Everything changed - major rewrite

modules/services/phpldapadmin.nix

@@ -3,7 +3,7 @@
 # phpLDAPadmin — web UI for OpenLDAP management.
 #
 # Stateless container (no persistent volumes needed).
-# Protected by Authelia two_factor, admins-only policy (defined in authelia.nix).
+# Protected by Authelia two_factor, admins-only policy.
 # Bound to localhost:8081; Caddy reverse-proxies it.
 #
 # Networking: uses default bridge (podman) network with a port mapping
@@ -12,7 +12,8 @@
 # host.containers.internal DNS name that podman injects automatically.
 
 let
-  cfg = config.homey.phpldapadmin;
+  cfg    = config.homey.phpldapadmin;
+  domain = homeyConfig.domain;
 in
 {
   options.homey.phpldapadmin = {
@@ -50,6 +51,14 @@ in
       wants = lib.mkAfter [ "podman-openldap.service" "podman-homey-network.service" ];
     };
 
+    # -----------------------------------------------------------------------
+    # Authelia access control — admins only, two_factor; all others denied.
+    # -----------------------------------------------------------------------
+    homey.authelia.accessControlRules = [
+      { priority = 20; domain = [ "ldapadmin.${domain}" ]; subject = [ "group:admins" ]; policy = "two_factor"; }
+      { priority = 21; domain = [ "ldapadmin.${domain}" ]; policy = "deny"; }
+    ];
+
     # -----------------------------------------------------------------------
     # Caddy virtual host — forward_auth + reverse_proxy
     # -----------------------------------------------------------------------