From 8c92428b425e5f02761f225dc5858d53070a4726 Mon Sep 17 00:00:00 2001
From: root <root@caddy.fritz.box>
Date: Sat, 4 Jul 2026 21:24:51 +0200
Subject: [PATCH] fix: remove forward-auth gate for jellyfin, use SSO plugin
 OIDC flow instead

---
 Caddyfile | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)

diff --git a/Caddyfile b/Caddyfile
index f43f9df..e018b0d 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -39,16 +39,9 @@ media.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
-	# API and streaming paths — no Authentik (Jellyfin apps use their own auth)
-	@api path /api/* /socket /Audio/* /Videos/* /Items/* /Users/* /Sessions/* /System/* /LiveTv/* /Music/* /Artists/* /Albums/* /Playlists/* /Images/* /Subtitle* /videos/* /audio/* /sso/* /SSO-Auth/*
-	handle @api {
-		reverse_proxy 192.168.8.206:8096
-	}
-	# Web UI — gated behind Authentik
-	handle {
-		import authentik
-		reverse_proxy 192.168.8.206:8096
-	}
+	# SSO plugin handles auth via OIDC redirect to Authentik.
+	# No forward-auth gate — Jellyfin login page shows SSO button directly.
+	reverse_proxy 192.168.8.206:8096
 }
 
 git.hubris.network {