Auth SSO

auth.loca.zone is the sign-in desk for selected private loca.zone sites: Nginx sends an unsigned visitor to Authelia, Authelia checks the password and creates the shared authelia_session cookie, and Nginx lets the visitor return to the requested site only after Authelia approves the request.

flowchart LR
    A[Browser opens protected app] --> B[Nginx]
    B --> C{Authelia approves session?}
    C -->|no| D[auth.loca.zone sign-in]
    D --> E[loca.zone session cookie]
    E --> B
    C -->|yes| F[Protected app]

Status: applied 2026-08-27

• live sign-in service:
  • portal: https://auth.loca.zone
  • backend: Docker Compose service authelia on loopback port 51091
  • theme: dark
  • session limits: expiration: 24h, inactivity: 12h, remember_me: 1y
• live portal injection:
  • sub_filter '</title>' inserts /portal-forest.css
  • sub_filter '</head>' inserts /portal-remember.js
  • both same-origin assets return 200
  • remember me is visible and starts checked; users can untick it
• live companion wiki:
  • URL: https://wiki.auth.loca.zone
  • HTTPS uses its own wiki.auth.loca.zone certificate
  • published root: /home/loca/dev/wikis/auth/current
• protected-gate proof:
  • https://tndm.loca.zone/ still returns 302 to https://auth.loca.zone/?rd=...
• changelog — applied 2026-08-27:
  • portal theme changed from auto to dark
  • normal session limits changed from 1h / 5m to 24h / 12h
  • remembered-session lifetime changed from 1M to 1y
  • /portal-cleanup.css was replaced by /portal-forest.css and /portal-remember.js, then deleted
  • the remember-me row changed from hidden to visible and pre-checked
  • wiki.auth.loca.zone changed from a local build to a live HTTPS site with a dedicated certificate

Start here

• first login or redirect question:
  • How login works
• unexpected logout or a risky long session:
  • Sessions and remember me
• which host receives which policy:
  • Protected apps
• native OIDC sign-in for LiteLLM and Coder:
  • OIDC clients
• forest styling or checkbox injection:
  • Portal customization
• command needed right now:
  • Operator runbook
• account or secret handling:
  • Users and secrets
• failure diagnosis:
  • Troubleshooting

Sources of truth

• live Authelia configuration:
  • /home/loca/dev/services/authelia/config/configuration.yml
• live Compose definition:
  • /home/loca/dev/services/authelia/docker-compose.yml
• live portal vhost:
  • /etc/nginx/sites-available/auth.loca.zone
• host port and ask-first registry:
  • /home/loca/AGENTS.md
• applied change workspace:
  • /home/loca/dev/auth