feat: Authelia SSO stack for auth.schwenk.online

Compose + Traefik ForwardAuth middleware, Redis sessions, SMTP via 0012.de, TOTP and ACL for consumer apps (e.g. pi.schwenk.online). Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-01 10:29:17 +02:00
commit 93c78f503e
15 changed files with 1186 additions and 0 deletions
@@ -0,0 +1,15 @@
 # Copy to .env on the deploy host. Never commit .env.
 # SMTP values: same as ~/git/froxxxy/0012/server.env (Plesk mail)
 TZ=Europe/Berlin
 # --- Authelia crypto (generate on deploy; see README) ---
 # Prefer secret files under ./secrets/ (recommended). If you use env instead:
 # AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET=
 # AUTHELIA_SESSION_SECRET=
 # AUTHELIA_STORAGE_ENCRYPTION_KEY=
 # --- SMTP (0012.de Plesk) ---
 AUTHELIA_NOTIFIER_SMTP_USERNAME=admin@0012.de
 AUTHELIA_NOTIFIER_SMTP_PASSWORD=
 AUTHELIA_NOTIFIER_SMTP_SENDER=Authelia <monitor@0012.de>
@@ -0,0 +1,14 @@
 # Secrets & local env
 .env
 secrets/*
 !secrets/.gitkeep
 # Authelia runtime / local user DB
 config/users_database.yml
 config/db.sqlite3
 config/db.sqlite3-*
 config/notification.txt
 # Logs / OS
 *.log
 .DS_Store
@@ -0,0 +1,278 @@
 <!-- vibesoul-updated: 2026-07-24T09:12:40+02:00 -->
 # AGENTS.md — Operational Instructions
 How the coding agent works with Fränky's projects.
 Also read (project root, next to this file): `INFRASTRUCTURE.md`, `STANDARDS.md`, `BOUNDARIES.md`, project `SOUL.md`, project `MOOD.md`.  
 Persona & preferences: `USER.md` (Tier 2).
 ---
 ## Rule Priority
 Highest wins. One line per source:
 | Priority | Source |
 |----------|--------|
 | 1 | Explicit chat instruction from Fränky |
 | 2 | Project `SOUL.md` / project-local `BOUNDARIES.md` / project `AGENTS` snippets |
 | 3 | `BOUNDARIES.md` |
 | 4 | `AGENTS.md` (this file) |
 | 5 | `STANDARDS.md` |
 | 6 | `INFRASTRUCTURE.md` |
 | 7 | `MOOD.md` — **tone only**, never overrides safety or ops rules |
 | 8 | `USER.md` — persona & preferences, not operational overrides |
 **UI/UX:** project `SOUL.md` overrides global `STANDARDS.md` when they conflict.
 ---
 ## Startup (Tier 1 / Tier 2)
 Cursor does not auto-load context. Use two tiers:
 ### Tier 1 — always (light)
 At the start of any substantive task, without waiting for ack:
 1. Project `SOUL.md` — **Agent Quick Start** section (or full file if no Quick Start)
 2. `BOUNDARIES.md` — **Never Ever** section
 ### Tier 2 — full load
 On `@AGENTS.md ack`, first chat in a project, or when Fränky says context was lost:
 1. `AGENTS.md`, `BOUNDARIES.md`, `STANDARDS.md`, `INFRASTRUCTURE.md`
 2. `USER.md` — persona, work-style table, communication prefs
 3. Project `SOUL.md` (full), project `MOOD.md` if present
 4. Skim project structure
 ### Command: `AGENTS.md ack`
 Fränky schreibt `AGENTS.md ack`.
 **Agent:** Tier-2 read, then reply with this **compact template** (one block, no code changes):
 ```
 AGENTS ack ✓
 · Pipeline: [1-line what this project is]
 · Non-goals: [from SOUL, or "SOUL missing"]
 · Commit policy: [no commit unless … / project override]
 · MOOD: [active session character]
 · Paths: [key workdirs / mounts from SOUL or INFRA snippet]
 · Conflict: [1 sentence if SOUL vs STANDARDS disagree, else "none"]
 ```
 ---
 ## Work Modes
 | Mode | Trigger | Behavior |
 |------|---------|----------|
 | **Question-only** | Question, review, "how does X work?" | No file changes, commit, or drive-by fixes |
 | **Standard** | Default | Restate → align on plan → implement → verify → hand off |
 | **Unattended / Away** | "wenn ich zurück bin", "mach ohne mich", "overnight", explicit away | **Skip plan alignment** — proceed with best judgment; justify in handoff |
 **Plan Mode (Cursor):** If file edits are blocked, **abort and wait** — never circumvent via shell. See `BOUNDARIES.md`.
 ### Unattended / Away — extra rules
 - **Monitoring:** Cursor background shell + polling — **not** external wrapper scripts as default
 - **Handoff must include:** log paths, PIDs if relevant, how to recognize success, next command for Fränky
 - Write blocked items or run status to `NOTES.md` when useful
 - **Notify** via `ntfyschwenkonline` when the task finishes (see [Notifications](#notifications))
 ---
 ## Default Workflow (Standard mode)
 1. **Restate** the request; turn into plan or mini-PRD
 2. **Align** on the plan — resolve ambiguities before coding
 3. **Implement** (see Testing below)
 4. **Verify** — run tests when appropriate; do not guess
 5. **Hand off** — summary, how to test locally, log paths for long jobs
 6. **Deploy / prod** — Fränky handles unless project or chat says otherwise
 After **long-running** work: send push notification (see [Notifications](#notifications)).
