From 7fdd8f55e7983c4cdca0e1a4539d1af58a25ca1f Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 27 Aug 2026 15:07:54 +1000 Subject: [PATCH] Record the Caddy blocks and Authelia rules as applied cube, api and ai joined the HTTPS_UserAccess two_factor rule in one Authelia restart on 2026-08-27, backup configuration.yml.bak-ai-20260827. All four AI hostnames now return 302 to the auth portal, and POST /ask on ai.yokogawa.tech returns 303 to the portal rather than a 404 from ai-web, which is what proves the route exists. Co-Authored-By: Claude Opus 5 --- REQUESTS.md | 6 ++++-- authelia/access-rules.md | 8 ++++++++ 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/REQUESTS.md b/REQUESTS.md index 3f94537..1c73afe 100644 --- a/REQUESTS.md +++ b/REQUESTS.md @@ -81,8 +81,10 @@ Dan for this item. Two things are worth recording: further DNS is needed for the demo. `cube.yokogawa.tech` is for engineers on the public side only; `ai-api` reaches Cube container-to-container and never by hostname. - **The names resolving is not the same as the services answering.** The Caddyfile blocks - and the Authelia rules for `ai`, `api` and `cube` still have to be applied on the host — - see the deployment note. Until they are, all three names return nothing. + and the Authelia rules for `ai`, `api` and `cube` were applied on the host the same day; + all four AI hostnames now return 302 to the auth portal. What is still unproven is the + part no check here can reach: an operator on `cicore1`, signed in with Duo, getting an + answer end to end. The original request follows, unchanged. diff --git a/authelia/access-rules.md b/authelia/access-rules.md index 1a64a50..973dd9d 100644 --- a/authelia/access-rules.md +++ b/authelia/access-rules.md @@ -43,6 +43,14 @@ Add each hostname at the phase that needs it. Every domain added here must also have a Caddyfile block with `import authelia` (`caddy/ai-routes.caddy`), and every Caddyfile block must have a rule here. One without the other is a hole. +**Applied on lin001:** `lf` on 2026-08-20; `cube`, `api` and `ai` on +2026-08-27, in one Authelia restart. Backup +`~/authelia/configuration.yml.bak-ai-20260827`. All four now return 302 to the +auth portal. Between the Caddy blocks going in and this rule landing, the three +new hostnames returned **403** — Caddy serving a hostname Authelia has no rule +for means `default_policy: deny`, which is the safe direction but is not +obvious from the status code alone. `verify.sh` names that case explicitly. + ## Phase 9: the document publisher rule Operator document upload splits the API in two. Anyone in `HTTPS_UserAccess`