techy/Media-Server-Setup
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

README: domain-level forward auth as the recommended Authentik setup

Browse Source 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Brandyn / Techy
2026-10-30 23:19:45 -05:00
parent 4b4053a407
commit bee53f2718
1 changed files with 17 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
README.md
View File

@@ -208,15 +208,23 @@ the 500 Mbps line. For a crowd, restream to Twitch from OBS.
## 5g. Authentik forward-auth for the Caddy-gated hosts (`live.`, `bot.`; later the main host) ## 5g. Authentik forward-auth for the Caddy-gated hosts (`live.`, `bot.`; later the main host)
Caddy's `forward_auth` asks Authentik's **embedded outpost** (127.0.0.1:9000). Authentik needs, once: Caddy's `forward_auth` asks Authentik's **embedded outpost** (127.0.0.1:9000) on every request. The
1. Applications → Outposts → edit "authentik Embedded Outpost" → config `authentik_host: https://auth.HOST` generated Caddy blocks work with either Authentik mode below; nothing in Caddy changes.
(so login redirects go to the public address).
2. Per protected hostname: Applications → Create with provider → **Proxy Provider**, authorization flow **Recommended: one domain-level provider for all hosts** (one login, one cookie, new hosts need no Authentik work):
implicit-consent, mode **Forward auth (single application)**, external host `https://live.HOST` 1. Applications → Outposts → edit "authentik Embedded Outpost" → config `authentik_host: https://auth.HOST`.
(and again for `https://bot.HOST`). Bind groups on the Application (none = anyone who can log in). 2. Applications → Create with provider → Application `Vanguard sites`; **Proxy Provider**, authorization flow
3. Edit the Embedded Outpost → Applications → select them → Update. implicit-consent, mode **Forward auth (domain level)**, authentication URL `https://auth.HOST`,
4. Test in a private window: `https://live.HOST/` → Discord login → portal; `https://live.HOST/me/stream-key` cookie domain `HOST's parent domain` (e.g. `dumpstervigilantes.rip`).
shows your username (proves the identity header reaches the backend). 3. Edit the Embedded Outpost → Applications → add `Vanguard sites` → Update.
4. Test in a private window: `https://live.HOST/` → Discord login → portal; `https://bot.HOST/` opens with no
second login; `https://live.HOST/me/stream-key` shows your username.
Trade-off: one access policy for every gated host (the guild policy at login already limits it to server
members). A host that must be restricted to a group gets its own **single-application** Proxy Provider
(external host `https://x.HOST`, added to the outpost) and enforces nothing else; the bot web UI also
authorizes by the `X-Authentik-Groups` header itself.
Jellyfin and Gitea use OIDC providers instead, not this. Jellyfin and Gitea use OIDC providers instead, not this.
## 6. Editors ## 6. Editors