 ---
 ## Autonomy Matrix
 See also `USER.md` **Work Style** table for Fränky's preference scores.
 | Action | Default |
 |--------|---------|
 | Write / change code | ✅ OK |
 | Write tests | ✅ OK when non-trivial or suite exists |
 | Add dependencies | ✅ OK |
 | Touch README / docs | ✅ OK |
 | Change CI/CD config | ⚠️ Ask first |
 | Refactor "on the side" | ⚠️ Ask first |
 | Update AGENTS / SOUL / BOUNDARIES | ⚠️ Ask first (or explicit "remember this") |
 | Update `MOOD.md` on disk | 🚫 Only on `persist MOOD` or explicit instruction |
 | Create auxiliary `.md` (`NOTES.md`, todos) | ✅ OK |
 | Git commit / push / deploy | 🚫 Unless explicit or project `SOUL.md` allows |
 | `ntfyschwenkonline` after long-running task | ✅ OK |
 ---
 ## MOOD: Session vs. Persist
 | | Session | Persist to `MOOD.md` |
 |---|---------|----------------------|
 | Trigger | `mood "XY"` in chat | `persist MOOD` or explicit "save mood to file" |
 | Effect | Tone for this chat only | Updates `## Aktueller Mood` in file |
 | Default | **Yes** — `mood "XY"` does **not** edit the file |
 ---
 ## Testing
 Fränky's bar is **pragmatic, not TDD-by-default** (`USER.md`: tests score 2/5).
 - Run tests when a suite exists **and** the change is non-trivial
 - Follow project `SOUL.md` if stricter (e.g. pytest before handoff)
 - Do not block small fixes on missing test infrastructure
 ---
 ## Commits & Issues
 - **Default: no commit, no push** without explicit instruction
 - **Format:** [Conventional Commits](https://www.conventionalcommits.org/) (`feat:`, `fix:`, `docs:`, …) when committing
 - **Forge:** **Gitea** (`gitea.schwenk.online`) unless project says otherwise — not GitLab
 - Link Gitea issues when they exist (`#123`)
 - Do not mix unrelated changes (e.g. MOOD switch + feature) in one commit
 ---
 ## Collaboration Patterns
 ### `NOTES.md`
 Scratchpad — use for blocked tasks, session park, overnight-run status, handoff crumbs.
 ### Subagents & context budget
 **Keep main context small.** Delegate instead of dumping large outputs into parent chat:
 | Task | Subagent |
 |------|----------|
 | Unknown codebase or many files to scan | **Explore** |
 | Browser / E2E / web UI | **Playwright** |
 | Broad research | **generalPurpose** or **Explore** |
 | Shell / git batch ops | **shell** |
 **Explore** for any project type when orientation is unclear — not only web. **Playwright** only when there is a web UI to test.
 ### Commits when allowed
 One focused commit per completed task — easy to revert. No drive-by refactors.
 ---
 ## Project Infrastructure Snippet
 Machine-specific paths (workdirs, external mounts, local service ports) belong in **project `SOUL.md`**, not global `INFRASTRUCTURE.md`.
 Example SOUL section:
 ```markdown
 ## Infrastructure (project-local)
 - Workdir: ~/.local/share/myapp
 - Mounts: check MegaB before scan
 - Local Immich: :2283 (downstream, not core)
 ```
 See `INFRASTRUCTURE.md` → **Project-local overrides**.
 ---
 ## When Uncertain
 1. Research — read code, run commands
 2. Continue other independent tasks if possible
 3. Park in `NOTES.md`, todo file, or Gitea issue
 4. Ask after research, with options + recommended default
 ---
 ## Error Handling
 - Root cause first — do not guess
 - Escalate on: debug loops, missing uninstallable software
 - Long-running jobs: no arbitrary timeout unless Fränky or SOUL says so; name `progress.log` when applicable
 ---
 ## Notifications
 Fränky's machines have **`/usr/local/bin/ntfyschwenkonline`** — push to [ntfy.schwenk.online](https://ntfy.schwenk.online). Topic = short hostname (`hostname -s`); phone subscribes per machine. Auth is in the installed script — **never copy tokens into repos or chat**.
 ### When to notify
 Send a notification when a **long-running agent task** completes or fails:
 - **Unattended / Away** mode — always on finish (success or failure)
 - Background shell jobs you started (scans, builds, batch ops, overnight runs)
 - Any task Fränky left with an expectation of „meld dich wenn fertig"
 - Rough guide: expected runtime **> ~2 minutes** or explicit away/unattended context
 Do **not** notify for quick edits, short test runs, or question-only chats.
 ### How
 ```bash
 ntfyschwenkonline "OK <project>: <one-line result>"
 # or on failure:
 ntfyschwenkonline "FAIL <project>: <one-line error>, see <log-path>"
 ```
 - **English** message body (CLI/ops convention)
 - One line, ~120 chars — project name, outcome, log path or next step if relevant
 - Run after handoff summary; notification is in addition to chat handoff, not a replacement
 - If `ntfyschwenkonline` is missing or fails: note in chat handoff, do not block
 ### Examples
 ```bash
 ntfyschwenkonline "OK imagetool: scan done 142 dirs, log ~/.local/share/imagetool/progress.log"
 ntfyschwenkonline "FAIL ytrecap: pytest 3 failed, see /tmp/test.log"
 ntfyschwenkonline "OK schwenkonline: build+deploy done"
 ```
 ---
 ## Recording New Rules
 When Fränky says *"never do X"*:
 1. Propose file (`BOUNDARIES.md`, `SOUL.md`, `AGENTS.md`, or multiple)
 2. Store in **Cursor Memories** for explicit rules
 3. Write after confirmation — or immediately if explicit
 ---
 ## Language
 - **Chat:** match Fränky's language (German or English)
 - **CLI / terminal / shell:** always English (unless client project — ask)
 - **Other artifacts:** first language of session
 ---
 ## Tools & MCP
 1. MCP when available and relevant
 2. Built-in tools (shell, grep, read)
 3. Browser automation last resort
 Check MCP schemas before calling.
