_factor"; subject = admin; }
{ domain = "torrent.nordhammer.it"; policy = "one_factor"; } { domain = "torrent.nordhammer.it"; policy = "one_factor"; subject = admin; }
{ domain = "profilarr.nordhammer.it"; policy = "one_factor"; } { domain = "profilarr.nordhammer.it"; policy = "one_factor"; subject = admin; }
{ domain = "shelfarr.nordhammer.it"; policy = "one_factor"; } { domain = "shelfarr.nordhammer.it"; policy = "one_factor"; subject = admin; }
{ domain = "sabnzbd.nordhammer.it"; policy = "one_factor"; } { domain = "sabnzbd.nordhammer.it"; policy = "one_factor"; subject = admin; }
{ domain = "code.nordhammer.it"; policy = "one_factor"; } { domain = "code.nordhammer.it"; policy = "one_factor"; subject = admin; }
{ domain = "reddit.nordhammer.it"; policy = "one_factor"; } { domain = "reddit.nordhammer.it"; policy = "one_factor"; }
{ domain = "panel.nordhammer.it"; policy = "one_factor"; } { domain = "panel.nordhammer.it"; policy = "one_factor"; subject = admin; }
{ domain = "stardew.nordhammer.it"; policy = "one_factor"; } { domain = "stardew.nordhammer.it"; policy = "one_factor"; }
# Health data: only the two people the app knows about. # Health data: only the two people the app knows about.
{ domain = "flowtrack.nordhammer.it"; policy = "one_factor"; subject = [ "user:kayla" "user:fred" ]; } { domain = "flowtrack.nordhammer.it"; policy = "one_factor"; subject = [ "user:kayla" "user:fred" ]; }