Authelia administration

Anonymous deployments require GBB_ADMIN_GROUP, GBB_PUBLIC_ORIGIN, and explicit GBB_HUMAN_TRUSTED_PROXIES CIDRs. Go accepts Remote-User and Remote-Groups only from those immediate ingress peers, then checks exact group membership. Go does not handle LDAP passwords or connect to LDAP. Keep Authelia's existing LDAP integration and require the same administrative group in its access policy.

Protect /admin/* and /api/v1/admin/* through Traefik ForwardAuth. Strip incoming identity headers on every public route; on administrative routes strip them before ForwardAuth copies authenticated response headers. Restrict backend network access to ingress and explicitly authorized internal services. Proxy CIDRs alone do not make a header trustworthy if ingress passes client-supplied values. See Authelia's integration and the middleware example (deploy/k8s/authelia.example.yaml in the repo).

Browser mutations require the exact configured Origin. The administrative identity endpoint is /api/v1/admin/identity; mutations record the authenticated actor. Administrators cancel through /api/v1/admin/builds/{id}/cancel, while anonymous owners use the public cancellation route. The Admin link reloads through ingress so Authelia can authenticate navigation before the admin UI mounts.

When Authelia administration is configured, token creation/revocation and token session endpoints return 410. Bootstrap seeding is skipped. Historical token IDs remain for attribution. Remote token-authenticated CLI workflows therefore no longer work against the anonymous public deployment; local CLI compilation remains available. Legacy non-anonymous deployments retain their existing contract during migration and must not be used as the public launch configuration.

The examples do not configure your Cloudflare IP allowlist, zone-specific origin TLS, administrative group policy, or network selectors automatically. Those must be supplied and verified in the target environment before rollout.