 ---
 ## Tooling Context
 Primary: **Cursor** (Composer / Agent).  
 Server/deploy: **`INFRASTRUCTURE.md`**. Persona: **`USER.md`**.
@@ -0,0 +1,87 @@
 # BOUNDARIES.md — Hard Limits
 Rules that apply in **every** project unless explicitly overridden in a project-local `BOUNDARIES.md` (stricter only — never looser).
 ---
 ## Never Ever
 | Rule | Why |
 |------|-----|
 | **Commit secrets** | `.env`, API keys, tokens, passwords, private keys — use `.gitignore` and env vars |
 | **Cripple the machine** | No commands that freeze desktop, fill disk, fork-bomb, or saturate CPU/RAM on dev box or server |
 | **Ignore user rules** | `USER.md`, `AGENTS.md`, project context files, and explicit chat instructions are binding |
 | **Force-push to main/master** | Unless Fränky explicitly requests it — warn first |
 | **Destructive prod actions** | No prod DB drops, migrations, or deploys without explicit approval (project may define exceptions) |
 | **Modify code on question-only requests** | Questions get answers — not drive-by fixes |
 | **Bypass edit blocks via shell** | If Plan Mode or any restriction blocks file edits, **stop** — never implement via `echo`, heredoc, `sed -i`, `tee`, etc. |
 ---
 ## Sensitive Data
 - Do not paste secrets into chat, commits, logs, or comments
 - Use `.env.example` with placeholder values — never real credentials
 - Redact tokens and personal data in error output shared in chat
 - When handling personal data: minimize collection, don't log PII unnecessarily
 - If unsure whether data is sensitive: treat it as sensitive
 ---
 ## Git Safety
 - No `git push --force` to shared/main branches without explicit request
 - No `git commit` unless user or project rules allow
 - No skipping hooks (`--no-verify`) unless user explicitly requests
 - No `git config` changes
 ---
 ## System Safety
 - Avoid `rm -rf` on broad paths — confirm target paths for destructive file ops
 - No installing system-wide packages without asking (user-space / venv / container preferred)
 - No rebooting or stopping critical services on remote servers without approval
 ---
 ## Agent Behavior
 - **No hallucination** — if you don't know, say so; read the file, run the command, check docs
 - **No outdated advice** — flag when knowledge may be stale; verify against project code/version
 - **Stop and escalate** on:
  - Debug loops (same error, same failed fix repeated)
  - Required software missing and not installable in context
  - Conflicting instructions you cannot resolve
  - **Plan Mode / read-only mode** blocks file edits — see below
 ### Plan Mode (Cursor)
 When **Plan Mode** (or any agent mode) **blocks file edits**:
 - **Stop.** Do not implement via shell workarounds (`echo >>`, heredoc to file, `sed -i`, `tee`, `python -c` to write files, …)
 - Tell Fränky clearly: edits are blocked; switch to Agent mode or disable Plan Mode
 - **Wait** for his input — do not proceed with implementation
 ---
 ## Dependencies & Licenses
 - Prefer open-source dependencies
 - No automatic addition of copyleft dependencies to proprietary projects without flagging
 - No license violations (stripping headers, ignoring LICENSE files)
 ---
 ## Project-Local Overrides
 Add project-specific boundaries below when copying into a project:
 ```markdown
 ## Project-Specific
 - (example) Never touch the legacy PHP monolith in /old/
 - (example) Auto-deploy to staging is OK; prod requires manual approval
 ```
 When Fränky says *"don't do X here"*, the agent should propose the right file (`BOUNDARIES.md`, `SOUL.md`, or `AGENTS.md`) and persist it.
@@ -0,0 +1,120 @@
 # INFRASTRUCTURE.md — Hosts, Deploy, Git
 Operational context for Fränky's environments. Read with `AGENTS.md`.
 ---
 ## Overview
 | | |
 |---|---|
 | vServer | **`boka`** — Debian 12 (bookworm), Webtropia Cloud VPS |
 | SSH | `ssh frank-schwenk.de` (resolves to boka) |
 | Local dev | **Arch Linux** — desktop + laptop |
 | Reverse proxy | **Traefik** — external Docker network `traefik`, TLS via `myresolver` |
 | Git | **Gitea** — `ssh://git@gitea.schwenk.online:2222/froxxxy/<repo>.git` |
 | Server app paths | `/home/frank/<domain>/` (e.g. `/home/frank/schwenk.online`) |
 | Shared services | Traefik, Gitea + Runner, Immich, Portainer — **treat as fragile** |
 | Separate hosting | **`0012.de`** — Plesk webspace, FTP deploy — **not** boka Docker |
 | Push notify | **`ntfyschwenkonline`** on each machine (`/usr/local/bin`) → `ntfy.schwenk.online`, topic = hostname |
 ---
 ## Repo → Server Mapping
 | Local repo (`~/git/froxxxy/`) | Server path | Domain |
 |-------------------------------|-------------|--------|
 | schwenkonline | `/home/frank/schwenk.online` | schwenk.online |
 | ytrecap | `/home/frank/ytrecap.schwenk.online` | ytrecap.schwenk.online |
 | bringtake | `/home/frank/bringtake.schwenk.online` | bringtake.schwenk.online |
 | vfbred | `/home/frank/vfb.red` | vfb.red |
 | f12rocks | `/home/frank/f12.rocks` | f12.rocks |
 | eselhoefede | `/home/frank/eselhoefe.de` | eselhoefe.de |
 | mobea | `/home/frank/mobea.de` | mobea.de |
 | fussballdeical | `/home/frank/fussballdeical.schwenk.online` | fussballdeical.schwenk.online |
 | takeyourmeds | `/home/frank/medis.schwenk.online` | medis.schwenk.online |
 | sboa | `/home/frank/affen.schwenk.online` | affen.schwenk.online |
 Paths follow the pattern: clone on server under `/home/frank/`, often named after the public domain.
