rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

pelican: gate panel behind Authelia, bypass /api/remote/ for wings

Browse source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
rope 2026-08-09 12:00:43 +01:00
parent 00ec9a9759
commit 475d394810
3 changed files with 33 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

1
services/authelia.nix
View file

@ -42,6 +42,7 @@
{ domain = "sabnzbd.nordhammer.it"; policy = "one_factor"; }
{ domain = "code.nordhammer.it"; policy = "one_factor"; }
{ domain = "notes.nordhammer.it"; policy = "one_factor"; }
{ domain = "panel.nordhammer.it"; policy = "one_factor"; }
];
};

36
services/nginx.nix
View file

@ -106,15 +106,13 @@ in
"jellyfin.nordhammer.it" = proxy 8096; # streaming to external clients
"seerr.nordhammer.it" = proxy 5055; # own auth via Jellyfin sign-in
# Pelican game panel — own auth. Not Authelia-protected: wings polls
# the panel API and the browser console opens a websocket straight to
# the node, neither of which can follow a forward-auth redirect.
"panel.nordhammer.it" = lib.recursiveUpdate (proxy 8092) {
locations."/".extraConfig = "client_max_body_size 100m;";
};
# wings daemon (see services/pelican.nix). Uploads through the file
# manager are whole server archives, so no body-size cap; the console
# websocket idles between keystrokes, hence the long read timeout.
# wings daemon (see services/pelican.nix). Deliberately NOT behind
# Authelia: the panel container calls this server-to-server and has no
# session cookie to present. wings authenticates every request with its
# own token/JWT, so an unauthenticated caller gets nothing. Uploads
# through the file manager are whole server archives, hence no
# body-size cap; the console websocket idles between keystrokes, hence
# the long read timeout.
"node.nordhammer.it" = lib.recursiveUpdate (proxy 8443) {
locations."/".extraConfig = ''
client_max_body_size 0;
@ -156,6 +154,26 @@ in
};
"notes.nordhammer.it" = protectedProxy 5230;
# Pelican game panel. Can't turn off its own login (no such option
# upstream), so Authelia is the outer gate and the Pelican account
# behind it is a formality. /api/remote/ must skip forward-auth: wings
# polls it with its daemon token and can't follow a 302 to the portal.
"panel.nordhammer.it" = ssl // {
locations = autheliaLocation // {
"/" = {
proxyPass = "http://127.0.0.1:8092";
proxyWebsockets = true;
extraConfig = autheliaAuthConfig + ''
client_max_body_size 100m;
'';
};
"/api/remote/" = {
proxyPass = "http://127.0.0.1:8092";
extraConfig = "client_max_body_size 100m;";
};
};
};
# --- Local-only: serves update history JSON to Homepage's customapi widget ---
"homepage-updates.local" = {
listen = [ { addr = "127.0.0.1"; port = 8083; } ];

5
services/pelican.nix
View file

@ -15,6 +15,11 @@
# UI and stored in the panel's SQLite DB. Back up /var/lib/pelican-panel and
# /var/lib/pelican (server files); the nix side here is only the plumbing.
#
# AUTH: panel.nordhammer.it sits behind Authelia (see nginx.nix), except
# /api/remote/ which wings needs. Pelican has no switch to disable its own
# login, so its account is a second, redundant gate — replacing it means
# standing up Authelia's OIDC provider and pointing Pelican's Socialite at it.
#
# FIRST-RUN (wings crash-loops until step 3 — that's expected):
# 1. https://panel.nordhammer.it → installer wizard, make admin user.
# 2. Admin → Nodes → Create. FQDN node.nordhammer.it, SSL *on*, port 443