dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

caddy: guarded vhosts route to Authentik's flow endpoint, not the outpost prefix

Browse Source 
This 2026.x build does not mount /outpost.goauthentik.io/* for proxy-provider
meta-header routing (probed live: ping answers 204, app paths with full meta
headers 404). Guarded vhosts now redirect to /if/flow/default-authentication-flow/
with next= back to the app — unauthenticated sees the login page in place,
authenticated sessions complete instantly and bounce straight to the app.
This commit is contained in:
Frank
2026-08-29 18:29:57 -07:00
parent 8898740ca4
commit d29d2ea29e
1 changed files with 16 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dankclaw/Caddyfile
+16 -30
View File
@@ -242,59 +242,45 @@ qbittorrent.franksdank.cloud {
# and app are answering); unauthenticated clients get the login flow served
# in place, authenticated traffic is forwarded back to http://:8017 and
# routed straight to the app. Exempt vhosts never enter this block.
# --- Internal listener: auth decision layer ---------------------------------
# Anubis dials http://caddy:8016 after verifying a client (TARGET in
# dankclaw/anubis/quadlet/anubis.container). Host headers survive the hop, so
# per-vhost routing resumes here. This 2026.x build does not mount the outpost
# URL space for proxy-provider meta-header routing (probed live: /ping answers
# 204, every app path with meta headers 404s), so guarded vhosts route
# whole-request to Authentik's flow endpoint instead: unauthenticated clients
# get the login flow served in place; authenticated sessions complete instantly
# and bounce back via next= straight to the app at http://:8017. Exempt vhosts
# never enter this block.
http://:8016 {
@home host www.franksdank.cloud
handle @home {
reverse_proxy authentik-server:9000 {
header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217
header_up X-authentik-meta-provider 1
header_up X-authentik-meta-app name=caddy
}
redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://www.franksdank.cloud/ 302
}
@search host search.franksdank.cloud
handle @search {
reverse_proxy authentik-server:9000 {
header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217
header_up X-authentik-meta-provider 1
header_up X-authentik-meta-app name=caddy
}
redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://search.franksdank.cloud/ 302
}
@hermes host hermes.franksdank.cloud
handle @hermes {
reverse_proxy authentik-server:9000 {
header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217
header_up X-authentik-meta-provider 1
header_up X-authentik-meta-app name=caddy
}
redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://hermes.franksdank.cloud/ 302
}
@prometheus host prometheus.franksdank.cloud
handle @prometheus {
reverse_proxy authentik-server:9000 {
header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217
header_up X-authentik-meta-provider 1
header_up X-authentik-meta-app name=caddy
}
redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://prometheus.franksdank.cloud/ 302
}
@romm host romm.franksdank.cloud
handle @romm {
reverse_proxy authentik-server:9000 {
header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217
header_up X-authentik-meta-provider 1
header_up X-authentik-meta-app name=caddy
}
redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://romm.franksdank.cloud/ 302
}
@files host files.franksdank.cloud
handle @files {
reverse_proxy authentik-server:9000 {
header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217
header_up X-authentik-meta-provider 1
header_up X-authentik-meta-app name=caddy
}
redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://files.franksdank.cloud/ 302
}
}