From 7e856d85a68bd01b175ba5677060c32590c053ff Mon Sep 17 00:00:00 2001 From: claudio Date: Wed, 22 Apr 2026 22:20:56 +0200 Subject: [PATCH] Gate artifacto admin with Authentik + forward gateway header Inject X-Artifacto-Gateway (shared secret in ARTIFACTO_GATEWAY_SECRET) so the app can auto-login Authentik-authenticated users while rejecting spoofed SSO headers from direct-connection peers. Leaves /p/* (share URLs), /static/*, /healthz public. --- Caddyfile | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/Caddyfile b/Caddyfile index c034a78..793c981 100644 --- a/Caddyfile +++ b/Caddyfile @@ -161,5 +161,17 @@ artifacto.hubris.network { tls { dns ionos {env.IONOS_AUTH_API_TOKEN} } - reverse_proxy 192.168.8.205:3100 + # Public paths: share URLs, static assets, health — no SSO + @public path /p/* /static/* /healthz + handle @public { + reverse_proxy 192.168.8.205:3100 + } + # Admin + login surface: Authentik forward-auth + shared-secret header + # so the app can auto-login an Authentik-authenticated user. + handle { + import authentik + reverse_proxy 192.168.8.205:3100 { + header_up X-Artifacto-Gateway {env.ARTIFACTO_GATEWAY_SECRET} + } + } }