Add FHEM mTLS or Authelia auth with static upstream Basic Auth

[sidey79]

Summary

• allow fhem.* requests with either a valid client certificate or a successful Authelia forward_auth check
• inject a static upstream Authorization header for FHEM from FHEM_BASIC_AUTH_HEADER
• return 503 when the FHEM upstream Basic Auth secret is missing instead of proxying without backend credentials
• forward client certificate metadata headers to FHEM when the request is admitted via mTLS
• document the new environment variable and FHEM auth flow in the README

Validation

• validated Caddyfile with caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile in a one-off caddy:2.11.2 container using dummy environment values and mounted local PKI files

Notes

• no additional Authelia config changes are required for this flow beyond the existing one_factor access policy because FHEM no longer depends on Authelia accepting Basic Auth itself

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 61c446683b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restore Authelia fallback for workflow webhooks

This route now returns 403 for any request without a client cert before webhook handling, which removes the Authelia-based fallback that existed in caddy/Caddyfile on the parent commit. As a result, non-mTLS users can no longer reach the workflow webhook/UI paths (for example /webhook/github-pr-dashboard) via forward_auth, so the previously supported access flow is broken.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Validate the deployed Caddyfile in CI

Switching the compose mount to ./Caddyfile changes production to use the repo-root config, but the lint workflow still validates /work/caddy/Caddyfile; this means CI no longer checks the file that will actually be loaded by Caddy. A syntax or routing error in the root Caddyfile can therefore pass checks and fail only at deploy/runtime.

Useful? React with 👍 / 👎.