dtoro/caddy-conf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Gate artifacto admin with Authentik + forward gateway header

Browse Source 
Inject X-Artifacto-Gateway (shared secret in ARTIFACTO_GATEWAY_SECRET)
so the app can auto-login Authentik-authenticated users while
rejecting spoofed SSO headers from direct-connection peers.

Leaves /p/* (share URLs), /static/*, /healthz public.
This commit is contained in:
claudio
2026-04-22 22:20:56 +02:00
parent a6b12a4e64
commit 7e856d85a6
1 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
Caddyfile
View File

@@ -161,5 +161,17 @@ artifacto.hubris.network {
tls { tls {
dns ionos {env.IONOS_AUTH_API_TOKEN} dns ionos {env.IONOS_AUTH_API_TOKEN}
} }
reverse_proxy 192.168.8.205:3100 # Public paths: share URLs, static assets, health — no SSO
@public path /p/* /static/* /healthz
handle @public {
reverse_proxy 192.168.8.205:3100
}
# Admin + login surface: Authentik forward-auth + shared-secret header
# so the app can auto-login an Authentik-authenticated user.
handle {
import authentik
reverse_proxy 192.168.8.205:3100 {
header_up X-Artifacto-Gateway {env.ARTIFACTO_GATEWAY_SECRET}
}
}
} }