api no longer embeds the SPA (it's compose/web/Dockerfile's `web`
service in the oikos repo now) — route the catch-all handle to :8091
instead of :8090, and restore the /api/v1/*, /mcp, /agent/* matcher so
those keep hitting api directly rather than falling through to the
static file server.
Authentik-gated (matches paperless.hubris.network's pattern) since the
console handles real mutation actions (signal ack/resolve, approval
approve/deny) and doesn't implement its own network-level gating the
way mcp.hubris.network/secrets.hubris.network do.
See dtoro/Homelab-Docs oikos/console/ for the app itself.
Update the photos.hubris.network block to match the current stack
(PhotoPrism API + Go sidecar + SvelteKit). Add prism.hubris.network
as a dedicated PhotoPrism vhost for the Prismatic mobile client.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Domain-level proxy providers (Paperless, qBit) need an external_host that
routes to the LAN outpost (192.168.8.6), not auth.hubris.network (now the VPS
core). New site sso.hubris.network -> reverse_proxy 192.168.8.6:9000.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Forward-auth now validates against the VPS Authentik core via a dedicated
LAN outpost (auth-outpost LXC 106), not LXC 124's frozen embedded outpost.
Resolves the post-migration split-brain. 192.168.8.180:9000 -> 192.168.8.6:9000.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Earlier commits (e535f93 + a52cf68) proxied /library/login through to
PhotoPrism to fix what I thought was the OIDC initiation path. Wrong:
the SvelteKit SPA initiates OIDC by navigating to /api/v1/oidc/login
(already routed via @pp). The /library/login URL is what PhotoPrism's
UI uses POST-OIDC for the localStorage handoff back to the SPA — it
MUST bounce to / via the caddy redir, otherwise the SPA never picks
up the session and the user lands in PhotoPrism's own UI.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Without an explicit route{} block, caddy auto-hoists `redir` ahead of
`reverse_proxy`. That meant /library/* still redirected to / even
though I'd placed an @pp_login reverse_proxy above the redirs in the
file. Wrap the whole site in route{} so directives run in source order
and the more-specific /library/login matcher wins before the broader
/library/* redir.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