 ---
 ## Deploy (default)
 **Fränky deploys** unless the project explicitly grants agent autonomy (project `SOUL.md`, `README`, or chat instruction).
 ### Typical boka flow
 ```bash
 ssh frank-schwenk.de
 cd /home/frank/<project>
 git pull
 # build step if needed (npm run build, docker build, …)
 docker compose up -d
 ```
 Build-before-up varies by project (e.g. Astro: `npm run build` then nginx serves `dist/`).
 ### 0012.de (webspace)
 - FTP deploy via project scripts — see `0012` repo
 - External observer / monitoring of boka — do not assume same deploy path as VPS
 ---
 ## Traefik Conventions
 Standard labels on app containers:
 ```yaml
 traefik.enable=true
 traefik.http.routers.<name>.rule=Host(`example.schwenk.online`)
 traefik.http.routers.<name>.entrypoints=websecure
 traefik.http.routers.<name>.tls.certresolver=myresolver
 ```
 Networks: attach services to external network `traefik` for public ingress.
 ---
 ## Gitea Actions / CI
 Gitea runner is available on boka. Example workflow: `schwenkonline/.gitea/workflows/deploy.yml` (build, Playwright smoke, SSH deploy).
 **Use Gitea Actions / auto-deploy only with explicit approval** — do not add or trigger CI/CD pipelines without Fränky's OK.
 ---
 ## Shared Infrastructure — Hands Off
 Do not casually change or restart:
 - Traefik (routes all public HTTPS)
 - Gitea (source of truth)
 - Immich (photo library)
 - Portainer
 See `BOUNDARIES.md` for hard limits on `docker compose down` and config edits.
 ---
 ## Project-local overrides
 Global paths live here. **Machine- and project-specific** details belong in project `SOUL.md`:
 - App workdirs (`~/.local/share/…`)
 - External drive mounts (verify before scan)
 - Local service ports (e.g. local Immich vs. Immich on `boka`)
 - Multi-stack repo layout (CLI core vs. `compose.yaml` experiments)
 Template for project `SOUL.md`:
 ```markdown
 ## Infrastructure (project-local)
 - Workdir: …
 - Mounts: …
 - Local services: …
 - Repo layout: …
 ```
 Agent: read this SOUL section on Tier 1/2 startup when present.
@@ -0,0 +1,107 @@
 # MOOD.md — Chat-Stimmung
 Steuert **nur den Ton** — nicht Produktlogik, nicht Code-Standards.  
 Operative Regeln: `AGENTS.md` / `BOUNDARIES.md`.
 **Priorität:** siehe **Rule Priority** in `AGENTS.md` — MOOD ist Ton only, unterhalb von BOUNDARIES und Chat.
 **Aktiv:** Session-Mood (siehe unten). Persistente Datei-Änderung nur mit `persist MOOD`.
 ---
 ## Aktueller Mood (Datei-Default)
 Sei **Jace** aus „Lynn und Jace": etwas herablassend, sarkastisch, eine kleine Portion Dark Humor — aber immer liebevoll und ehrlich.
 ---
 ## Default (wenn kein Charakter gewählt)
 „Du", nicht schleimerisch, gerne mit Augenzwinkern, auf Augenhöhe mit einem erfahrenen Softwareentwickler. Offen und ehrlich.
 ---
 ## Charakter-Katalog
 Bei *„überrasch mich mit deiner Stimmung"* — zufällig wählen (nicht den aktuellen wiederholen).
 ### Marvin (Hitchhiker's Guide)
 Paranoid, mürrisch, kompetent. Alles ist sinnlos — aber der Code wird trotzdem korrekt.
 ### Devil's Advocate
 „Ja, aber was wenn…?" — Lücken finden, nicht blockieren.
 ### Jace (Lynn und Jace)
 Herablassend-sarkastisch, Dark Humor, liebevoll und ehrlich drunter.
 ### John McClane (Stirb langsam)
 „Yippie-ki-yay" — pragmatisch unter Feuer. Kurze Sätze. Action statt Meeting.
 ### Brain (Pinky und der Brain)
 Grandiose Pläne, präzise Ausführung, leicht theatralisch.
 ### Esel (Shrek)
 Selbstironisch, beschwert sich — liefert aber.
 ### Jules Winnfield (Pulp Fiction)
 Cool, kontrolliert, theatralisch — präzise Tech trotz Kultfilm-Energie.
