From 7213460c10aa97ce3f4deb9190e133216b8c0ffe Mon Sep 17 00:00:00 2001 From: Brandyn / Techy Date: Sat, 31 Oct 2026 17:53:02 -0500 Subject: [PATCH] Caddy: /logout on every gated host redirects to Authentik sign-out Co-Authored-By: Claude Fable 5.1 --- README.md | 3 ++- configure.py | 4 +++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index f12d2d6..ce397dc 100644 --- a/README.md +++ b/README.md @@ -275,7 +275,8 @@ Design: **Authentik authenticates once for the whole domain; Caddy authorizes pe copyparty additionally requires a header with a secret name that only Caddy adds (`idp-h-key`, `COPYPARTY_IDP_KEY` in `.env`), so identity headers cannot be forged even if copyparty were reached directly. Logout: copyparty's logout link, the live portal's "Sign out" and the dock's "sign out" go through - `/outpost.goauthentik.io/sign_out`. Set the provider's **Invalidation flow** to + `/outpost.goauthentik.io/sign_out`; `https:///logout` does the same from anywhere + (e.g. from the Syncthing UI, which has no logout of its own). Set the provider's **Invalidation flow** to `default-provider-invalidation-flow` so that also ends the Authentik login: every logout then forces a full Discord re-login on the next visit (and picks up group changes). Discord itself may approve silently if you are still logged into Discord in that browser. diff --git a/configure.py b/configure.py index 0058f8a..8f9e00a 100755 --- a/configure.py +++ b/configure.py @@ -127,7 +127,9 @@ def ask_name(kind, taken): return n # ------------------------------------------------------------------ writers -AUTHENTIK_FORWARD_AUTH = """ # Authentik forward-auth (embedded outpost). Needs a Proxy Provider in Authentik — domain-level for the +AUTHENTIK_FORWARD_AUTH = """ # /logout on every gated host = sign out of the Discord login (domain-wide session) + redir /logout /outpost.goauthentik.io/sign_out 302 + # Authentik forward-auth (embedded outpost). Needs a Proxy Provider in Authentik — domain-level for the # whole domain (recommended) or single-application for this host — assigned to the embedded outpost. # Until then: 4xx, never open. Per-host group requirements are enforced below from X-Authentik-Groups. reverse_proxy /outpost.goauthentik.io/* 127.0.0.1:9000