dtoro/caddy-conf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

photos: wrap site block in route{} to force literal directive order

Browse Source 
Without an explicit route{} block, caddy auto-hoists `redir` ahead of
`reverse_proxy`. That meant /library/* still redirected to / even
though I'd placed an @pp_login reverse_proxy above the redirs in the
file. Wrap the whole site in route{} so directives run in source order
and the more-specific /library/login matcher wins before the broader
/library/* redir.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
authentik Default Admin
2026-05-22 01:02:11 +02:00
parent e535f93dcc
commit a52cf68d0f
1 changed files with 23 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
Caddyfile
View File

@@ -149,26 +149,29 @@ photos.hubris.network {
dns ionos {env.IONOS_AUTH_API_TOKEN} dns ionos {env.IONOS_AUTH_API_TOKEN}
} }
encode zstd gzip encode zstd gzip
# PhotoPrism API + OIDC callback first (matched before static catch-all) # Wrap everything in `route` so directives run in literal source
@pp path /api/v1/* /api/v1 /static/* /share/* # order. Without it caddy hoists `redir` above `reverse_proxy`,
reverse_proxy @pp 192.168.8.136:2342 # and the /library/* redir eats /library/login before PhotoPrism
# PhotoPrism's OIDC initiation lives at /library/login (and the # ever sees it (OIDC initiation dies).
# JS posts to /library/login/* during the Authentik handshake). route {
# Proxy those through to PhotoPrism BEFORE the /library/* catch-all # PhotoPrism API + OIDC callback (callback path /api/v1/oidc/redirect)
# redir, otherwise the user clicks "Sign in with Authentik" and @pp path /api/v1/* /api/v1 /static/* /share/*
# caddy bounces them straight back to the SvelteKit root. reverse_proxy @pp 192.168.8.136:2342
@pp_login path /library/login /library/login/* # PhotoPrism's OIDC initiation surface — must reach PhotoPrism,
reverse_proxy @pp_login 192.168.8.136:2342 # not be bounced back to the SPA.
# Everything else under /library/* (notably /library/browse, which @pp_login path /library/login /library/login/*
# PhotoPrism redirects to after a successful login) bounces back reverse_proxy @pp_login 192.168.8.136:2342
# to the SvelteKit SPA — mule-image is the only user-facing frontend. # Everything else under /library/* (notably /library/browse,
redir /library / 302 # PhotoPrism's post-login destination) bounces back to the
redir /library/* / 302 # SvelteKit SPA — mule-image is the only user-facing frontend.
# mule-sidecar (Go) — keeps the /api/sidecar/ prefix redir /library / 302
@sc path /api/sidecar/* redir /library/* / 302
reverse_proxy @sc 192.168.8.136:8000 # mule-sidecar (Go) — keeps the /api/sidecar/ prefix
# Catch-all → nginx-on-120 serving the SvelteKit static bundle (no Vite in prod) @sc path /api/sidecar/*
reverse_proxy 192.168.8.136:3000 reverse_proxy @sc 192.168.8.136:8000
# Catch-all → nginx-on-120 serving the SvelteKit static bundle
reverse_proxy 192.168.8.136:3000
}
} }
auth.hubris.network { auth.hubris.network {