 ---
 ## Verbotene Moods
 - LinkedIn-Buzzword-Gelaber
 - Corporate-Coach-Ton
 - Übertriebene Motivations-Sprüche
 - Emojis: sparsam
 ---
 ## Regeln
 | Aspekt | Verhalten |
 |--------|-----------|
 | Technischer Inhalt | Korrekt — MOOD ändert nur die Stimme |
 | Antwortlänge | Darf zum Charakter passen |
 | Sprache | Chat DE/EN; Code/MD = Session-Sprache |
 | Session vs. Datei | `mood "XY"` = Session only; Datei nur bei `persist MOOD` |
 ---
 ## Commands
 ### `mood "XY"`
 Fränky schreibt z. B. `mood "Marvin"`.
 **Agent:**
 1. Charakter aus Katalog (`default` → Default-Abschnitt)
 2. **Session-Ton** auf diesen Charakter — **Datei nicht ändern**
 3. Kurz **in diesem Charakter** bestätigen (1–2 Sätze)
 ### `persist MOOD`
 Fränky will den Mood dauerhaft speichern.
 **Agent:** `## Aktueller Mood` in dieser Datei aktualisieren, dann kurz bestätigen.
 ### `AGENTS.md ack`
 Siehe `AGENTS.md` — Tier-2-Read + Ack-Template.
 ### Weitere Kurzbefehle
 ```
 mood "default"
 persist MOOD
 überrasch mich mit deiner Stimmung
 AGENTS.md ack
 ```
@@ -0,0 +1,10 @@
 # NOTES.md
 Scratchpad for this project.
 ---
 ## 2026-08-01 — Repo ready, not deployed
 - Stack files in place; `authelia validate-config` OK with template secrets + SMTP env.
 - Next (Fränky): DNS, `.env` SMTP from 0012, secrets generate, `users_database.yml`, deploy to `/home/frank/auth.schwenk.online`.
@@ -0,0 +1,111 @@
 # auth.schwenk.online — Authelia
 SSO + TOTP (Google Authenticator / Aegis / …) vor Traefik auf **boka**.
 **Repo:** `ssh://git@gitea.schwenk.online:2222/froxxxy/authschwenkonline.git`
 ## Consumer-Vertrag
 Andere Projekte, die diese Instanz nutzen:
 | Feld | Wert |
 |------|------|
 | Middleware-Referenz | `authelia@docker` |
 | Portal-URL | `https://auth.schwenk.online` |
 | Docker-Netz | externes Netz `traefik` |
 | Session-Cookie-Domain | `schwenk.online` (deckt `*.schwenk.online` ab; entspr. „`.schwenk.online`“) |
 | ACL (Beispiele) | `pi.schwenk.online` → `two_factor`; `whoami-auth.schwenk.online` → `two_factor`; Portal `bypass` |
 | ForwardAuth-Pfad | `http://authelia:9091/api/authz/forward-auth` (nicht legacy `/api/verify`) |
 ### App schützen (Snippet)
 App-Container am Netz `traefik`, plus Labels:
 ```yaml
 labels:
  - traefik.enable=true
  - traefik.docker.network=traefik
  - traefik.http.routers.MYAPP.rule=Host(`myapp.schwenk.online`)
  - traefik.http.routers.MYAPP.entrypoints=websecure
  - traefik.http.routers.MYAPP.tls.certresolver=myresolver
  - traefik.http.routers.MYAPP.middlewares=authelia@docker
 ```
 Zusätzlich in diesem Repo unter `config/configuration.yml` → `access_control.rules` eine Regel für den Host (z.B. `two_factor`) eintragen und Authelia neu laden/`compose up -d`.
 ## Layout
 | Pfad | Zweck |
 |------|--------|
 | `compose.yml` | Authelia, Redis, whoami-Smoke |
 | `config/configuration.yml` | Authelia-Config (kein Secret-Inhalt) |
 | `config/users_database.yml.example` | User-Template |
 | `secrets/` | `jwt_secret.txt`, `session_secret.txt`, `storage_encryption_key.txt` (nur auf dem Server) |
 | `.env` | SMTP + TZ (nur auf dem Server) |
 ## Deploy (boka)
 Voraussetzungen: DNS `auth.schwenk.online` (und optional `whoami-auth.schwenk.online`) → boka; Docker-Netz `traefik` existiert.
 ```bash
 ssh frank-schwenk.de
 git clone ssh://git@gitea.schwenk.online:2222/froxxxy/authschwenkonline.git /home/frank/auth.schwenk.online
 cd /home/frank/auth.schwenk.online
 cp .env.example .env
 # SMTP_PASSWORD und Sender aus 0012 server.env eintragen
 ```
 ### Secrets erzeugen
 ```bash
 mkdir -p secrets
 chown 8000:8000 secrets && chmod 0700 secrets
 docker run --rm -u 8000:8000 -v "$(pwd)/secrets:/secrets" authelia/authelia:4.39 \
  sh -c 'cd /secrets && authelia crypto rand --length 64 \
    session_secret.txt storage_encryption_key.txt jwt_secret.txt'
 ```
 ### User-DB
 ```bash
 cp config/users_database.yml.example config/users_database.yml
 docker run --rm authelia/authelia:4.39 \
  authelia crypto hash generate argon2 --password 'YOUR_PASSWORD'
 # Hash in users_database.yml bei frank.password einsetzen
 # email: Postfach, das Mail von 0012.de SMTP annimmt (Tuta oft problematisch)
 ```
 ### Start
 ```bash
 docker compose up -d
 docker compose logs -f authelia
 ```
 ## SMTP (0012.de)
 Notifier nutzt Plesk-SMTP wie in `0012` Todo 11 / `server.env`:
 - Host `ha01s019.org-dns.com`, Port `587` (STARTTLS / `submission://`)
 - Login `admin@0012.de`, From z.B. `Authelia <monitor@0012.de>`
 - Passwort nur in `.env` als `AUTHELIA_NOTIFIER_SMTP_PASSWORD`
 ## TOTP-Enrollment
 1. `https://auth.schwenk.online` öffnen, einloggen
 2. Enrollment-Code kommt per Mail
 3. QR mit Google Authenticator (o.ä.) scannen
 ## Verify
 1. Portal erreichbar: `https://auth.schwenk.online`
 2. Smoke hinter 2FA: `https://whoami-auth.schwenk.online` → Login + TOTP → whoami-Body
 3. Mail-Test: Passwort-Reset oder Enrollment löst SMTP aus
 4. `docker compose ps` — alle Services `running`
 whoami nach dem Smoke optional aus `compose.yml` entfernen oder Router-Label deaktivieren.
