32 lines
1.0 KiB
Plaintext
32 lines
1.0 KiB
Plaintext
# Internal forward-auth upstream proxy (no TLS between Caddy handlers)
|
|
:8099 {
|
|
@outpost path /outpost.goauthentik.io/*
|
|
reverse_proxy @outpost https://auth.hubris.network:443 {
|
|
transport http {
|
|
tls_server_name auth.hubris.network
|
|
}
|
|
header_up Host auth.hubris.network
|
|
}
|
|
}
|
|
|
|
# Authentik forward-auth snippet (domain-level mode).
|
|
# Usage: add "import authentik" inside any site block to gate it.
|
|
(authentik) {
|
|
route {
|
|
reverse_proxy /outpost.goauthentik.io/* https://auth.hubris.network:443
|
|
forward_auth http://127.0.0.1:8099 {
|
|
uri /outpost.goauthentik.io/auth/caddy
|
|
copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
|
|
trusted_proxies private_ranges
|
|
header_up X-Forwarded-Host {host}
|
|
header_up X-Forwarded-Proto {scheme}
|
|
header_up X-Forwarded-Uri {uri}
|
|
}
|
|
}
|
|
}
|
|
|
|
# Internal webhook receiver for auto-deploy from Gitea
|
|
:8080 {
|
|
reverse_proxy 127.0.0.1:8081
|
|
}
|