Monitoring primarily

modules/services/authelia.nix

@@ -107,6 +107,27 @@ let
         - domain:
             - "jellyfin.${domain}"
           policy: "one_factor"
+        - domain:
+            - "uptime.${domain}"
+          subject:
+            - "group:admins"
+          policy: "two_factor"
+        - domain:
+            - "uptime.${domain}"
+          policy: "deny"
+        - domain:
+            - "grafana.${domain}"
+          subject:
+            - "group:admins"
+          policy: "two_factor"
+        - domain:
+            - "grafana.${domain}"
+          policy: "deny"
+        # ntfy: bypass — ntfy enforces its own token/password auth;
+        # the mobile app must be able to connect without Authelia SSO.
+        - domain:
+            - "ntfy.${domain}"
+          policy: "bypass"
 
     notifier:
       filesystem:
@@ -196,5 +217,14 @@ in
       after    = lib.mkAfter  [ "mnt-data.mount" "podman-openldap.service" "podman-homey-network.service" ];
       requires = lib.mkAfter  [ "mnt-data.mount" "podman-openldap.service" "podman-homey-network.service" ];
     };
+
+    # -----------------------------------------------------------------------
+    # Uptime Kuma monitor for this service
+    # -----------------------------------------------------------------------
+    homey.monitoring.monitors = [{
+      name     = "Authelia";
+      url      = "https://auth.${domain}/api/health";
+      interval = 60;
+    }];
   };
 }