yau-plant-assistant/authelia/access-rules.md

Authelia access rules — the additions, as text

This file is documentation, not configuration. Never commit the real ~/authelia/configuration.yml, and never generate a replacement for it. It contains the AD bind account, session secrets and the Duo integration for every service on the host. The four hostnames below are the only part of it this project touches.

What has to change

Four hostnames join the existing HTTPS_UserAccess two_factor rule in ~/authelia/configuration.yml, under access_control.rules:

Hostname	Phase	Serves
lf.yokogawa.tech	2	Langfuse — traces, prompts, eval runs
cube.yokogawa.tech	5	Cube semantic layer, playground and REST API
api.yokogawa.tech	6	ai-api FastAPI
ai.yokogawa.tech	7	ai-web operator UI

The shape of the addition — the domain list on the existing trailing rule gains these entries, the policy and subject stay exactly as they already are:

access_control:
  rules:
    # ... existing rules unchanged ...
    - domain:
        # ... existing domains unchanged ...
        - lf.yokogawa.tech        # added <date>, AI PoC Phase 2
        - cube.yokogawa.tech      # added <date>, AI PoC Phase 5
        - api.yokogawa.tech       # added <date>, AI PoC Phase 6
        - ai.yokogawa.tech        # added <date>, AI PoC Phase 7
      policy: two_factor
      subject:
        - group:HTTPS_UserAccess

Add each hostname at the phase that needs it. Every domain added here must also have a Caddyfile block with import authelia (caddy/ai-routes.caddy), and every Caddyfile block must have a rule here. One without the other is a hole.

How to apply it

# 1. Back up first. There are plenty of .bak-* precedents on the host.
sudo cp ~/authelia/configuration.yml ~/authelia/configuration.yml.bak-ai-$(date +%Y%m%d)

# 2. Edit with sudo - the file is root-owned. ~/apply_rule.py rewrites the
#    trailing rule if you prefer it to hand-editing.
sudo nano ~/authelia/configuration.yml

# 3. ANNOUNCE FIRST - this logs out every active user on every service.
docker compose -f ~/authelia-compose.yml restart authelia

# 4. Verify. "Up" is not proof.
curl -sI https://ai.yokogawa.tech        # expect 302 -> auth portal
docker logs --tail 50 authelia

Things that bite

• Restarting Authelia logs out every active user on the host, including whoever is mid-demo on Grafana. Announce it, and batch the domain additions so you restart once per phase rather than once per hostname.
• AD group membership must be DIRECT. Authelia resolves direct membership only; a user inside a nested group silently gets denied with no useful log line. Before Phase 7, confirm the demo operator account is a direct member of HTTPS_UserAccess and is Duo-enrolled. svc-authelia is read-only and cannot fix membership for you.
• A missing rule fails open at the wrong layer. Caddy will happily serve a hostname that has import authelia before the rule exists — Authelia then applies its default policy. Add the rule in the same change as the Caddyfile block and verify the 302 before telling anyone the URL.
• Restarting Authelia is also the supported way to refresh someone's group membership after an AD change.