# Internal forward-auth upstream proxy (no TLS between Caddy handlers)
:8099 {
	@outpost path /outpost.goauthentik.io/*
	reverse_proxy @outpost https://auth.hubris.network:443 {
		transport http {
			tls_server_name auth.hubris.network
		}
		header_up Host auth.hubris.network
	}
}

# Authentik forward-auth snippet (domain-level mode).
# Usage: add "import authentik" inside any site block to gate it.
(authentik) {
	route {
		reverse_proxy /outpost.goauthentik.io/* https://auth.hubris.network:443
		forward_auth http://127.0.0.1:8099 {
			uri /outpost.goauthentik.io/auth/caddy
			copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
			trusted_proxies private_ranges
			header_up X-Forwarded-Host {host}
			header_up X-Forwarded-Proto {scheme}
			header_up X-Forwarded-Uri {uri}
		}
	}
}

# Internal webhook receiver for auto-deploy from Gitea
:8080 {
	reverse_proxy 127.0.0.1:8081
}