From 475d394810d1ad9c9a0d137da0d03993fdc38c5f Mon Sep 17 00:00:00 2001
From: rope <fredrik@nordhammer.it>
Date: Sun, 9 Aug 2026 12:00:43 +0100
Subject: [PATCH] pelican: gate panel behind Authelia, bypass /api/remote/ for
 wings

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 services/authelia.nix |  1 +
 services/nginx.nix    | 36 +++++++++++++++++++++++++++---------
 services/pelican.nix  |  5 +++++
 3 files changed, 33 insertions(+), 9 deletions(-)

diff --git a/services/authelia.nix b/services/authelia.nix
index fa0ac8b..d3c6cd9 100644
--- a/services/authelia.nix
+++ b/services/authelia.nix
@@ -42,6 +42,7 @@
             { domain = "sabnzbd.nordhammer.it";   policy = "one_factor"; }
             { domain = "code.nordhammer.it";       policy = "one_factor"; }
             { domain = "notes.nordhammer.it";     policy = "one_factor"; }
+            { domain = "panel.nordhammer.it";     policy = "one_factor"; }
           ];
         };
 
diff --git a/services/nginx.nix b/services/nginx.nix
index 74798dd..d22afa6 100644
--- a/services/nginx.nix
+++ b/services/nginx.nix
@@ -106,15 +106,13 @@ in
         "jellyfin.nordhammer.it" = proxy 8096;  # streaming to external clients
         "seerr.nordhammer.it"    = proxy 5055;  # own auth via Jellyfin sign-in
 
-        # Pelican game panel — own auth. Not Authelia-protected: wings polls
-        # the panel API and the browser console opens a websocket straight to
-        # the node, neither of which can follow a forward-auth redirect.
-        "panel.nordhammer.it"    = lib.recursiveUpdate (proxy 8092) {
-          locations."/".extraConfig = "client_max_body_size 100m;";
-        };
-        # wings daemon (see services/pelican.nix). Uploads through the file
-        # manager are whole server archives, so no body-size cap; the console
-        # websocket idles between keystrokes, hence the long read timeout.
+        # wings daemon (see services/pelican.nix). Deliberately NOT behind
+        # Authelia: the panel container calls this server-to-server and has no
+        # session cookie to present. wings authenticates every request with its
+        # own token/JWT, so an unauthenticated caller gets nothing. Uploads
+        # through the file manager are whole server archives, hence no
+        # body-size cap; the console websocket idles between keystrokes, hence
+        # the long read timeout.
         "node.nordhammer.it"     = lib.recursiveUpdate (proxy 8443) {
           locations."/".extraConfig = ''
             client_max_body_size 0;
@@ -156,6 +154,26 @@ in
         };
         "notes.nordhammer.it"    = protectedProxy 5230;
 
+        # Pelican game panel. Can't turn off its own login (no such option
+        # upstream), so Authelia is the outer gate and the Pelican account
+        # behind it is a formality. /api/remote/ must skip forward-auth: wings
+        # polls it with its daemon token and can't follow a 302 to the portal.
+        "panel.nordhammer.it"    = ssl // {
+          locations = autheliaLocation // {
+            "/" = {
+              proxyPass = "http://127.0.0.1:8092";
+              proxyWebsockets = true;
+              extraConfig = autheliaAuthConfig + ''
+                client_max_body_size 100m;
+              '';
+            };
+            "/api/remote/" = {
+              proxyPass = "http://127.0.0.1:8092";
+              extraConfig = "client_max_body_size 100m;";
+            };
+          };
+        };
+
         # --- Local-only: serves update history JSON to Homepage's customapi widget ---
         "homepage-updates.local" = {
           listen = [ { addr = "127.0.0.1"; port = 8083; } ];
diff --git a/services/pelican.nix b/services/pelican.nix
index ef465b9..835d7e9 100644
--- a/services/pelican.nix
+++ b/services/pelican.nix
@@ -15,6 +15,11 @@
 # UI and stored in the panel's SQLite DB. Back up /var/lib/pelican-panel and
 # /var/lib/pelican (server files); the nix side here is only the plumbing.
 #
+# AUTH: panel.nordhammer.it sits behind Authelia (see nginx.nix), except
+# /api/remote/ which wings needs. Pelican has no switch to disable its own
+# login, so its account is a second, redundant gate — replacing it means
+# standing up Authelia's OIDC provider and pointing Pelican's Socialite at it.
+#
 # FIRST-RUN (wings crash-loops until step 3 — that's expected):
 #   1. https://panel.nordhammer.it → installer wizard, make admin user.
 #   2. Admin → Nodes → Create. FQDN node.nordhammer.it, SSL *on*, port 443