ginnoir/homelabstack
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix Homarr appdata bind mount and deploy Authentik forward auth on admin sites.
Deploy to valhalla / deploy (push) Has been cancelled
Details

Browse Source 
Homarr-labs stores state under /appdata; the old compose mapped empty paths and lost the dashboard on redeploy. TB-006 batch 1 adds Caddy forward_auth for 12 admin UIs with API and webhook bypasses.
This commit is contained in:
ginnoir
2026-06-10 23:14:32 -05:00
parent 1253825541
commit 109cc0d5cb
6 changed files with 586 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Caddyfile
+121 -41
View File
@@ -17,6 +17,20 @@
respond @blocked "Access denied" 403
}
# TB-006 — Authentik forward auth (embedded outpost on authentik-server:9000).
# Wrap protected sites in `route { ... }` so bypass handles run before forward_auth.
(authentik_outpost) {
reverse_proxy /outpost.goauthentik.io/* authentik-server:9000
}
(authentik_forward_auth) {
forward_auth authentik-server:9000 {
uri /outpost.goauthentik.io/auth/caddy
copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
trusted_proxies private_ranges
}
}
# =============================================================
# FOUNDRY VTT — public
# =============================================================
@@ -196,8 +210,13 @@ storage.j-costa.com, https://storage.j-costa.com {
# MINIO CONSOLE — internal only
# =============================================================
minio.ginnoir.com {
import internal_only
reverse_proxy resume-minio:9001
route {
import authentik_outpost
handle {
import authentik_forward_auth
reverse_proxy resume-minio:9001
}
}
}
# =============================================================
@@ -219,34 +238,50 @@ dev.ginnoir.com {
# MANAGEMENT — internal only
# =============================================================
portainer.ginnoir.com {
@webhook {
method POST
path /api/stacks/webhooks/*
}
handle @webhook {
reverse_proxy portainer:9000
}
handle {
import internal_only
reverse_proxy portainer:9000
route {
import authentik_outpost
@webhook {
method POST
path /api/stacks/webhooks/*
}
handle @webhook {
reverse_proxy portainer:9000
}
handle {
import authentik_forward_auth
reverse_proxy portainer:9000
}
}
}
uptime.ginnoir.com {
import internal_only
reverse_proxy uptime-kuma:3001
route {
import authentik_outpost
handle {
import authentik_forward_auth
reverse_proxy uptime-kuma:3001
}
}
}
homarr.ginnoir.com {
import internal_only
reverse_proxy homarr:7575
route {
import authentik_outpost
handle {
import authentik_forward_auth
reverse_proxy homarr:7575
}
}
}
backup.ginnoir.com {
import internal_only
reverse_proxy kopia:51515
route {
import authentik_outpost
handle {
import authentik_forward_auth
reverse_proxy kopia:51515
}
}
}
router.ginnoir.com {
@@ -258,13 +293,31 @@ router.ginnoir.com {
# DEV STACK — internal only
# =============================================================
gitea.ginnoir.com {
import internal_only
reverse_proxy gitea:3000
route {
import authentik_outpost
@api path /api/*
@git path_regexp (?i)\.git(/|$)
handle @api {
reverse_proxy gitea:3000
}
handle @git {
reverse_proxy gitea:3000
}
handle {
import authentik_forward_auth
reverse_proxy gitea:3000
}
}
}
code.ginnoir.com {
import internal_only
reverse_proxy code_server:8443
route {
import authentik_outpost
handle {
import authentik_forward_auth
reverse_proxy code_server:8443
}
}
}
registry.ginnoir.com {
@@ -273,35 +326,62 @@ registry.ginnoir.com {
}
registry-ui.ginnoir.com {
import internal_only
reverse_proxy registry_ui:80
route {
import authentik_outpost
handle {
import authentik_forward_auth
reverse_proxy registry_ui:80
}
}
}
dbx.ginnoir.com {
import internal_only
reverse_proxy dbx:4224
route {
import authentik_outpost
handle {
import authentik_forward_auth
reverse_proxy dbx:4224
}
}
}
vault.ginnoir.com {
import internal_only
reverse_proxy vault:8200
route {
import authentik_outpost
@vaultapi path /v1/*
handle @vaultapi {
reverse_proxy vault:8200
}
handle {
import authentik_forward_auth
reverse_proxy vault:8200
}
}
}
docs.ginnoir.com {
import internal_only
reverse_proxy bookstack:80
route {
import authentik_outpost
handle {
import authentik_forward_auth
reverse_proxy bookstack:80
}
}
}
plane.ginnoir.com {
import internal_only
handle /api/* {
reverse_proxy plane_api:8000
}
handle /auth/* {
reverse_proxy plane_api:8000
}
handle {
reverse_proxy plane_web:3000
route {
import authentik_outpost
handle /api/* {
reverse_proxy plane_api:8000
}
handle /auth/* {
reverse_proxy plane_api:8000
}
handle {
import authentik_forward_auth
reverse_proxy plane_web:3000
}
}
}