# =============================================================================
# Authentik — add this block to /etc/caddy/sites/infrastructure.caddy
# on the Caddy VM (192.168.88.110)
# =============================================================================

# Main Authentik UI — login portal at https://auth.jgitta.com
auth.jgitta.com {
    import web_secure
    reverse_proxy 192.168.88.27:9011
}


# =============================================================================
# Forward Auth snippet — add to snippets.caddy on the Caddy VM
# =============================================================================
# This snippet protects any service that doesn't have its own login page.
# Add "import authentik_forward_auth" to any site block to require Authentik login.
#
# (authentik_forward_auth) {
#     forward_auth http://192.168.88.27:9011 {
#         uri /outpost.goauthentik.io/auth/caddy
#         copy_headers X-authentik-username X-authentik-groups X-authentik-email X-authentik-name X-authentik-uid
#         trusted_proxies private_ranges
#     }
# }


# =============================================================================
# Example: protect Dashy with forward auth
# Replace your existing dashy block with this:
# =============================================================================
# dashy.jgitta.com {
#     import web_secure
#     import authentik_forward_auth
#     reverse_proxy http://192.168.88.27:8081
# }


# =============================================================================
# Services to protect with forward auth (uncomment after Authentik is running):
# =============================================================================
# Add "import authentik_forward_auth" to these site blocks:
#   - dashy.jgitta.com      (:8081)
#   - search.jgitta.com     (:8092)
#   - beszel.jgitta.com     (:8085)
#   - status.jgitta.com     (:3001)
#   - glances.jgitta.com    (:61208)
#   - budget.jgitta.com     (:5006)
#   - apache.jgitta.com     (:8080)  — Guacamole (also has native OIDC extension)