diff --git a/Caddyfile b/Caddyfile
index f8ce7c9..5a316ca 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -1,3 +1,19 @@
+# Authentik forward-auth snippet (domain-level mode).
+# Usage: add "import authentik" inside any site block to gate it.
+(authentik) {
+    route {
+        reverse_proxy /outpost.goauthentik.io/* https://auth.hubris.network {
+            header_up Host {upstream_hostport}
+        }
+        forward_auth https://auth.hubris.network {
+            uri /outpost.goauthentik.io/auth/caddy
+            copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
+            trusted_proxies private_ranges
+            header_up Host {upstream_hostport}
+        }
+    }
+}
+
 # The Caddyfile is an easy way to configure your Caddy web server.
 #
 # Unless the file starts with a global options block, the first