dtoro/caddy-conf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

photos: stop caddy from eating /library/login (OIDC initiation)

Browse Source 
The /library/* catch-all redir bounced /library/login (PhotoPrism's
OIDC login surface) back to / before the user could click "Sign in
with Authentik". Add a specific @pp_login matcher above the redir
so /library/login + /library/login/* reach PhotoPrism, while the
post-login /library/browse target still bounces back to the SvelteKit
SPA.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
authentik Default Admin
2026-05-22 01:01:21 +02:00
parent 730334c3df
commit e535f93dcc
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
Caddyfile
View File

@@ -152,8 +152,16 @@ photos.hubris.network {
# PhotoPrism API + OIDC callback first (matched before static catch-all)
@pp path /api/v1/* /api/v1 /static/* /share/*
reverse_proxy @pp 192.168.8.136:2342
# PhotoPrism redirects to /library/browse after OIDC. Bounce back to
# the SvelteKit SPA; mule-image is the only user-facing frontend.
# PhotoPrism's OIDC initiation lives at /library/login (and the
# JS posts to /library/login/* during the Authentik handshake).
# Proxy those through to PhotoPrism BEFORE the /library/* catch-all
# redir, otherwise the user clicks "Sign in with Authentik" and
# caddy bounces them straight back to the SvelteKit root.
@pp_login path /library/login /library/login/*
reverse_proxy @pp_login 192.168.8.136:2342
# Everything else under /library/* (notably /library/browse, which
# PhotoPrism redirects to after a successful login) bounces back
# to the SvelteKit SPA — mule-image is the only user-facing frontend.
redir /library / 302
redir /library/* / 302
# mule-sidecar (Go) — keeps the /api/sidecar/ prefix