From ae7799286903f9ac93838afa41fdd7100b528dbf Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 22 Aug 2026 20:44:19 +0000 Subject: [PATCH] Wire the Security Dashboard into Authelia's per-user access scoping _authelia_scope_access() (services/authelia.sh) already works for any Authelia-protected service, forward_auth-gated or OIDC alike -- it's just never been called from security-dashboard.sh on either the domain-takeover path (_secdash_offer_asterisk_domain) or the plain separate-subdomain path, so every domain this dashboard ever protected defaulted to "any Authelia user", with no way to restrict it to specific people. That's why the Authelia menu's "Promote to a specific service's access group" reported no scoped groups existing yet even after protecting this dashboard with Authelia. _secdash_configure_caddy() now offers scoping right after the domain is Authelia-protected (guarded on EXTRA_BLOCK being non-empty, so Basic-Auth-only or no-auth setups aren't offered a scoping question for a gate that doesn't exist), guarded by declare -F for standalone runs where authelia.sh was never sourced. Runs whether the Caddy block was just freshly written or already existed, so re-running the installer on an already-configured domain still offers it. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01SpKTLpwAgZNooTacWeQLuc --- services/security-dashboard.sh | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/services/security-dashboard.sh b/services/security-dashboard.sh index f0bb1cd..1cfacdb 100644 --- a/services/security-dashboard.sh +++ b/services/security-dashboard.sh @@ -814,6 +814,20 @@ CADDYBLOCK log_warning "$SD_DOMAIN already in Caddyfile — leaving the existing entry alone." fi + # Offer per-user access scoping now that this domain is actually + # Authelia-protected (local import or remote forward_auth — EXTRA_BLOCK + # is only non-empty when one of those was configured above; skip this + # entirely for Basic-Auth-only or no-auth setups, where there's no + # Authelia gate to scope). This dashboard was never wired into + # _authelia_scope_access before now, on either this domain-takeover path + # or the plain separate-subdomain path below it — every protected + # domain here defaulted to "any Authelia user", with no way to restrict + # it to specific people. Guarded by declare -F: this file can run + # standalone with authelia.sh never sourced. + if [ -n "$EXTRA_BLOCK" ] && declare -F _authelia_scope_access >/dev/null 2>&1; then + _authelia_scope_access "security-dashboard" "$SD_DOMAIN" + fi + # This port never needs to be open to the internet — only Caddy (local, # via host.docker.internal) ever needs to reach it. if command -v ufw &>/dev/null; then