🔐 Master Access

🧭 Quick Start

loca.zone uses a guest-first, native-admin model:

Need	Route	Authority	Status
Operate Oh My Pi	omp.loca.zone	Authelia master owner	✅ Observed redirect
Bootstrap Trilium	trlm.loca.zone/set-password	Authelia, then Trilium native password	✅ Observed redirect
Use a public/guest surface	Its normal public route	Application policy	✅ Keep public
Administer a native-only app	Its native sign-in path	That application’s break-glass admin	🔒 Native only

Decision: keep native-only administrators. Do not present proxy identity headers as application roles.

🗺️ Access Map

flowchart TD
    request[Request] --> gate{Explicit Authelia boundary?}
    gate -->|Yes| login[auth.loca.zone]
    login --> owner[Master owner]
    owner --> restricted[Restricted route]
    gate -->|No| policy{Application route policy}
    policy -->|Public or guest| guest[Direct guest/public surface]
    policy -->|Native admin| native[Native sign-in]
    native --> role[Application-owned role]

📊 Capability Matrix

Application	Current access model	Federation reality	Operator rule
OMP	Whole app is Authelia-gated	Not needed for its owner boundary	Use the master owner login
Trilium	Only /set-password is Authelia-gated	Native password remains authoritative	Authenticate, then complete native bootstrap
Fluxer	Native wildcard admin preserved	OIDC exists, but the native admin does not match the master owner and no safe unattended bootstrap exists	Keep its native admin
Puter	Built-in native admin preserved	Deployed path lacks generic Authelia OIDC configuration	Keep native admin
Mattermost	Native system admin preserved	Generic OIDC needs an active Enterprise license and explicit native-auth migration	Keep native admin
SurfSense	Native local authentication	No generic OIDC or SAML	Keep native admin
AnythingLLM	Open single-user guest mode	No generic OIDC or SAML; multi-user mode changes the guest contract	Keep guest mode

🛡️ Non-Negotiables

• Preserve established public and guest routes.
• Keep native break-glass administrators until a tested, application-native migration exists.
• Treat reverse-proxy authentication as an ingress boundary, never as an application-admin role.
• Remove unused federation experiments rather than retaining dormant credentials or client registrations.
• Before changing an app’s identity model, test native recovery, guest access, logout, expiry, restart, and rollback.

🚶 Operator Journeys

Journey	Safe path
OMP owner	Open OMP → authenticate at Authelia → enter OMP.
Trilium bootstrap	Open the protected setup route → authenticate at Authelia → set the Trilium-native password.
Guest user	Open the application’s public route directly; do not add a blanket Authelia gate.
Native administrator	Use the application’s own administrator login and retain it for recovery.

✅ Verification Map

Check	Expected result	Evidence state
OMP without a session	Redirect to Authelia	✅ Observed
Trilium setup without a session	Redirect to Authelia	✅ Observed
SurfSense guest landing	Reachable without an Authelia gate	✅ Observed
Any future federation change	Native role, guest policy, recovery, rollback, and authenticated owner journey all pass	⏳ Required before cutover

🔗 Related

• 🧠 Homelab Solutions
• ⚙️ Quartz Hosting