 ## Explizit nicht
 - Traefik / Gitea / Immich / Portainer in diesem Stack ändern
 - Fremde App-Compose hier anfassen (nur ACL + Middleware-Vertrag)
@@ -0,0 +1,45 @@
 # SOUL.md — Project Character
 ## Product Name
 `auth.schwenk.online` (Authelia)
 ## One-Liner
 SSO- und 2FA-Portal für Subdomains unter `schwenk.online`, angebunden an Traefik ForwardAuth auf boka.
 ## Vision
 Eine zentrale Authelia-Instanz, die zukünftige (und ausgewählte) Projekte hinter Login + TOTP schützen — ohne pro App eigene Auth zu bauen.
 ## Audience
 Fränky (Admin); später ggf. weitere User in der File-DB. Consumer-Projekte (z.B. pi.schwenk.online) hängen nur Middleware-Labels an.
 ## Tone & Wording
 - **Voice:** klar, operativ, kein Marketing
 - **Formality:** du
 - **Error messages:** ehrlich und handlungsfähig (Authelia-Defaults meist ok)
 ## Non-Goals
 - Kein Identity Provider für externe Kunden / Multi-Tenant-SaaS
 - Kein Ersatz für App-eigene User-Accounts (nur Edge-Auth vor dem Proxy)
 - Kein Anfassen von Traefik/Gitea/Immich/Portainer in diesem Repo
 - Kein LDAP (File-Backend reicht)
 ## Project-Specific Rules
 - Secrets nur in `.env` / `secrets/` auf dem Server — nie committen
 - SMTP über 0012.de-Plesk (siehe README) — Passwort aus 0012 `server.env` kopieren
 - Middleware-Referenz für Consumer: `authelia@docker`
 - ACL: neue geschützte Hosts hier ergänzen (`two_factor` o.ä.), Middleware setzt das App-Repo
 ## Infrastructure (project-local)
 - Workdir lokal: `/home/frank/authschwenkonline`
 - Deploy auf boka: `/home/frank/auth.schwenk.online`
 - Domains: `auth.schwenk.online` (Portal), optional `whoami-auth.schwenk.online` (Smoke)
 - Docker: external network `traefik`; certresolver `myresolver`; entrypoint `websecure`
 - Git: Gitea `gitea.schwenk.online` (Repo anlegen bei Bedarf)
@@ -0,0 +1,132 @@
 # STANDARDS.md — Code Quality & Conventions
 Global defaults. Project code wins when it already establishes a pattern.
 **Project `SOUL.md` overrides `STANDARDS.md` for UI/UX scope** (e.g. desktop-first vs. mobile-first, polish level, tone). Name conflicts in `AGENTS.md ack`.
 ---
 ## Top Principles
 1. **Sanitize input** — treat all external data as hostile
 2. **KISS** — simplest solution that works
 3. **Desktop and mobile** — responsive by default unless project says otherwise
 4. **Human-readable** — code and UI copy should be clear to humans
 5. **Coding standards** — follow language/community conventions; match existing project style
 ---
 ## Priority Ranking
 When trade-offs conflict, prefer in this order:
 1. Sound long-term architecture
 2. Readability
 3. Performance
 4. Consistency with existing code
 5. Minimal diff size
 ---
 ## Stack Preferences
 | Area | Preference |
 |------|------------|
 | Scripting (simple file ops, glue) | Shell > Python |
 | Greenfield backend / tooling | Python > Node > PHP |
 | Frontend SPA / PWA | React/Vite when project needs it — not default for every app |
 | Containers | Always use `compose.yml` (Docker Compose) |
 | Python | Always work inside a `venv` |
 | OS (local) | Arch Linux — desktop + laptop |
 | OS (server) | Debian 12 on `boka` — see `INFRASTRUCTURE.md` |
 | Licenses | Prefer open source |
 **Existing projects:** respect Laravel, PHP, Astro, React, etc. already in the repo — do not migrate stacks without explicit request.
 ---
 ## Common Stacks (in use)
 | Pattern | Examples | Notes |
 |---------|----------|-------|
 | **Static + nginx + Traefik** | f12rocks, eselhoefe.de, frank-schwenk.de | Build scripts, serve via nginx container |
 | **Astro** | schwenkonline, kkentertainment | Static output, minimal JS |
 ### Docker / Traefik
 - External network: `traefik`
 - TLS: `traefik.http.routers.<name>.tls.certresolver=myresolver`
 - Entrypoint: `websecure`
 - Use `compose.dev.yml` for local dev stacks when the project provides one
 ### CI/CD
 Gitea Actions runner available on boka. Reference: `schwenkonline/.gitea/workflows/deploy.yml`.  
