feat: add authentik forward-auth gate for media.hubris.network (API bypass for apps)

SABnzbd is configured with SABNZBD__PORT=8082 in docker compose.
Previous value 8081 was a dead port; 8080 would route to qBittorrent.

Caddyfile

@@ -1,9 +1,20 @@
+# Internal forward-auth upstream proxy (no TLS between Caddy handlers)
+:8099 {
+	@outpost path /outpost.goauthentik.io/*
+	reverse_proxy @outpost https://auth.hubris.network:443 {
+		transport http {
+			tls_server_name auth.hubris.network
+		}
+		header_up Host auth.hubris.network
+	}
+}
+
 # Authentik forward-auth snippet (domain-level mode).
 # Usage: add "import authentik" inside any site block to gate it.
 (authentik) {
 	route {
-		reverse_proxy /outpost.goauthentik.io/* http://192.168.8.180:9000
-		forward_auth http://192.168.8.180:9000 {
+		reverse_proxy /outpost.goauthentik.io/* https://auth.hubris.network:443
+		forward_auth http://127.0.0.1:8099 {
 			uri /outpost.goauthentik.io/auth/caddy
 			copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
 			trusted_proxies private_ranges
@@ -28,7 +39,16 @@ media.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
-	reverse_proxy 192.168.8.206:8096
+	# API and streaming paths — no Authentik (Jellyfin apps use their own auth)
+	@api path /api/* /socket /Audio/* /Videos/* /Items/* /Users/* /Sessions/* /System/* /LiveTv/* /Music/* /Artists/* /Albums/* /Playlists/* /Images/* /Subtitle* /videos/* /audio/*
+	handle @api {
+		reverse_proxy 192.168.8.206:8096
+	}
+	# Web UI — gated behind Authentik
+	handle {
+		import authentik
+		reverse_proxy 192.168.8.206:8096
+	}
 }
 
 git.hubris.network {
@@ -62,7 +82,7 @@ books.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
-	reverse_proxy 192.168.8.205:6060
+	reverse_proxy 192.168.8.213:6060
 }
 
 home.hubris.network {
@@ -79,12 +99,6 @@ cloud.hubris.network {
 	reverse_proxy 192.168.8.224:80
 }
 
-matrix.hubris.network {
-	tls {
-		dns ionos {env.IONOS_AUTH_API_TOKEN}
-	}
-	reverse_proxy 192.168.8.239:8008
-}
 
 proxmox.hubris.network {
 	tls {
@@ -133,7 +147,10 @@ sab.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
-	reverse_proxy 192.168.8.132:8081
+	handle {
+		import authentik
+		reverse_proxy 192.168.8.132:8082
+	}
 }
 
 blog.hubris.network {
@@ -144,30 +161,44 @@ blog.hubris.network {
 }
 
 photos.hubris.network {
-	# mule-image — PhotoPrism + Go sidecar + SvelteKit (post-Mulimage 2.0)
+	# Mulimage 2.0 — PhotoPrism + Go sidecar + SvelteKit (LXC 120)
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
 	encode zstd gzip
-	# PhotoPrism API + OIDC callback first (matched before static catch-all)
+	# PhotoPrism API + static assets + share links
 	@pp path /api/v1/* /api/v1 /static/* /share/*
 	reverse_proxy @pp 192.168.8.136:2342
-	# PhotoPrism redirects to /library/browse after OIDC. Bounce back to
-	# the SvelteKit SPA; mule-image is the only user-facing frontend.
-	redir /library /  302
+	# OIDC hand-off: PhotoPrism redirects to /library/login after SSO;
+	# bounce back to / so the SvelteKit SPA picks up the session.
+	redir /library / 302
 	redir /library/* / 302
-	# mule-sidecar (Go) — keeps the /api/sidecar/ prefix
+	# Go sidecar — marks, folder mutations, duplicates, heap convert
 	@sc path /api/sidecar/*
 	reverse_proxy @sc 192.168.8.136:8000
-	# Catch-all → nginx-on-120 serving the SvelteKit static bundle (no Vite in prod)
+	# SvelteKit frontend (catch-all)
 	reverse_proxy 192.168.8.136:3000
 }
 
+prism.hubris.network {
+	# PhotoPrism — direct access for Prismatic mobile client (LXC 120)
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	encode zstd gzip
+	reverse_proxy 192.168.8.136:2342
+}
+
 auth.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
 	}
-	reverse_proxy 192.168.8.180:9000
+	reverse_proxy https://auth.hubris.network:443 {
+		transport http {
+			tls_server_name auth.hubris.network
+		}
+		header_up Host auth.hubris.network
+	}
 }
 
 artifacto.hubris.network {
@@ -220,3 +251,45 @@ secrets.hubris.network {
 	}
 	reverse_proxy 192.168.8.205:9820
 }
+
+# Authentik LAN forward-auth outpost (external_host for domain-level providers)
+sso.hubris.network {
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	reverse_proxy https://auth.hubris.network:443 {
+		transport http {
+			tls_server_name auth.hubris.network
+		}
+		header_up Host auth.hubris.network
+	}
+}
+
+
+element.hubris.network {
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	reverse_proxy 192.168.8.239:8080
+}
+
+trmnl.hubris.network {
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	reverse_proxy 192.168.8.211:9851
+}
+
+house.hubris.network {
+tls {
+dns ionos {env.IONOS_AUTH_API_TOKEN}
+}
+reverse_proxy 192.168.8.212:3000
+}
+
+teddy.hubris.network {
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	reverse_proxy 192.168.8.243:8080
+}