From a52cf68d0fb1eaea024a55bd081d20b7b11289e2 Mon Sep 17 00:00:00 2001 From: dtoro Date: Fri, 22 May 2026 01:02:11 +0200 Subject: [PATCH] photos: wrap site block in route{} to force literal directive order Without an explicit route{} block, caddy auto-hoists `redir` ahead of `reverse_proxy`. That meant /library/* still redirected to / even though I'd placed an @pp_login reverse_proxy above the redirs in the file. Wrap the whole site in route{} so directives run in source order and the more-specific /library/login matcher wins before the broader /library/* redir. Co-Authored-By: Claude Opus 4.7 (1M context) --- Caddyfile | 43 +++++++++++++++++++++++-------------------- 1 file changed, 23 insertions(+), 20 deletions(-) diff --git a/Caddyfile b/Caddyfile index 8989b84..a93c034 100644 --- a/Caddyfile +++ b/Caddyfile @@ -149,26 +149,29 @@ photos.hubris.network { dns ionos {env.IONOS_AUTH_API_TOKEN} } encode zstd gzip - # PhotoPrism API + OIDC callback first (matched before static catch-all) - @pp path /api/v1/* /api/v1 /static/* /share/* - reverse_proxy @pp 192.168.8.136:2342 - # PhotoPrism's OIDC initiation lives at /library/login (and the - # JS posts to /library/login/* during the Authentik handshake). - # Proxy those through to PhotoPrism BEFORE the /library/* catch-all - # redir, otherwise the user clicks "Sign in with Authentik" and - # caddy bounces them straight back to the SvelteKit root. - @pp_login path /library/login /library/login/* - reverse_proxy @pp_login 192.168.8.136:2342 - # Everything else under /library/* (notably /library/browse, which - # PhotoPrism redirects to after a successful login) bounces back - # to the SvelteKit SPA — mule-image is the only user-facing frontend. - redir /library / 302 - redir /library/* / 302 - # mule-sidecar (Go) — keeps the /api/sidecar/ prefix - @sc path /api/sidecar/* - reverse_proxy @sc 192.168.8.136:8000 - # Catch-all → nginx-on-120 serving the SvelteKit static bundle (no Vite in prod) - reverse_proxy 192.168.8.136:3000 + # Wrap everything in `route` so directives run in literal source + # order. Without it caddy hoists `redir` above `reverse_proxy`, + # and the /library/* redir eats /library/login before PhotoPrism + # ever sees it (OIDC initiation dies). + route { + # PhotoPrism API + OIDC callback (callback path /api/v1/oidc/redirect) + @pp path /api/v1/* /api/v1 /static/* /share/* + reverse_proxy @pp 192.168.8.136:2342 + # PhotoPrism's OIDC initiation surface — must reach PhotoPrism, + # not be bounced back to the SPA. + @pp_login path /library/login /library/login/* + reverse_proxy @pp_login 192.168.8.136:2342 + # Everything else under /library/* (notably /library/browse, + # PhotoPrism's post-login destination) bounces back to the + # SvelteKit SPA — mule-image is the only user-facing frontend. + redir /library / 302 + redir /library/* / 302 + # mule-sidecar (Go) — keeps the /api/sidecar/ prefix + @sc path /api/sidecar/* + reverse_proxy @sc 192.168.8.136:8000 + # Catch-all → nginx-on-120 serving the SvelteKit static bundle + reverse_proxy 192.168.8.136:3000 + } } auth.hubris.network {