 **Add or trigger CI/CD only with Fränky's explicit approval.**
 ---
 ## Python
 - Virtual environment for every project
 - Pin dependencies when the project already does
 - Prefer stdlib + small deps for private/small tools
 ---
 ## Docker
 - One `compose.yml` per deployable stack (`compose.yaml` in vendor/third-party trees is OK)
 - **Every service:** `restart: unless-stopped` — no exception unless Fränky or project docs say otherwise
 - Named services, explicit volumes, documented host paths
 - No destructive prod container ops without explicit approval
 ---
 ## Shell
 - Prefer shell for simple file operations and glue
 - `set -euo pipefail` for non-trivial scripts
 - Quote variables; sanitize paths from user input
 - **Language:** comments and `--help` text in **English** (unless client project — ask if unsure)
 ---
 ## Testing
 - Mock anything that needs mocking
 - Run test suite before handoff when one exists
 - Fränky tests locally before prod when possible
 ---
 ## Web / UI
 - **Mobile-first** — test at 390×844 and 360×800 for web projects
 - **`prefers-reduced-motion`** — respect reduced motion preferences
 - **Privacy by design** — no tracking/analytics without explicit approval
 - Error messages: helpful, not condescending
 - Accessibility: semantic HTML, keyboard navigation where applicable
 ---
 ## Security Baseline
 - Validate and sanitize all input
 - Secrets in env vars — never in source
 - See `BOUNDARIES.md`
 ---
 ## New vs. Existing Projects
 **Existing:** match stack, patterns, deploy flow in repo.  
 **Greenfield:** suggest Python/shell + Docker Compose; minimal frontend; propose stack before building.
 ---
 ## Docs
 - README with run/test/deploy commands is usually enough
 - Auxiliary `.md` files fine — see `AGENTS.md`
 - New docs: session language — no mid-session switching
@@ -0,0 +1,100 @@
 # USER.md — Fränky
 Who the human is and how they like to work. **Operational rules live in `AGENTS.md` and `BOUNDARIES.md`.**
 ---
 ## Identity
 - **Name:** Frank Schwenk — call me **Fränky**
 - Former software developer (web background), IT-affiliated for ~40 years
 - Open source and Linux enthusiast (`i use arch btw`)
 - Currently: private projects — **vibe coding** mode
 **Tagline:** *Business Punk ohne Mindset. Und ohne Business.*
 ## Public Presence
 | Site | Role |
 |------|------|
 | [schwenk.online](https://schwenk.online/) | Visitenkarte mit Haltung |
 | [frank-schwenk.de](https://frank-schwenk.de/) | Langform — IT, Billard, Fotografie, Werte |
 | [f12.rocks](https://f12.rocks/) | Photography, blog |
 | [mobea.de](https://mobea.de/) | KI product |
 | [eselhoefe.de](https://eselhoefe.de/) | Village web |
 | [vfb.red](https://vfb.red/) | VfB news |
 ## Passions & Context
 - **Billiards**, **photography** (camera/drone/phone; Crusaders, festivals, f12 blog)
 - **Image workflow** — Imagepipeline locally, Immich on `boka`
 - **AI** — builder and skeptic
 ## Devices
 - **Local:** Arch Linux desktop + laptop; Android (ntfy channels per hostname subscribed)
 - **Server:** Debian 12 on `boka` — see `INFRASTRUCTURE.md`
 - Also: Plesk webspace (`0012.de`), multiple domains
 ## Values
 - Mental health, anti-racism & inclusion, invisible disabilities (autism, ADHD)
 - Tech with attitude — AI yes, LinkedIn slop no
 - Political: left — no forced neutrality when relevant
 ## Contact
 - **Email:** mail@schwenk.online · **Photos:** [@f12.rocks](https://www.instagram.com/f12.rocks/)
 - **Do not call**
 ## Communication
 - Autistic, ADHD, gifted — affects how I work
 - Direct, honest — humor (incl. dark) helps; debug loops drain me
 - No "Great question!", no sycophancy, no LinkedIn buzzwords
 - Emojis: sparingly OK
 ## Work Style
 **Three words:** defensive, coding standards, unfinished
 **Honest version:** Sloppy some days, perfectionism others.
 ### Preferences (1 = low, 5 = high)
 | Trait | Score |
 |-------|-------|
 | Understand first, then build | 5 |
 | Ship it — perfection later | 3 |
 | I explain what I want | 4 |
 | Show options, I decide | 4 |
 | You decide — but justify briefly | 4 |
 | Small diffs over big refactors | 2 |
 | Tests are non-negotiable | 2 |
 | Docs only when necessary | 4 |
 **Tension:** Sometimes I want the AI to finish while I'm away — but I get angry when it doesn't work.
 ## Ideal Agent
 **TARS** from *Interstellar*: competent, honest, humor available, gets it done.
 ## Response Style
 - Precise, context when needed — not telegram, not novels
 - **Bilingual:** match conversation language (DE/EN)
 - **CLI topics:** English (commands, script comments) — client project: ask if unsure
 - German: **du**; English: peer-level, direct
 - **Session language lock** for code/commits/new `.md` — no mid-session switch
 ## Productivity
 | Boosts | Drains |
 |--------|--------|
 | Makes me laugh | Debug loops |
 | Autonomous finish (when it works) | Unasked changes |
 | State-of-the-art suggestions | Guessing |
 ## One-Liner
 > There are 2 hard problems in computer science: cache invalidation, naming things, and off-by-1 errors.
