YAU.POC/yau-plant-assistant
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record the Caddy blocks and Authelia rules as applied

Browse source 
cube, api and ai joined the HTTPS_UserAccess two_factor rule in one Authelia
restart on 2026-08-27, backup configuration.yml.bak-ai-20260827. All four AI
hostnames now return 302 to the auth portal, and POST /ask on ai.yokogawa.tech
returns 303 to the portal rather than a 404 from ai-web, which is what proves
the route exists.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Claude 2026-08-27 15:07:54 +10:00
parent eb8cfaa787
commit 7fdd8f55e7
2 changed files with 12 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
REQUESTS.md
View file

@ -81,8 +81,10 @@ Dan for this item. Two things are worth recording:
further DNS is needed for the demo. `cube.yokogawa.tech` is for engineers on the public
side only; `ai-api` reaches Cube container-to-container and never by hostname.
- **The names resolving is not the same as the services answering.** The Caddyfile blocks
and the Authelia rules for `ai`, `api` and `cube` still have to be applied on the host —
see the deployment note. Until they are, all three names return nothing.
and the Authelia rules for `ai`, `api` and `cube` were applied on the host the same day;
all four AI hostnames now return 302 to the auth portal. What is still unproven is the
part no check here can reach: an operator on `cicore1`, signed in with Duo, getting an
answer end to end.
The original request follows, unchanged.

8
authelia/access-rules.md
View file

@ -43,6 +43,14 @@ Add each hostname at the phase that needs it. Every domain added here must also
have a Caddyfile block with `import authelia` (`caddy/ai-routes.caddy`), and
every Caddyfile block must have a rule here. One without the other is a hole.
**Applied on lin001:** `lf` on 2026-08-20; `cube`, `api` and `ai` on
2026-08-27, in one Authelia restart. Backup
`~/authelia/configuration.yml.bak-ai-20260827`. All four now return 302 to the
auth portal. Between the Caddy blocks going in and this rule landing, the three
new hostnames returned **403** — Caddy serving a hostname Authelia has no rule
for means `default_policy: deny`, which is the safe direction but is not
obvious from the status code alone. `verify.sh` names that case explicitly.
## Phase 9: the document publisher rule
Operator document upload splits the API in two. Anyone in `HTTPS_UserAccess`