From c906a5acc7a878c4e0bab287338d2690a862fa44 Mon Sep 17 00:00:00 2001
From: dtoro <d.toro.v@pm.me>
Date: Mon, 1 Jun 2026 00:41:55 +0200
Subject: [PATCH] authentik: add sso.hubris.network site for LAN forward-auth
 outpost callback

Domain-level proxy providers (Paperless, qBit) need an external_host that
routes to the LAN outpost (192.168.8.6), not auth.hubris.network (now the VPS
core). New site sso.hubris.network -> reverse_proxy 192.168.8.6:9000.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 Caddyfile | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/Caddyfile b/Caddyfile
index 0b1d1d9..8a18120 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -223,3 +223,11 @@ secrets.hubris.network {
 	}
 	reverse_proxy 192.168.8.205:9820
 }
+
+# Authentik LAN forward-auth outpost (external_host for domain-level providers)
+sso.hubris.network {
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	reverse_proxy 192.168.8.6:9000
+}