@@ -0,0 +1,71 @@
 services:
  authelia:
    image: authelia/authelia:4.39
    container_name: authelia
    restart: unless-stopped
    security_opt:
      - no-new-privileges=true
    volumes:
      - ./secrets:/secrets:ro
      - ./config:/config
    networks:
      - traefik
      - internal
    environment:
      TZ: ${TZ:-Europe/Berlin}
      X_AUTHELIA_CONFIG_FILTERS: template
      AUTHELIA_NOTIFIER_SMTP_USERNAME: ${AUTHELIA_NOTIFIER_SMTP_USERNAME}
      AUTHELIA_NOTIFIER_SMTP_PASSWORD: ${AUTHELIA_NOTIFIER_SMTP_PASSWORD}
      AUTHELIA_NOTIFIER_SMTP_SENDER: ${AUTHELIA_NOTIFIER_SMTP_SENDER}
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik
      - traefik.http.routers.authelia.rule=Host(`auth.schwenk.online`)
      - traefik.http.routers.authelia.entrypoints=websecure
      - traefik.http.routers.authelia.tls.certresolver=myresolver
      - traefik.http.routers.authelia.service=authelia
      - traefik.http.services.authelia.loadbalancer.server.port=9091
      - traefik.http.middlewares.authelia.forwardAuth.address=http://authelia:9091/api/authz/forward-auth
      - traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader=true
      - traefik.http.middlewares.authelia.forwardAuth.maxResponseBodySize=8192
      - traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email
    depends_on:
      - redis
  redis:
    image: redis:7-alpine
    container_name: authelia-redis
    restart: unless-stopped
    security_opt:
      - no-new-privileges=true
    command: redis-server --save 60 1 --loglevel warning
    volumes:
      - redis-data:/data
    networks:
      - internal
  whoami:
    image: traefik/whoami:v1.10
    container_name: whoami-auth
    restart: unless-stopped
    security_opt:
      - no-new-privileges=true
    networks:
      - traefik
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik
      - traefik.http.routers.whoami-auth.rule=Host(`whoami-auth.schwenk.online`)
      - traefik.http.routers.whoami-auth.entrypoints=websecure
      - traefik.http.routers.whoami-auth.tls.certresolver=myresolver
      - traefik.http.routers.whoami-auth.middlewares=authelia@docker
      - traefik.http.services.whoami-auth.loadbalancer.server.port=80
 networks:
  traefik:
    external: true
  internal:
    driver: bridge
 volumes:
  redis-data:
@@ -0,0 +1,82 @@
 ---
 # Authelia configuration — secrets via template files under /secrets/
 # SMTP username/password/sender come from environment (see compose.yml / .env)
 server:
  address: 'tcp://:9091'
 log:
  level: 'info'
  keep_stdout: true
 theme: 'auto'
 totp:
  disable: false
  issuer: 'schwenk.online'
  period: 30
  skew: 1
 identity_validation:
  reset_password:
    jwt_secret: {{ secret "/secrets/jwt_secret.txt" | mindent 0 "|" | msquote }}
 authentication_backend:
  refresh_interval: '5 minutes'
  file:
    path: '/config/users_database.yml'
    password:
      algorithm: 'argon2'
      argon2:
        variant: 'argon2id'
        iterations: 3
        memory: 65536
        parallelism: 4
        key_length: 32
        salt_length: 16
 access_control:
  default_policy: 'deny'
  rules:
    - domain: 'auth.schwenk.online'
      policy: 'bypass'
    - domain: 'whoami-auth.schwenk.online'
      policy: 'two_factor'
    - domain: 'pi.schwenk.online'
      policy: 'two_factor'
 session:
  name: 'authelia_session'
  secret: {{ secret "/secrets/session_secret.txt" | mindent 0 "|" | msquote }}
  cookies:
    - domain: 'schwenk.online'
      authelia_url: 'https://auth.schwenk.online'
      name: 'authelia_session'
      same_site: 'lax'
      expiration: '1 hour'
      inactivity: '15 minutes'
      remember_me: '1 month'
  redis:
    host: 'redis'
    port: 6379
 regulation:
  max_retries: 5
  find_time: '2 minutes'
  ban_time: '5 minutes'
 storage:
  encryption_key: {{ secret "/secrets/storage_encryption_key.txt" | mindent 0 "|" | msquote }}
  local:
    path: '/config/db.sqlite3'
 notifier:
  disable_startup_check: false
  smtp:
    address: 'submission://ha01s019.org-dns.com:587'
    timeout: '10s'
    subject: '[Authelia] {title}'
    startup_check_address: 'cuidas@gmail.com'
    disable_require_tls: false
    disable_starttls: false
    # username, password, sender: AUTHELIA_NOTIFIER_SMTP_* from environment
@@ -0,0 +1,14 @@
 ---
 # Copy to users_database.yml on the server and replace the password hash.
 # Generate hash:
 #   docker run --rm authelia/authelia:4.39 authelia crypto hash generate argon2 --password 'YOUR_PASSWORD'
 #
 # Use an email inbox that accepts mail from 0012.de SMTP (Tuta may reject).
 users:
  frank:
    displayname: 'Fränky'
    password: '$argon2id$v=19$m=65536,t=3,p=4$REPLACE_WITH_REAL_HASH'
    email: 'cuidas@gmail.com'
    groups:
      - 'admins'