Everything changed - major rewrite

modules/services/authelia.nix

@@ -17,6 +17,10 @@
 #   authelia/session_secret
 #   authelia/storage_encryption_key
 #   openldap/ro_password  (shared with openldap module)
+#
+# Access control rules are NOT declared here. Each service module contributes
+# its own rules via homey.authelia.accessControlRules, which are sorted by
+# priority and merged into the final config at build time.
 
 let
   cfg     = config.homey.authelia;
@@ -27,9 +31,29 @@ let
   ldapBaseDN = lib.concatStringsSep ","
     (map (p: "dc=${p}") (lib.splitString "." domain));
 
+  # Render a single access_control rule attrset to a YAML list item.
+  # Indented for insertion into the access_control.rules block (4 spaces
+  # before "- domain:", matching the 2-space indent of "rules:").
+  renderRule = rule:
+    let
+      domainLines    = lib.concatMapStringsSep "\n" (d: "        - \"${d}\"") rule.domain;
+      subjectBlock   = lib.optionalString (rule.subject != []) (
+        "\n      subject:\n" +
+        lib.concatMapStringsSep "\n" (s: "        - \"${s}\"") rule.subject
+      );
+      resourcesBlock = lib.optionalString (rule.resources != []) (
+        "\n      resources:\n" +
+        lib.concatMapStringsSep "\n" (r: "        - \"${r}\"") rule.resources
+      );
+    in
+      "    - domain:\n${domainLines}${subjectBlock}${resourcesBlock}\n      policy: \"${rule.policy}\"\n";
+
+  sortedRules = lib.sort (a: b: a.priority < b.priority) cfg.accessControlRules;
+  rulesYaml   = lib.concatStrings (map renderRule sortedRules);
+
   # The authelia config is written as a Nix string so all values are
   # resolved at build time except for secrets, which are injected at
-  # runtime via a wrapper script (same pattern as openldap).
+  # runtime via environment variables.
   autheliaConfig = ''
     ###############################################################
     #                Authelia configuration                       #
@@ -79,75 +103,7 @@ let
     access_control:
       default_policy: "deny"
       rules:
-        - domain:
-            - "auth.${domain}"
-          policy: "bypass"
-        - domain:
-            - "ldapadmin.${domain}"
-          subject:
-            - "group:admins"
-          policy: "two_factor"
-        - domain:
-            - "ldapadmin.${domain}"
-          policy: "deny"
-        - domain:
-            - "torrent.${domain}"
-          subject:
-            - "group:admins"
-          policy: "two_factor"
-        - domain:
-            - "torrent.${domain}"
-          policy: "deny"
-        - domain:
-            - "git.${domain}"
-          policy: "one_factor"
-        - domain:
-            - "nextcloud.${domain}"
-          policy: "one_factor"
-        - domain:
-            - "jellyfin.${domain}"
-          policy: "one_factor"
-        - domain:
-            - "uptime.${domain}"
-          subject:
-            - "group:admins"
-          policy: "two_factor"
-        - domain:
-            - "uptime.${domain}"
-          policy: "deny"
-        - domain:
-            - "grafana.${domain}"
-          subject:
-            - "group:admins"
-          policy: "two_factor"
-        - domain:
-            - "grafana.${domain}"
-          policy: "deny"
-        # ntfy: bypass — ntfy enforces its own token/password auth;
-        # the mobile app must be able to connect without Authelia SSO.
-        - domain:
-            - "ntfy.${domain}"
-          policy: "bypass"
-        # Eurovision Vote: /admin/* for admins only; all others one_factor
-        - domain:
-            - "eurovision-vote.${domain}"
-          resources:
-            - "^/admin.*$"
-          subject:
-            - "group:admins"
-          policy: "two_factor"
-        - domain:
-            - "eurovision-vote.${domain}"
-          resources:
-            - "^/admin.*$"
-          policy: "deny"
-        - domain:
-            - "eurovision-vote.${domain}"
-          policy: "one_factor"
-        - domain:
-            - "paperless.${domain}"
-          policy: "one_factor"
-
+    ${rulesYaml}
     notifier:
       filesystem:
         filename: "/config/emails.txt"
@@ -163,6 +119,40 @@ let
 in
 {
   options.homey.authelia = {
+    # Declared unconditionally so any service module can contribute rules
+    # even when Authelia itself is disabled.
+    accessControlRules = lib.mkOption {
+      type = lib.types.listOf (lib.types.submodule {
+        options = {
+          priority = lib.mkOption {
+            type        = lib.types.int;
+            default     = 100;
+            description = "Order within access_control.rules — lower values appear first. Authelia evaluates rules top-to-bottom and stops at the first match.";
+          };
+          domain = lib.mkOption {
+            type        = lib.types.listOf lib.types.str;
+            description = "Domain glob(s) this rule matches.";
+          };
+          policy = lib.mkOption {
+            type        = lib.types.enum [ "bypass" "one_factor" "two_factor" "deny" ];
+            description = "Authelia policy applied when the rule matches.";
+          };
+          subject = lib.mkOption {
+            type    = lib.types.listOf lib.types.str;
+            default = [];
+            description = "Optional subject constraints (e.g. \"group:admins\").";
+          };
+          resources = lib.mkOption {
+            type    = lib.types.listOf lib.types.str;
+            default = [];
+            description = "Optional URL path regex constraints.";
+          };
+        };
+      });
+      default     = [];
+      description = "Access control rules contributed by service modules. Merged and sorted by priority at build time.";
+    };
+
     enable = lib.mkEnableOption "Authelia SSO gateway" // { default = true; };
 
     image = lib.mkOption {
@@ -178,6 +168,15 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    # -----------------------------------------------------------------------
+    # Authelia's own bypass rule — must be first so the login UI is reachable.
+    # -----------------------------------------------------------------------
+    homey.authelia.accessControlRules = [{
+      priority = 0;
+      domain   = [ "auth.${domain}" ];
+      policy   = "bypass";
+    }];
+
     # -----------------------------------------------------------------------
     # Secrets
     # -----------------------------------------------------------------------