Sync workspace with Gitea: merge June/July session docs

- README + siklos-docker-services: add authentik/searxng/beszel rows, photos VM section, 2026-06-24 cleanup notes, 2026-07-03 Portainer conversion note (jgpc naming preserved) - Add: authentik setup docs, frigate docs/config, OCIS migration docs, AdventureLog bug report, install-native-apps.sh, workstation-disk-analysis.md - Remove obsolete: cgitta-nextcloud-zip-analysis.md, kopia-restore-guide.md - .gitignore: ocis-credentials.md (secrets stay local), *.bak
2026-07-08 14:12:05 -05:00
parent bab19cd790
commit 7cb2ebed2d
27 changed files with 1611 additions and 595 deletions
@@ -0,0 +1,49 @@
+# =============================================================================
+# Authentik — add this block to /etc/caddy/sites/infrastructure.caddy
+# on the Caddy VM (192.168.88.110)
+# =============================================================================
+
+# Main Authentik UI — login portal at https://auth.jgitta.com
+auth.jgitta.com {
+    import web_secure
+    reverse_proxy 192.168.88.27:9011
+}
+
+
+# =============================================================================
+# Forward Auth snippet — add to snippets.caddy on the Caddy VM
+# =============================================================================
+# This snippet protects any service that doesn't have its own login page.
+# Add "import authentik_forward_auth" to any site block to require Authentik login.
+#
+# (authentik_forward_auth) {
+#     forward_auth http://192.168.88.27:9011 {
+#         uri /outpost.goauthentik.io/auth/caddy
+#         copy_headers X-authentik-username X-authentik-groups X-authentik-email X-authentik-name X-authentik-uid
+#         trusted_proxies private_ranges
+#     }
+# }
+
+
+# =============================================================================
+# Example: protect Dashy with forward auth
+# Replace your existing dashy block with this:
+# =============================================================================
+# dashy.jgitta.com {
+#     import web_secure
+#     import authentik_forward_auth
+#     reverse_proxy http://192.168.88.27:8081
+# }
+
+
+# =============================================================================
+# Services to protect with forward auth (uncomment after Authentik is running):
+# =============================================================================
+# Add "import authentik_forward_auth" to these site blocks:
+#   - dashy.jgitta.com      (:8081)
+#   - search.jgitta.com     (:8092)
+#   - beszel.jgitta.com     (:8085)
+#   - status.jgitta.com     (:3001)
+#   - glances.jgitta.com    (:61208)
+#   - budget.jgitta.com     (:5006)
+#   - apache.jgitta.com     (:8080)  — Guacamole (also has native OIDC extension)