From f07668c1c3611bbe18e7ae330f758ce3f3c56d51 Mon Sep 17 00:00:00 2001
From: dtoro <d.toro.v@pm.me>
Date: Wed, 8 Jul 2026 12:00:20 +0200
Subject: [PATCH] caddy: update Caddyfile.oikos snippet to match deployed
 config with enrollment bypass

---
 compose/caddy/Caddyfile.oikos | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/compose/caddy/Caddyfile.oikos b/compose/caddy/Caddyfile.oikos
index 657044e..5947fc4 100644
--- a/compose/caddy/Caddyfile.oikos
+++ b/compose/caddy/Caddyfile.oikos
@@ -2,21 +2,26 @@
 # Lives in dtoro/caddy-conf repo; auto-deploys to caddy (LXC 121).
 # Replaces the old MCP server on apps/105 with the Docker stack on mac-mini.
 
-# Oikos REST API (operator)
+# Oikos REST API (operator) — enrollment endpoint bypasses Authentik
 oikos.hubris.network {
-    reverse_proxy <mac-mini-mesh-ip>:8090
+    tls {
+        dns ionos {env.IONOS_AUTH_API_TOKEN}
+    }
+    @enroll path /api/v1/clients/enroll
+    handle @enroll {
+        reverse_proxy <mac-mini-mesh-ip>:8090
+    }
+    handle {
+        import authentik
+        reverse_proxy <mac-mini-mesh-ip>:8090
+    }
 }
 
-# Oikos MCP endpoint (Hermes agents)
+# Oikos MCP endpoint (Hermes agents) — no auth required
 mcp.hubris.network {
     reverse_proxy <mac-mini-mesh-ip>:8090
 }
 
-# Oikos API (legacy apps/105 path — redirect or proxy during cutover)
-apis.hubris.network {
-    reverse_proxy <mac-mini-mesh-ip>:8090
-}
-
 # Hermes gateway (workstation access)
 hermes.hubris.network {
     reverse_proxy <mac-mini-mesh-ip>:8092