From 6ea8e727d41fb3c898a21aceeb58ae6b901e04ee Mon Sep 17 00:00:00 2001 From: dtoro Date: Mon, 1 Jun 2026 00:31:08 +0200 Subject: [PATCH] authentik: point forward-auth snippet at LAN outpost (192.168.8.6) Forward-auth now validates against the VPS Authentik core via a dedicated LAN outpost (auth-outpost LXC 106), not LXC 124's frozen embedded outpost. Resolves the post-migration split-brain. 192.168.8.180:9000 -> 192.168.8.6:9000. Co-Authored-By: Claude Opus 4.8 --- Caddyfile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Caddyfile b/Caddyfile index 0eac6fa..0b1d1d9 100644 --- a/Caddyfile +++ b/Caddyfile @@ -2,8 +2,8 @@ # Usage: add "import authentik" inside any site block to gate it. (authentik) { route { - reverse_proxy /outpost.goauthentik.io/* http://192.168.8.180:9000 - forward_auth http://192.168.8.180:9000 { + reverse_proxy /outpost.goauthentik.io/* http://192.168.8.6:9000 + forward_auth http://192.168.8.6:9000 { uri /outpost.goauthentik.io/auth/caddy copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version trusted_proxies private_ranges @@ -170,7 +170,7 @@ auth.hubris.network { tls { dns ionos {env.IONOS_AUTH_API_TOKEN} } - reverse_proxy 192.168.8.180:9000 + reverse_proxy 192.168.8.6:9000 } artifacto.hubris.network {