From d45c9d203b56ee4a9cceebb5f0dd127f31b9483e Mon Sep 17 00:00:00 2001 From: Spendlik Date: Tue, 11 Aug 2026 09:46:25 +0000 Subject: [PATCH] =?UTF-8?q?Mark=20Phase=209=20(Authelia)=20skipped=20by=20?= =?UTF-8?q?decision=20=E2=80=94=20bypass,=20rely=20on=20Koillection's=20ow?= =?UTF-8?q?n=20login=20for=20this=20single-user=20instance?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- 114_koillection_deployment.md | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/114_koillection_deployment.md b/114_koillection_deployment.md index cfcde2a..be7ef4b 100644 --- a/114_koillection_deployment.md +++ b/114_koillection_deployment.md @@ -1,6 +1,6 @@ # 114 — Koillection Deployment Guide -> Status: **IN PROGRESS** — CT created 2026-08-11, app + nginx + SSL + DNS live, Authelia decision + first login pending (Phase 9+) +> Status: **IN PROGRESS** — CT created 2026-08-11, app + nginx + SSL + DNS live, Authelia bypassed by decision, first login pending (Phase 10+) > CT ID: 114 · IP: 192.168.1.114 > Domain: `collections.spendlik.sk` > Last updated: 2026-08-11 @@ -311,7 +311,12 @@ Verified resolving via `nslookup collections.spendlik.sk` on CT 101 (canonical n --- -## Phase 9 — Authelia Protection (CT 102) +## Phase 9 — Authelia Protection (CT 102) — ❌ SKIPPED by decision (2026-08-11) + +**Decision: bypass Authelia, rely on Koillection's own login only.** Personal single-user instance — Koillection's built-in authentication is sufficient, and no Authelia middleware was ever added to the CT 101 nginx vhost (Phase 6), so there is nothing to add or remove. No `/etc/authelia/configuration.yml` changes were made for this domain. + +
+Reference: steps to add Authelia later if this decision changes Enter CT 102, edit `/etc/authelia/configuration.yml`. Add to `access_control.rules`: @@ -320,8 +325,6 @@ Enter CT 102, edit `/etc/authelia/configuration.yml`. Add to `access_control.rul policy: two_factor ``` -> Koillection has its own internal login system. Authelia adds a second layer before users even reach the login page. Since this is a personal single-user instance, you may prefer Authelia bypass and rely on Koillection's own login instead — your call. - Restart Authelia after editing: ```bash @@ -330,6 +333,8 @@ docker compose restart Add the Authelia middleware to the nginx vhost in CT 101 (follow the pattern from other protected services). +
+ --- ## Phase 10 — First Login & Initial Setup @@ -445,3 +450,4 @@ mkdir -p /opt/koillection/backups | `nginx: command not found` when following Phase 6 | You're inside CT 114 (koillection), not CT 101 (reverse-proxy). Check the shell prompt — nginx work always happens on CT 101, never on the app container itself | | Wrong nginx vhost filename | Use the full domain as the filename (`collections.spendlik.sk`), matching every other vhost on CT 101 — not the short service name | | certbot fails domain validation | DNS (Phase 8) must resolve publicly before certbot's HTTP-01 challenge (Phase 7) will succeed — do DNS first if it hasn't propagated yet | +| No 2FA on collections.spendlik.sk | Intentional — Authelia was bypassed by decision (Phase 9). Security relies solely on Koillection's own login. Revisit if this ever becomes multi-user or exposed beyond personal use |