34d2ccc576
Build spec and host brief carried in from C:\Claude and WRPS/02-env; the plant model (equipment, tags, alarm bitmask, enums, unit conversions) is derived from WRPS/04-plc/register-map.csv, WRPS/05-scada/modbus/scada-points.csv and WRPS-CTL-003. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
76 lines
3.2 KiB
Markdown
76 lines
3.2 KiB
Markdown
# Authelia access rules — the additions, as text
|
|
|
|
**This file is documentation, not configuration. Never commit the real
|
|
`~/authelia/configuration.yml`, and never generate a replacement for it.**
|
|
It contains the AD bind account, session secrets and the Duo integration for
|
|
every service on the host. The four hostnames below are the only part of it
|
|
this project touches.
|
|
|
|
## What has to change
|
|
|
|
Four hostnames join the existing `HTTPS_UserAccess` `two_factor` rule in
|
|
`~/authelia/configuration.yml`, under `access_control.rules`:
|
|
|
|
| Hostname | Phase | Serves |
|
|
|---|---|---|
|
|
| `lf.yokogawa.tech` | 2 | Langfuse — traces, prompts, eval runs |
|
|
| `cube.yokogawa.tech` | 5 | Cube semantic layer, playground and REST API |
|
|
| `api.yokogawa.tech` | 6 | `ai-api` FastAPI |
|
|
| `ai.yokogawa.tech` | 7 | `ai-web` operator UI |
|
|
|
|
The shape of the addition — the domain list on the existing trailing rule gains
|
|
these entries, the policy and subject stay exactly as they already are:
|
|
|
|
```yaml
|
|
access_control:
|
|
rules:
|
|
# ... existing rules unchanged ...
|
|
- domain:
|
|
# ... existing domains unchanged ...
|
|
- lf.yokogawa.tech # added <date>, AI PoC Phase 2
|
|
- cube.yokogawa.tech # added <date>, AI PoC Phase 5
|
|
- api.yokogawa.tech # added <date>, AI PoC Phase 6
|
|
- ai.yokogawa.tech # added <date>, AI PoC Phase 7
|
|
policy: two_factor
|
|
subject:
|
|
- group:HTTPS_UserAccess
|
|
```
|
|
|
|
Add each hostname at the phase that needs it. Every domain added here must also
|
|
have a Caddyfile block with `import authelia` (`caddy/ai-routes.caddy`), and
|
|
every Caddyfile block must have a rule here. One without the other is a hole.
|
|
|
|
## How to apply it
|
|
|
|
```bash
|
|
# 1. Back up first. There are plenty of .bak-* precedents on the host.
|
|
sudo cp ~/authelia/configuration.yml ~/authelia/configuration.yml.bak-ai-$(date +%Y%m%d)
|
|
|
|
# 2. Edit with sudo - the file is root-owned. ~/apply_rule.py rewrites the
|
|
# trailing rule if you prefer it to hand-editing.
|
|
sudo nano ~/authelia/configuration.yml
|
|
|
|
# 3. ANNOUNCE FIRST - this logs out every active user on every service.
|
|
docker compose -f ~/authelia-compose.yml restart authelia
|
|
|
|
# 4. Verify. "Up" is not proof.
|
|
curl -sI https://ai.yokogawa.tech # expect 302 -> auth portal
|
|
docker logs --tail 50 authelia
|
|
```
|
|
|
|
## Things that bite
|
|
|
|
- **Restarting Authelia logs out every active user on the host**, including
|
|
whoever is mid-demo on Grafana. Announce it, and batch the domain additions
|
|
so you restart once per phase rather than once per hostname.
|
|
- **AD group membership must be DIRECT.** Authelia resolves direct membership
|
|
only; a user inside a nested group silently gets denied with no useful log
|
|
line. Before Phase 7, confirm the demo operator account is a direct member of
|
|
`HTTPS_UserAccess` and is Duo-enrolled. `svc-authelia` is read-only and
|
|
cannot fix membership for you.
|
|
- **A missing rule fails open at the wrong layer.** Caddy will happily serve a
|
|
hostname that has `import authelia` before the rule exists — Authelia then
|
|
applies its default policy. Add the rule in the same change as the Caddyfile
|
|
block and verify the 302 before telling anyone the URL.
|
|
- Restarting Authelia is also the supported way to refresh someone's group
|
|
membership after an AD change.
|