From 8ed2631f6bf19103f24483e2a1a1fa3fd44c7773 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 22 Apr 2026 22:13:06 +0200 Subject: [PATCH] Gate photos.hubris.network behind Authentik forward-auth Bypass /api/* for JWT/mobile clients (mulita uses Bearer tokens; SPA login POSTs /api/v1/auth/login). Browser UI goes through the embedded outpost. --- Caddyfile | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/Caddyfile b/Caddyfile index c034a78..acc8fa0 100644 --- a/Caddyfile +++ b/Caddyfile @@ -147,7 +147,14 @@ photos.hubris.network { tls { dns ionos {env.IONOS_AUTH_API_TOKEN} } - reverse_proxy 192.168.8.136:3000 + @api path /api/* + handle @api { + reverse_proxy 192.168.8.136:3000 + } + handle { + import authentik + reverse_proxy 192.168.8.136:3000 + } } auth.hubris.network { @@ -161,5 +168,14 @@ artifacto.hubris.network { tls { dns ionos {env.IONOS_AUTH_API_TOKEN} } - reverse_proxy 192.168.8.205:3100 + # Public paths: share URLs, static assets, health — no SSO + @public path /p/* /static/* /healthz + handle @public { + reverse_proxy 192.168.8.205:3100 + } + # Admin + login surface: Authentik forward-auth + handle { + import authentik + reverse_proxy 192.168.8.205:3100 + } }