YAU.POC/yau-plant-assistant
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record the Caddy blocks and Authelia rules as applied

Browse source 
cube, api and ai joined the HTTPS_UserAccess two_factor rule in one Authelia
restart on 2026-08-27, backup configuration.yml.bak-ai-20260827. All four AI
hostnames now return 302 to the auth portal, and POST /ask on ai.yokogawa.tech
returns 303 to the portal rather than a 404 from ai-web, which is what proves
the route exists.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Claude 2026-08-27 15:07:54 +10:00
parent eb8cfaa787
commit 7fdd8f55e7
2 changed files with 12 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
REQUESTS.md
View file

@ -81,8 +81,10 @@ Dan for this item. Two things are worth recording:
further DNS is needed for the demo. `cube.yokogawa.tech` is for engineers on the public further DNS is needed for the demo. `cube.yokogawa.tech` is for engineers on the public
side only; `ai-api` reaches Cube container-to-container and never by hostname. side only; `ai-api` reaches Cube container-to-container and never by hostname.
- **The names resolving is not the same as the services answering.** The Caddyfile blocks - **The names resolving is not the same as the services answering.** The Caddyfile blocks
and the Authelia rules for `ai`, `api` and `cube` still have to be applied on the host — and the Authelia rules for `ai`, `api` and `cube` were applied on the host the same day;
see the deployment note. Until they are, all three names return nothing. all four AI hostnames now return 302 to the auth portal. What is still unproven is the
part no check here can reach: an operator on `cicore1`, signed in with Duo, getting an
answer end to end.
The original request follows, unchanged. The original request follows, unchanged.

8
authelia/access-rules.md
View file

@ -43,6 +43,14 @@ Add each hostname at the phase that needs it. Every domain added here must also
have a Caddyfile block with `import authelia` (`caddy/ai-routes.caddy`), and have a Caddyfile block with `import authelia` (`caddy/ai-routes.caddy`), and
every Caddyfile block must have a rule here. One without the other is a hole. every Caddyfile block must have a rule here. One without the other is a hole.
**Applied on lin001:** `lf` on 2026-08-20; `cube`, `api` and `ai` on
2026-08-27, in one Authelia restart. Backup
`~/authelia/configuration.yml.bak-ai-20260827`. All four now return 302 to the
auth portal. Between the Caddy blocks going in and this rule landing, the three
new hostnames returned **403** — Caddy serving a hostname Authelia has no rule
for means `default_policy: deny`, which is the safe direction but is not
obvious from the status code alone. `verify.sh` names that case explicitly.
## Phase 9: the document publisher rule ## Phase 9: the document publisher rule
Operator document upload splits the API in two. Anyone in `HTTPS_UserAccess` Operator document upload splits the API in two. Anyone in `HTTPS_UserAccess`