# Marreta & Authentik Deployment
Podman compose on dankclaw. Shares gluetun egress with searxng.
## Guard Chain
Caddy TLS → Anubis (:8923) → Authentik outpost → internal :8017 → marreta
## Auth Fix & Pitfalls
- Login-wall caused by null `ProxyProvider.application` & flows crashing Rust outpost.
- Fix: Link `Application(slug=marreta)`, populate auth/authz/invalidation flows.
- Probe: `localhost:8017` returns HTTP 000 (Caddy netns). Use internal probe or grep config.
- Non-browser clients fail JS challenges. Audit service-to-service URLs for public guarded hostnames.
- Exempt: IdP, Gitea (git smart-HTTP), self-auth services.
## Verification
- E2E: `tests/e2e/specs/16-marreta.spec.ts` asserts homepage tile passes guard chain.