techy/Media-Server-Setup
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

README: Authentik forward-auth setup for live/bot hosts

Browse Source 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Brandyn / Techy
2026-10-30 23:12:56 -05:00
parent 82df0b1583
commit 4b4053a407
1 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
README.md
View File

@@ -206,6 +206,19 @@ streamer's Authentik username must equal their MediaMTX name.
Bandwidth: no transcoding, every viewer gets the source bitrate (~15 Mbps) → ~30 concurrent viewers on
the 500 Mbps line. For a crowd, restream to Twitch from OBS.
## 5g. Authentik forward-auth for the Caddy-gated hosts (`live.`, `bot.`; later the main host)
Caddy's `forward_auth` asks Authentik's **embedded outpost** (127.0.0.1:9000). Authentik needs, once:
1. Applications → Outposts → edit "authentik Embedded Outpost" → config `authentik_host: https://auth.HOST`
(so login redirects go to the public address).
2. Per protected hostname: Applications → Create with provider → **Proxy Provider**, authorization flow
implicit-consent, mode **Forward auth (single application)**, external host `https://live.HOST`
(and again for `https://bot.HOST`). Bind groups on the Application (none = anyone who can log in).
3. Edit the Embedded Outpost → Applications → select them → Update.
4. Test in a private window: `https://live.HOST/` → Discord login → portal; `https://live.HOST/me/stream-key`
shows your username (proves the identity header reaches the backend).
Jellyfin and Gitea use OIDC providers instead, not this.
## 6. Editors
Browser: https://media.example.com/ → log in. Scrub any `.mp4` in the browser, download what you want.