deploy: expose dashboard at khamel.com/argus/ behind Authentik

[Khamel83]

The code is ready (ARGUS_ROOT_PATH support landed in the PR). Three steps needed on the homelab machine.

1. Add nginx location block

Edit services/funnel-proxy/nginx.conf:

location ^~ /argus/ {
    auth_request /oauth2/auth;
    error_page 401 = /oauth2/sign_in;

    set $backend "172.20.0.1:8005";
    proxy_pass http://$backend/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-Proto https;
}

2. Add to .env on the homelab

ARGUS_ROOT_PATH=/argus

3. Reload + restart

docker exec funnel-proxy nginx -t && docker exec funnel-proxy nginx -s reload
sudo systemctl restart argus

Verify

curl -I https://khamel.com/argus/dashboard
# Expect 302 → Authentik login (or 200 if already logged in)

Notes

• Port 8005 is set in scripts/start-server.sh (ARGUS_PORT=8005)
• Authentik handles auth at the nginx layer — leave ARGUS_ADMIN_API_KEY unset, no second password prompt
• Dashboard auto-refreshes budget data every 60s via HTMX polling

[Khamel83]

Closing as repo-resolved. The application-side support for serving the
dashboard under /argus is now on main via ARGUS_ROOT_PATH=/argus, and
PR #8 also documented/provided proxy deployment support.

Any remaining work is the homelab nginx/Authentik rollout described in this
issue. If that live deployment fails, we should open a fresh issue with the
exact failure mode.