From 4b4053a407cc63e2bda5c537fe811267847a42ff Mon Sep 17 00:00:00 2001 From: Brandyn / Techy Date: Fri, 30 Oct 2026 23:12:56 -0500 Subject: [PATCH] README: Authentik forward-auth setup for live/bot hosts Co-Authored-By: Claude Fable 5.1 --- README.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/README.md b/README.md index 68a88e2..73a59cf 100644 --- a/README.md +++ b/README.md @@ -206,6 +206,19 @@ streamer's Authentik username must equal their MediaMTX name. Bandwidth: no transcoding, every viewer gets the source bitrate (~15 Mbps) → ~30 concurrent viewers on the 500 Mbps line. For a crowd, restream to Twitch from OBS. +## 5g. Authentik forward-auth for the Caddy-gated hosts (`live.`, `bot.`; later the main host) + +Caddy's `forward_auth` asks Authentik's **embedded outpost** (127.0.0.1:9000). Authentik needs, once: +1. Applications → Outposts → edit "authentik Embedded Outpost" → config `authentik_host: https://auth.HOST` + (so login redirects go to the public address). +2. Per protected hostname: Applications → Create with provider → **Proxy Provider**, authorization flow + implicit-consent, mode **Forward auth (single application)**, external host `https://live.HOST` + (and again for `https://bot.HOST`). Bind groups on the Application (none = anyone who can log in). +3. Edit the Embedded Outpost → Applications → select them → Update. +4. Test in a private window: `https://live.HOST/` → Discord login → portal; `https://live.HOST/me/stream-key` + shows your username (proves the identity header reaches the backend). +Jellyfin and Gitea use OIDC providers instead, not this. + ## 6. Editors Browser: https://media.example.com/ → log in. Scrub any `.mp4` in the browser, download what you want.