# Authentik forward-auth snippet (domain-level mode).
# Usage: add "import authentik" inside any site block to gate it.
(authentik) {
    route {
        reverse_proxy /outpost.goauthentik.io/* https://auth.hubris.network {
            header_up Host {upstream_hostport}
        }
        forward_auth https://auth.hubris.network {
            uri /outpost.goauthentik.io/auth/caddy
            copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
            trusted_proxies private_ranges
        }
    }
}

# The Caddyfile is an easy way to configure your Caddy web server.
#
# Unless the file starts with a global options block, the first
# uncommented line is always the address of your site.
#
# To use your own domain name (with automatic HTTPS), first make
# sure your domain's A/AAAA DNS records are properly pointed to
# this machine's public IP, then replace ":80" below with your
# domain name.

media.hubris.network {
    tls {
        dns ionos {env.IONOS_AUTH_API_TOKEN}
    }
    reverse_proxy 192.168.8.206:8096
}

git.hubris.network {
    tls {
        dns ionos {env.IONOS_AUTH_API_TOKEN}
    }
    handle_path /_plantuml/* {
        rewrite * /plantuml{uri}
        reverse_proxy 192.168.8.205:8079
    }
    handle {
        reverse_proxy 192.168.8.121:3000
    }
}

paperless.hubris.network {
    import authentik
    tls {
        dns ionos {env.IONOS_AUTH_API_TOKEN}
    }
    reverse_proxy 192.168.8.130:8000
}

books.hubris.network {
    tls {
        dns ionos {env.IONOS_AUTH_API_TOKEN}
    }
    reverse_proxy 192.168.8.205:6060
}

home.hubris.network {
    tls {
        dns ionos {env.IONOS_AUTH_API_TOKEN}
    }
    reverse_proxy 192.168.8.101:8123
}

cloud.hubris.network {
    tls {
        dns ionos {env.IONOS_AUTH_API_TOKEN}
    }
    reverse_proxy 192.168.8.224:80
}

matrix.hubris.network {
    tls {
        dns ionos {env.IONOS_AUTH_API_TOKEN}
    }
    reverse_proxy 192.168.8.239:8008
}

proxmox.hubris.network {
    tls {
        dns ionos {env.IONOS_AUTH_API_TOKEN}
    }
    reverse_proxy https://192.168.8.77:8006 {
        transport http {
            tls_insecure_skip_verify
        }
    }
}

docker.hubris.network {
    tls {
        dns ionos {env.IONOS_AUTH_API_TOKEN}
    }
    reverse_proxy https://192.168.8.205:9443 {
             transport http {
            tls_insecure_skip_verify
        }
   }

}


jellyseerr.hubris.network {
    tls {
        dns ionos {env.IONOS_AUTH_API_TOKEN}
    }
    reverse_proxy 192.168.8.132:5056
}

qbit.hubris.network {
    tls {
        dns ionos {env.IONOS_AUTH_API_TOKEN}
    }
    reverse_proxy 192.168.8.132:8080
}

sab.hubris.network {
    tls {
        dns ionos {env.IONOS_AUTH_API_TOKEN}
    }
    reverse_proxy 192.168.8.132:8081
}

blog.hubris.network {
    tls {
        dns ionos {env.IONOS_AUTH_API_TOKEN}
    }
    reverse_proxy 192.168.8.205:8080
}

photos.hubris.network {
    tls {
        dns ionos {env.IONOS_AUTH_API_TOKEN}
    }
    reverse_proxy 192.168.8.136:3000
}

auth.hubris.network {
    tls {
        dns ionos {env.IONOS_AUTH_API_TOKEN}
    }
    reverse_proxy 192.168.8.180:9000
}