From e535f93dcc139f8af84e7905aec00f9b7f4d4336 Mon Sep 17 00:00:00 2001 From: dtoro Date: Fri, 22 May 2026 01:01:21 +0200 Subject: [PATCH] photos: stop caddy from eating /library/login (OIDC initiation) The /library/* catch-all redir bounced /library/login (PhotoPrism's OIDC login surface) back to / before the user could click "Sign in with Authentik". Add a specific @pp_login matcher above the redir so /library/login + /library/login/* reach PhotoPrism, while the post-login /library/browse target still bounces back to the SvelteKit SPA. Co-Authored-By: Claude Opus 4.7 (1M context) --- Caddyfile | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/Caddyfile b/Caddyfile index bbacd27..8989b84 100644 --- a/Caddyfile +++ b/Caddyfile @@ -152,8 +152,16 @@ photos.hubris.network { # PhotoPrism API + OIDC callback first (matched before static catch-all) @pp path /api/v1/* /api/v1 /static/* /share/* reverse_proxy @pp 192.168.8.136:2342 - # PhotoPrism redirects to /library/browse after OIDC. Bounce back to - # the SvelteKit SPA; mule-image is the only user-facing frontend. + # PhotoPrism's OIDC initiation lives at /library/login (and the + # JS posts to /library/login/* during the Authentik handshake). + # Proxy those through to PhotoPrism BEFORE the /library/* catch-all + # redir, otherwise the user clicks "Sign in with Authentik" and + # caddy bounces them straight back to the SvelteKit root. + @pp_login path /library/login /library/login/* + reverse_proxy @pp_login 192.168.8.136:2342 + # Everything else under /library/* (notably /library/browse, which + # PhotoPrism redirects to after a successful login) bounces back + # to the SvelteKit SPA — mule-image is the only user-facing frontend. redir /library / 302 redir /library/* / 302 # mule-sidecar (Go) — keeps the /api/sidecar/ prefix