From 2a72efad44e607b24a20b089d00dc0cf4d0accd0 Mon Sep 17 00:00:00 2001
From: Frank <frank@dankware>
Date: Sat, 29 Aug 2026 23:49:42 -0700
Subject: [PATCH] anubis policy: allow /outpost.goauthentik.io/* transport
 paths

Login/PoW/POST traffic to the outpost URL space cannot solve a fresh PoW
challenge per request; exempt the transport prefix (authentik's own session
gate still protects it) so the guarded-host sign-in journey completes.
---
 dankclaw/anubis/policy.json | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/dankclaw/anubis/policy.json b/dankclaw/anubis/policy.json
index 0c8c79f..37dae49 100644
--- a/dankclaw/anubis/policy.json
+++ b/dankclaw/anubis/policy.json
@@ -10,6 +10,11 @@
       "path_regex": "^/\\.within\\.website",
       "action": "ALLOW"
     },
+    {
+      "name": "serve authentik outpost transport",
+      "path_regex": "^/outpost\\.goauthentik\\.io/",
+      "action": "ALLOW"
+    },
     {
       "name": "challenge everything else",
       "path_regex": ".",