Protected apps

flowchart LR
    R[Incoming authorization request] --> M{Exact domain rule?}
    M -->|auth.loca.zone| B[bypass]
    M -->|listed private host| O[one_factor]
    M -->|no match| D[default_policy: bypass]
    O --> N{Nginx location invokes auth_request?}
    N -->|yes| P[Policy is enforced]
    N -->|no| X[Request never reaches Authelia]

Access-control rule inventory

• generated from:
  • /home/loca/dev/services/authelia/config/configuration.yml
• observed on:
  • 2026-08-27
• default when no rule matches:
  • bypass
• port cross-reference source:
  • /home/loca/AGENTS.md, port_convention.registry
  • not listed means the registry has no entry; no port is guessed

Domain	Authelia policy	AGENTS.md port registry	Nginx edge observation
auth.loca.zone	bypass	Authelia 51091, loopback Docker	Portal reverse proxy; bypass prevents a self-redirect loop
admin.loca.zone	one_factor	not listed	No matching standalone vhost file was observed
cdsr.loca.zone	one_factor	52224	Auth request included on /
omp.loca.zone	one_factor	50086, registered exemption	Auth request included on /
pwiz.loca.zone	one_factor	52222	Auth request included on app and API locations
trlm.loca.zone	one_factor	not listed	Only /set-password invokes auth request; / does not
odaw.loca.zone	one_factor	no app port; static vhost, API uses MixBox 51644	Auth request included on reviewed static and API routes
mxbx.loca.zone	one_factor	51644	Auth request included on /
tndm.loca.zone	one_factor	51818	Interactive routes use auth request; agent API has a deliberate bearer-token path
midi.loca.zone	one_factor	not listed	Static routes invoke auth request
wiki.midi.loca.zone	one_factor	not listed	Static wiki routes invoke auth request

What the policy words mean here

• bypass:
  • Authelia approves without asking for a login
  • required for the sign-in portal itself
• one_factor:
  • a valid password-backed Authelia session is required when Nginx asks Authelia
  • no second factor is demanded by this policy
• default_policy: bypass:
  • an unlisted domain is approved if it reaches this Authelia policy set
  • it does not automatically add or remove an Nginx gate

Rule versus enforcement

• an access_control rule:
  • tells Authelia what answer to give
  • does not modify any Nginx vhost
• an Nginx gate requires both:
  • server scope: include snippets/authelia-location.conf;
  • protected location: include snippets/authelia-authrequest.conf;
• operational consequence:
  • never call a host protected merely because its domain appears in the rule list
  • verify the exact Nginx location that handles the sensitive route
  • trlm.loca.zone demonstrates the difference: its rule is one_factor, but only /set-password currently calls Authelia

Companion wiki boundary

• live wiki.auth.loca.zone vhost:
  • serves this public static wiki at https://wiki.auth.loca.zone
  • uses its own dedicated certificate
  • does not include the Authelia auth-request snippets
  • has no explicit access-control rule
• changing that boundary later:
  • is an Nginx config and access-control change
  • is an ask-first stop under /home/loca/AGENTS.md

Related pages

• request mechanics:
  • How login works
• native application login:
  • OIDC clients
• safe commands:
  • Operator runbook