Access control
loca.zone enforces a guest-first, native-admin operational model. Edge reverse-proxy authentication defines ingress boundaries and never fabricates application roles.
Gate Classifications
Ingress traffic is segmented across four edge protection tiers:
| Gate kind | Applications | Ingress mechanism | Operator policy |
|---|---|---|---|
| Authelia forward-auth | cdsr, deek, icon, klbz, lllm (UI), midi, mxbx, odaw, omp, opmo, remotion.opmo, hyperframes.opmo, tndm, trlm (/set-password) | Nginx forward-auth via auth.loca.zone | Master owner credentials |
| HTTP basic auth | less (Paperless) | Nginx auth_basic file | Dedicated credentials |
| Application native | code, elv3, flxr, less, lobe, loco (native Authelia OIDC, no edge gate), most, opno, team, yuan | In-app login and session management | Application break-glass admin |
| Open or guest | allm, khoj, pwiz (trusted-header identity), rckt, sflw (public showcase), surf, os (and static apps) | Direct public proxy, trusted header, or guest surface | Preserve public guest experience |
Operator Journeys
| Journey | Safe path | Target URL |
|---|---|---|
| OMP owner | Authenticate via Authelia then enter OMP | omp.loca.zone |
| Trilium bootstrap | Open protected setup route with Authelia then set native password | trlm.loca.zone/set-password |
| Guest user | Direct navigation without edge gate | Normal public routes |
| Native administrator | Application-native login screen for break-glass operations | Application admin URLs |
Capability Matrix
| Application | Access model | Federation reality | Operator rule |
|---|---|---|---|
| OMP | Whole app is Authelia-gated | Ingress boundary for owner | Use the master owner login |
| Trilium | Only /set-password is Authelia-gated | Native password remains authoritative | Authenticate, then complete native bootstrap |
| Fluxer | Native wildcard admin preserved | Native admin does not match master owner | Keep native admin |
| Puter | Built-in native admin preserved | Deployed path lacks generic Authelia OIDC | Keep native admin |
| Mattermost | Native system admin preserved | Generic OIDC needs an active Enterprise license | Keep native admin |
| SurfSense | Native local authentication | No generic OIDC or SAML | Keep native admin |
| AnythingLLM | Open single-user guest mode | Multi-user mode changes the guest contract | Keep guest mode |
Non-Negotiables
- Preserve established public and guest routes.
- Keep native break-glass administrators until a tested, application-native migration exists.
- Treat reverse-proxy authentication as an ingress boundary, never as an application-admin role.
- Remove unused federation experiments rather than retaining dormant credentials or client registrations.
- Before changing an application identity model, test native recovery, guest access, logout, expiry, restart, and rollback.
Sources
/etc/nginx/sites-available/omp.loca.zone:1-40/etc/nginx/sites-available/trlm.loca.zone:1-40/etc/nginx/sites-available/auth.loca.zone:1-35/home/loca/dev/wikis/loca/evidence/legacy-pages/master-access.md:1-74