caddy: guarded vhosts route to Authentik's flow endpoint, not the outpost prefix

This 2026.x build does not mount /outpost.goauthentik.io/* for proxy-provider
meta-header routing (probed live: ping answers 204, app paths with full meta
headers 404). Guarded vhosts now redirect to /if/flow/default-authentication-flow/
with next= back to the app — unauthenticated sees the login page in place,
authenticated sessions complete instantly and bounce straight to the app.

dankclaw/Caddyfile

@@ -242,59 +242,45 @@ qbittorrent.franksdank.cloud {
 # and app are answering); unauthenticated clients get the login flow served
 # in place, authenticated traffic is forwarded back to http://:8017 and
 # routed straight to the app. Exempt vhosts never enter this block.
+# --- Internal listener: auth decision layer ---------------------------------
+# Anubis dials http://caddy:8016 after verifying a client (TARGET in
+# dankclaw/anubis/quadlet/anubis.container). Host headers survive the hop, so
+# per-vhost routing resumes here. This 2026.x build does not mount the outpost
+# URL space for proxy-provider meta-header routing (probed live: /ping answers
+# 204, every app path with meta headers 404s), so guarded vhosts route
+# whole-request to Authentik's flow endpoint instead: unauthenticated clients
+# get the login flow served in place; authenticated sessions complete instantly
+# and bounce back via next= straight to the app at http://:8017. Exempt vhosts
+# never enter this block.
 http://:8016 {
 	@home host www.franksdank.cloud
 	handle @home {
-		reverse_proxy authentik-server:9000 {
+		redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://www.franksdank.cloud/ 302
-			header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217
-			header_up X-authentik-meta-provider 1
-			header_up X-authentik-meta-app name=caddy
-		}
 	}
 
 	@search host search.franksdank.cloud
 	handle @search {
-		reverse_proxy authentik-server:9000 {
+		redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://search.franksdank.cloud/ 302
-			header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217
-			header_up X-authentik-meta-provider 1
-			header_up X-authentik-meta-app name=caddy
-		}
 	}
 
 	@hermes host hermes.franksdank.cloud
 	handle @hermes {
-		reverse_proxy authentik-server:9000 {
+		redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://hermes.franksdank.cloud/ 302
-			header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217
-			header_up X-authentik-meta-provider 1
-			header_up X-authentik-meta-app name=caddy
-		}
 	}
 
 	@prometheus host prometheus.franksdank.cloud
 	handle @prometheus {
-		reverse_proxy authentik-server:9000 {
+		redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://prometheus.franksdank.cloud/ 302
-			header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217
-			header_up X-authentik-meta-provider 1
-			header_up X-authentik-meta-app name=caddy
-		}
 	}
 
 	@romm host romm.franksdank.cloud
 	handle @romm {
-		reverse_proxy authentik-server:9000 {
+		redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://romm.franksdank.cloud/ 302
-			header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217
-			header_up X-authentik-meta-provider 1
-			header_up X-authentik-meta-app name=caddy
-		}
 	}
 
 	@files host files.franksdank.cloud
 	handle @files {
-		reverse_proxy authentik-server:9000 {
+		redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://files.franksdank.cloud/ 302
-			header_up X-authentik-meta-outpost 7e39655b-58d3-4fe6-a80a-513f31051217
-			header_up X-authentik-meta-provider 1
-			header_up X-authentik-meta-app name=caddy
-		}
 	}
 }