fix(caddy,authentik): auth guarded vhosts by proxying the whole request through authentik

The forward_auth target /outpost.goauthentik.io/auth/caddy does not exist
in authentik 2026.8 (verified live: 404 for every header combination; the
URL tree has no outpost auth prefix at all — the outpost worker dials back
to core over ws/outpost/<uuid>/ instead). Unauthenticated subrequests got
404, Caddy treated >=400 as 'not authenticated' and redirected browsers to
the dead path — users saw authentik's own Not-Found page.

Fix: guarded vhosts now proxy the whole request through authentik-server:9000
with X-authentik-meta-outpost/-provider/-app headers (the exact header set
this build's Traefik controller emits, adapted for Caddy). Unauthenticated
clients get the login flow served in place; once a session exists,
authentik proxies on to the provider's internal_host — now
http://caddy:8017, a new post-auth internal listener that routes straight to
the app. The chain terminates; nothing dials back into authentik.

Live DB changes applied alongside (postgres is the source of truth):
provider pk=1 authentication_flow=default-authentication-flow (was NULL —
the actual cause of the 404s) and internal_host=http://caddy:8017 (was
self-referential http://authentik-server:9000).

tests/authentik.bats

@@ -95,22 +95,20 @@ UNIT_DIR="$REPO_ROOT/dankclaw/authentik/quadlet"
     echo "$block" | grep -q 'reverse_proxy authentik-server:9000'
 }
 
-# --- Caddyfile: forward_auth on vhosts without their own auth ---
+# --- Caddyfile: guarded vhosts proxy the whole request through Authentik ----
 
-@test "the Caddyfile uses forward_auth" {
-    grep -q 'forward_auth' "$CADDYFILE"
+@test "guarded vhosts proxy the whole request through authentik on the internal listener" {
+    awk '/^http:\/\/:8016/,/^\}/' "$CADDYFILE" | grep -q 'reverse_proxy authentik-server:9000'
 }
 
-@test "forward_auth targets the authentik outpost caddy endpoint" {
-    grep -q '/outpost.goauthentik.io/auth/caddy' "$CADDYFILE"
+@test "the auth decision carries the outpost meta headers" {
+    grep -q 'X-authentik-meta-outpost' "$CADDYFILE"
+    grep -q 'X-authentik-meta-provider' "$CADDYFILE"
+    grep -q 'X-authentik-meta-app' "$CADDYFILE"
 }
 
-@test "forward_auth copies the X-Authentik-Username header" {
-    grep -q 'X-Authentik-Username' "$CADDYFILE"
-}
-
-@test "the outpost path is proxied to authentik in forward_auth vhosts" {
-    grep -q '/outpost.goauthentik.io/\*' "$CADDYFILE"
+@test "authenticated traffic returns to Caddy on the post-auth listener" {
+    grep -qE '^http://:8017 \{' "$CADDYFILE"
 }
 
 # --- Homepage: moved to naked domain + www ---

tests/caddyfile.bats

@@ -125,10 +125,11 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
     # franksdank.casa is not in the same Porkbun account, so it cannot get
     # a DNS-01 Let's Encrypt cert; it stays explicitly http. Every other
     # client-facing site address must carry no http:// prefix. The internal
-    # listener (http://:8016) is not client-facing — Anubis dials it over
-    # container DNS after verifying a client, so plain HTTP is intended.
+    # listeners (http://:8016, http://:8017) are not client-facing — Anubis
+    # and Authentik dial them over container DNS after verifying a client,
+    # so plain HTTP is intended.
     local offenders
-    offenders=$(grep -E '^http://' "$CADDYFILE" | grep -v 'plex\.franksdank\.casa' | grep -v '^http://:8016' || true)
+    offenders=$(grep -E '^http://' "$CADDYFILE" | grep -v 'plex\.franksdank\.casa' | grep -vE '^http://:801[67]' || true)
     [ -z "$offenders" ] || { echo "non-.casa http:// vhosts: $offenders"; return 1; }
 }
 

tests/homepage_caddy.bats

@@ -37,9 +37,11 @@ setup() {
     local block
     block=$(awk '/^franksdank\.cloud[[:space:]]/,/^}/' "$CADDY")
     echo "$block" | grep -q 'reverse_proxy anubis:8923'
-    # The SSO check itself now runs on the internal listener that Anubis
+    # The SSO check itself runs on the internal listener that Anubis
     # forwards accepted traffic to; Host survives the hop, so per-vhost
-    # routing (and with it forward_auth) resumes there.
+    # routing resumes there — guarded vhosts proxy the whole request
+    # through Authentik, which forwards authenticated traffic back on the
+    # post-auth listener (http://:8017) that routes straight to the app.
     grep -q 'http://:8016' "$CADDY"
-    awk '/^http:\/\/:8016/,/^\}/' "$CADDY" | grep -q 'forward_auth authentik-server:9000'
+    awk '/^http:\/\/:8016/,/^\}/' "$CADDY" | grep -q 'reverse_proxy authentik-server:9000'
 }