From d29d2ea29e54c636f886f4501ca51db9a3670aba Mon Sep 17 00:00:00 2001 From: Frank Date: Sat, 29 Aug 2026 18:29:57 -0700 Subject: [PATCH] caddy: guarded vhosts route to Authentik's flow endpoint, not the outpost prefix MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This 2026.x build does not mount /outpost.goauthentik.io/* for proxy-provider meta-header routing (probed live: ping answers 204, app paths with full meta headers 404). Guarded vhosts now redirect to /if/flow/default-authentication-flow/ with next= back to the app — unauthenticated sees the login page in place, authenticated sessions complete instantly and bounce straight to the app. --- dankclaw/Caddyfile | 46 ++++++++++++++++------------------------------ 1 file changed, 16 insertions(+), 30 deletions(-) diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile index 3cc0532..db177da 100644 --- a/dankclaw/Caddyfile +++ b/dankclaw/Caddyfile @@ -242,59 +242,45 @@ qbittorrent.franksdank.cloud { # and app are answering); unauthenticated clients get the login flow served # in place, authenticated traffic is forwarded back to http://:8017 and # routed straight to the app. Exempt vhosts never enter this block. +# --- Internal listener: auth decision layer --------------------------------- +# Anubis dials http://caddy:8016 after verifying a client (TARGET in +# dankclaw/anubis/quadlet/anubis.container). Host headers survive the hop, so +# per-vhost routing resumes here. This 2026.x build does not mount the outpost +# URL space for proxy-provider meta-header routing (probed live: /ping answers +# 204, every app path with meta headers 404s), so guarded vhosts route +# whole-request to Authentik's flow endpoint instead: unauthenticated clients +# get the login flow served in place; authenticated sessions complete instantly +# and bounce back via next= straight to the app at http://:8017. Exempt vhosts +# never enter this block. http://:8016 { @home host www.franksdank.cloud handle @home { - reverse_proxy authentik-server:9000 { - header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217 - header_up X-authentik-meta-provider 1 - header_up X-authentik-meta-app name=caddy - } + redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://www.franksdank.cloud/ 302 } @search host search.franksdank.cloud handle @search { - reverse_proxy authentik-server:9000 { - header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217 - header_up X-authentik-meta-provider 1 - header_up X-authentik-meta-app name=caddy - } + redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://search.franksdank.cloud/ 302 } @hermes host hermes.franksdank.cloud handle @hermes { - reverse_proxy authentik-server:9000 { - header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217 - header_up X-authentik-meta-provider 1 - header_up X-authentik-meta-app name=caddy - } + redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://hermes.franksdank.cloud/ 302 } @prometheus host prometheus.franksdank.cloud handle @prometheus { - reverse_proxy authentik-server:9000 { - header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217 - header_up X-authentik-meta-provider 1 - header_up X-authentik-meta-app name=caddy - } + redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://prometheus.franksdank.cloud/ 302 } @romm host romm.franksdank.cloud handle @romm { - reverse_proxy authentik-server:9000 { - header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217 - header_up X-authentik-meta-provider 1 - header_up X-authentik-meta-app name=caddy - } + redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://romm.franksdank.cloud/ 302 } @files host files.franksdank.cloud handle @files { - reverse_proxy authentik-server:9000 { - header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217 - header_up X-authentik-meta-provider 1 - header_up X-authentik-meta-app name=caddy - } + redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://files.franksdank.cloud/ 302 } }