From 993504106e64813828fc8688ebcf72d75266adbd Mon Sep 17 00:00:00 2001
From: ginnoir <ginnoir@users.noreply.github.com>
Date: Thu, 11 Jun 2026 15:32:09 -0500
Subject: [PATCH] feat(caddy): bypass Authentik forward_auth for Plane API key
 requests

Adds a named matcher @plane_api that matches /api/* requests carrying
X-API-Key, routing them directly to plane_api:8000 without hitting the
Authentik outpost. Browser/UI sessions still go through forward_auth.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 Caddyfile | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/Caddyfile b/Caddyfile
index 0fcc922..e0a7682 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -418,6 +418,13 @@ docs.ginnoir.com {
 plane.ginnoir.com {
 	route {
 		import authentik_outpost
+		@plane_api {
+			path /api/*
+			header X-API-Key *
+		}
+		handle @plane_api {
+			reverse_proxy plane_api:8000
+		}
 		handle /api/* {
 			import authentik_forward_auth
 			reverse_proxy plane_api:8000