# Authelia access rules — the additions, as text

**This file is documentation, not configuration. Never commit the real
`~/authelia/configuration.yml`, and never generate a replacement for it.**
It contains the AD bind account, session secrets and the Duo integration for
every service on the host. The four hostnames below are the only part of it
this project touches.

## What has to change

Four hostnames join the existing `HTTPS_UserAccess` `two_factor` rule in
`~/authelia/configuration.yml`, under `access_control.rules`:

| Hostname | Phase | Serves |
|---|---|---|
| `lf.yokogawa.tech` | 2 | Langfuse — traces, prompts, eval runs |
| `cube.yokogawa.tech` | 5 | Cube semantic layer, playground and REST API |
| `api.yokogawa.tech` | 6 | `ai-api` FastAPI |
| `ai.yokogawa.tech` | 7 | `ai-web` operator UI |

The shape of the addition — the domain list on the existing trailing rule gains
these entries, the policy and subject stay exactly as they already are:

```yaml
access_control:
  rules:
    # ... existing rules unchanged ...
    - domain:
        # ... existing domains unchanged ...
        - lf.yokogawa.tech        # added <date>, AI PoC Phase 2
        - cube.yokogawa.tech      # added <date>, AI PoC Phase 5
        - api.yokogawa.tech       # added <date>, AI PoC Phase 6
        - ai.yokogawa.tech        # added <date>, AI PoC Phase 7
      policy: two_factor
      subject:
        - group:HTTPS_UserAccess
```

Add each hostname at the phase that needs it. Every domain added here must also
have a Caddyfile block with `import authelia` (`caddy/ai-routes.caddy`), and
every Caddyfile block must have a rule here. One without the other is a hole.

## How to apply it

```bash
# 1. Back up first. There are plenty of .bak-* precedents on the host.
sudo cp ~/authelia/configuration.yml ~/authelia/configuration.yml.bak-ai-$(date +%Y%m%d)

# 2. Edit with sudo - the file is root-owned. ~/apply_rule.py rewrites the
#    trailing rule if you prefer it to hand-editing.
sudo nano ~/authelia/configuration.yml

# 3. ANNOUNCE FIRST - this logs out every active user on every service.
docker compose -f ~/authelia-compose.yml restart authelia

# 4. Verify. "Up" is not proof.
curl -sI https://ai.yokogawa.tech        # expect 302 -> auth portal
docker logs --tail 50 authelia
```

## Things that bite

- **Restarting Authelia logs out every active user on the host**, including
  whoever is mid-demo on Grafana. Announce it, and batch the domain additions
  so you restart once per phase rather than once per hostname.
- **AD group membership must be DIRECT.** Authelia resolves direct membership
  only; a user inside a nested group silently gets denied with no useful log
  line. Before Phase 7, confirm the demo operator account is a direct member of
  `HTTPS_UserAccess` and is Duo-enrolled. `svc-authelia` is read-only and
  cannot fix membership for you.
- **A missing rule fails open at the wrong layer.** Caddy will happily serve a
  hostname that has `import authelia` before the rule exists — Authelia then
  applies its default policy. Add the rule in the same change as the Caddyfile
  block and verify the 302 before telling anyone the URL.
- Restarting Authelia is also the supported way to refresh someone's group
  membership after an AD change.