Everything changed - major rewrite

2026-06-07 00:59:22 +03:00
parent 08e8b5edbe
commit 261cf892dd
20 changed files with 673 additions and 139 deletions
@@ -205,6 +205,14 @@ in
      mode = "0444";
    };

+    # -----------------------------------------------------------------------
+    # Authelia access control — admins only, two_factor; all others denied.
+    # -----------------------------------------------------------------------
+    homey.authelia.accessControlRules = [
+      { priority = 35; domain = [ "grafana.${domain}" ]; subject = [ "group:admins" ]; policy = "two_factor"; }
+      { priority = 36; domain = [ "grafana.${domain}" ]; policy = "deny"; }
+    ];
+
    # -----------------------------------------------------------------------
    # Caddy virtual host — forward_auth; Caddy maps Remote-User → X-WEBAUTH-USER
    # so Grafana's proxy auth auto-signs the user in