2c418d395d
Structure: shared/authentik - forward-auth proxy + authentik snippet (both hosts) hosts/hubris/ - git, mcp, oikos, paperless, cloud, photos, etc. hosts/strong/ - media, books, roms, jellyseerr, qbit, sab, matrix, etc. Each host imports /etc/caddy/shared/* at the top of its Caddyfile. Systemd overrides point to hosts/<hostname>/Caddyfile. Deploy workflow: git push → webhook → caddy reload
35 lines
1.3 KiB
Plaintext
35 lines
1.3 KiB
Plaintext
# Internal forward-auth upstream proxy (no TLS between Caddy handlers)
|
|
:8099 {
|
|
@outpost path /outpost.goauthentik.io/*
|
|
reverse_proxy @outpost https://auth.hubris.network:443 {
|
|
transport http {
|
|
tls_server_name auth.hubris.network
|
|
}
|
|
header_up Host auth.hubris.network
|
|
}
|
|
}
|
|
|
|
# Authentik forward-auth snippet (domain-level mode).
|
|
# Usage: add "import authentik" inside any site block to gate it.
|
|
(authentik) {
|
|
route {
|
|
reverse_proxy /outpost.goauthentik.io/* https://auth.hubris.network:443
|
|
forward_auth http://127.0.0.1:8099 {
|
|
uri /outpost.goauthentik.io/auth/caddy
|
|
copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
|
|
trusted_proxies private_ranges
|
|
header_up X-Forwarded-Host {host}
|
|
header_up X-Forwarded-Proto {scheme}
|
|
header_up X-Forwarded-Uri {uri}
|
|
}
|
|
}
|
|
}
|
|
|
|
# Unless the file starts with a global options block, the first
|
|
# uncommented line is always the address of your site.
|
|
#
|
|
# To use your own domain name (with automatic HTTPS), first make
|
|
# sure your domain's A/AAAA DNS records are properly pointed to
|
|
# this machine's public IP, then replace ":80" below with your
|
|
# domain name.
|