dtoro/caddy-conf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Gate photos.hubris.network behind Authentik forward-auth

Browse Source 
Bypass /api/* for JWT/mobile clients (mulita uses Bearer tokens;
SPA login POSTs /api/v1/auth/login). Browser UI goes through the
embedded outpost.
This commit is contained in:
root
2026-04-22 22:13:06 +02:00
parent 31eb41a05a
commit 8ed2631f6b
1 changed files with 18 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
Caddyfile
View File

@@ -147,7 +147,14 @@ photos.hubris.network {
tls { tls {
dns ionos {env.IONOS_AUTH_API_TOKEN} dns ionos {env.IONOS_AUTH_API_TOKEN}
} }
reverse_proxy 192.168.8.136:3000 @api path /api/*
handle @api {
reverse_proxy 192.168.8.136:3000
}
handle {
import authentik
reverse_proxy 192.168.8.136:3000
}
} }
auth.hubris.network { auth.hubris.network {
@@ -161,5 +168,14 @@ artifacto.hubris.network {
tls { tls {
dns ionos {env.IONOS_AUTH_API_TOKEN} dns ionos {env.IONOS_AUTH_API_TOKEN}
} }
reverse_proxy 192.168.8.205:3100 # Public paths: share URLs, static assets, health — no SSO
@public path /p/* /static/* /healthz
handle @public {
reverse_proxy 192.168.8.205:3100
}
# Admin + login surface: Authentik forward-auth
handle {
import authentik
reverse_proxy 192.168.8.205:3100
}
} }