Spendlik/Claude_Homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Mark Phase 9 (Authelia) skipped by decision — bypass, rely on Koillection's own login for this single-user instance

Browse Source
This commit is contained in:
Spendlik 2026-08-11 09:46:25 +00:00
parent baee2d55fe
commit d45c9d203b
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
114_koillection_deployment.md
View File

@ -1,6 +1,6 @@
# 114 — Koillection Deployment Guide # 114 — Koillection Deployment Guide
> Status: **IN PROGRESS** — CT created 2026-08-11, app + nginx + SSL + DNS live, Authelia decision + first login pending (Phase 9+) > Status: **IN PROGRESS** — CT created 2026-08-11, app + nginx + SSL + DNS live, Authelia bypassed by decision, first login pending (Phase 10+)
> CT ID: 114 · IP: 192.168.1.114 > CT ID: 114 · IP: 192.168.1.114
> Domain: `collections.spendlik.sk` > Domain: `collections.spendlik.sk`
> Last updated: 2026-08-11 > Last updated: 2026-08-11
@ -311,7 +311,12 @@ Verified resolving via `nslookup collections.spendlik.sk` on CT 101 (canonical n
--- ---
## Phase 9 — Authelia Protection (CT 102) ## Phase 9 — Authelia Protection (CT 102) — ❌ SKIPPED by decision (2026-08-11)
**Decision: bypass Authelia, rely on Koillection's own login only.** Personal single-user instance — Koillection's built-in authentication is sufficient, and no Authelia middleware was ever added to the CT 101 nginx vhost (Phase 6), so there is nothing to add or remove. No `/etc/authelia/configuration.yml` changes were made for this domain.
<details>
<summary>Reference: steps to add Authelia later if this decision changes</summary>
Enter CT 102, edit `/etc/authelia/configuration.yml`. Add to `access_control.rules`: Enter CT 102, edit `/etc/authelia/configuration.yml`. Add to `access_control.rules`:
@ -320,8 +325,6 @@ Enter CT 102, edit `/etc/authelia/configuration.yml`. Add to `access_control.rul
policy: two_factor policy: two_factor
``` ```
> Koillection has its own internal login system. Authelia adds a second layer before users even reach the login page. Since this is a personal single-user instance, you may prefer Authelia bypass and rely on Koillection's own login instead — your call.
Restart Authelia after editing: Restart Authelia after editing:
```bash ```bash
@ -330,6 +333,8 @@ docker compose restart
Add the Authelia middleware to the nginx vhost in CT 101 (follow the pattern from other protected services). Add the Authelia middleware to the nginx vhost in CT 101 (follow the pattern from other protected services).
</details>
--- ---
## Phase 10 — First Login & Initial Setup ## Phase 10 — First Login & Initial Setup
@ -445,3 +450,4 @@ mkdir -p /opt/koillection/backups
| `nginx: command not found` when following Phase 6 | You're inside CT 114 (koillection), not CT 101 (reverse-proxy). Check the shell prompt — nginx work always happens on CT 101, never on the app container itself | | `nginx: command not found` when following Phase 6 | You're inside CT 114 (koillection), not CT 101 (reverse-proxy). Check the shell prompt — nginx work always happens on CT 101, never on the app container itself |
| Wrong nginx vhost filename | Use the full domain as the filename (`collections.spendlik.sk`), matching every other vhost on CT 101 — not the short service name | | Wrong nginx vhost filename | Use the full domain as the filename (`collections.spendlik.sk`), matching every other vhost on CT 101 — not the short service name |
| certbot fails domain validation | DNS (Phase 8) must resolve publicly before certbot's HTTP-01 challenge (Phase 7) will succeed — do DNS first if it hasn't propagated yet | | certbot fails domain validation | DNS (Phase 8) must resolve publicly before certbot's HTTP-01 challenge (Phase 7) will succeed — do DNS first if it hasn't propagated yet |
| No 2FA on collections.spendlik.sk | Intentional — Authelia was bypassed by decision (Phase 9). Security relies solely on Koillection's own login. Revisit if this ever becomes multi-user or exposed beyond personal use |