Pin verified versions; add decision tree for Authelia coverage

- Pin AUTHELIA_VERSION=4.39.19 (current stable, released 2026-04-12) and
  FAIL2BAN_VERSION=1.1.0-r0 in .env.example + docker-compose.yml.
- Reshape access_control.rules and the Caddyfile snippet around a
  three-case decision tree: no app auth (Authelia is the gate), app with
  proxy-auth support (switch FROM app login TO Authelia headers), and
  apps that keep their own login (skip Authelia entirely).
- Document Frigate 0.14+ proxy auth specifically: auth.enabled: False,
  proxy.header_map (remote-user / remote-groups), trusted_proxies for
  the caddy_net subnet, optional X-Proxy-Secret for cross-VLAN trust.

https://claude.ai/code/session_013XZ1vmgk78k2PEQ5DmJhF3

authelia/configuration.yml

@@ -63,28 +63,61 @@ authentication_backend:
 # ---------------------------------------------------------------------------
 # Access control
 #
-# default_policy: deny means every domain Authelia sees must have an
-# explicit allow rule. Caddy only sends a domain to Authelia when its site
-# block has `import authelia`, so domains you don't proxy through Authelia
-# aren't affected.
+# default_policy: deny means every domain that Caddy forwards here must
+# have an explicit allow rule. Caddy only forwards when a site block has
+# `import authelia`, so domains where you keep the app's own auth (no
+# `import authelia` in Caddy) bypass Authelia entirely and don't need
+# rules here.
 #
 # Policies:
-#   bypass      no auth (Authelia portal itself)
+#   bypass      Authelia waves the request through (used for the portal)
 #   one_factor  password only
 #   two_factor  password + TOTP
+#
+# Decision tree for whether a site needs an Authelia rule at all:
+#
+#   - App has NO built-in auth (doorbell PTT page) -> rule here +
+#     `import authelia` in Caddy. Use two_factor for anything that
+#     controls hardware in the house.
+#
+#   - App has built-in auth but supports trusted-header proxy auth
+#     (Frigate 0.14+, Grafana, Gitea, Jellyfin, ...) -> rule here +
+#     `import authelia` in Caddy AND switch the app to proxy auth in
+#     its own config. Single login (Authelia), 2FA, app keeps its own
+#     user/role mapping driven from Authelia headers.
+#
+#   - App has built-in auth and CAN'T switch (router admin, legacy
+#     things) -> NO rule here, NO `import authelia` in Caddy. The
+#     traffic skips Authelia entirely; the app handles its own login.
 # ---------------------------------------------------------------------------
 access_control:
   default_policy: 'deny'
   rules:
-    - domain: 'auth.example.com'        # CHANGE
+    # The Authelia portal itself is always bypass.
+    - domain: 'auth.example.com'                # CHANGE
       policy: 'bypass'
 
-    # Examples -- uncomment / change to your subdomains:
-    # - domain: 'cam.example.com'
-    #   policy: 'one_factor'
+    # ----- Apps with NO built-in auth: Authelia is the only gate -----
+    # The Pi doorbell PTT page has no app-level auth, so Authelia is it.
+    # 2FA is appropriate -- this URL controls a speaker in your house.
     # - domain: 'doorbell.example.com'
     #   policy: 'two_factor'
 
+    # ----- Apps that switched FROM their own auth TO Authelia -----
+    # Frigate 0.14+ supports trusted-header proxy auth. To use this:
+    #   1. In frigate_config/config.yml, set `auth.enabled: False`
+    #      and add a `proxy:` block with `header_map.user: remote-user`
+    #      and `header_map.role: remote-groups` (see README).
+    #   2. `import authelia` in the cam.* Caddy block.
+    #   3. Add the rule below.
+    # - domain: 'cam.example.com'
+    #   policy: 'two_factor'
+
+    # ----- Apps that KEEP their own auth -----
+    # Don't add a rule and don't `import authelia` in their Caddy block.
+    # Example: a router admin page on `router.example.com` -- no rule
+    # appears here, the request never reaches Authelia.
+
 session:
   # secret loaded via AUTHELIA_SESSION_SECRET_FILE
   cookies: