# Traefik dynamic config — forward auth via authentik embedded outpost.
# Deploy to: /etc/dokploy/traefik/dynamic/authentik-forwardauth.yml
# All objects carry the `ak-` prefix; this file is never managed by Dokploy.
#
# Bypass model: the gated Host router (managed by Dokploy domain middlewares)
# covers UI paths only. More-specific rules win automatically:
#   Host + PathPrefix(`/outpost.goauthentik.io`) -> outpost   (auth callbacks)
#   Host + PathPrefix(`/api`)                   -> app API   (CLI/SDK/agents/UI fetches)
http:
  services:
    ak-authentik:
      loadBalancer:
        servers:
          - url: http://authentik-server:9000
        passHostHeader: true
    ak-dokploy:
      loadBalancer:
        servers:
          - url: http://dokploy:3000
        passHostHeader: true
    ak-infisical:
      loadBalancer:
        servers:
          - url: http://infisical:8080
        passHostHeader: true

  middlewares:
    ak-fw:
      forwardAuth:
        # embedded outpost reachable internally — no Cloudflare roundtrip
        address: http://authentik-server:9000/outpost.goauthentik.io/auth/traefik
        trustForwardHeader: true
        authResponseHeaders:
          - X-authentik-username
          - X-authentik-groups
          - X-authentik-email
          - X-authentik-name
          - X-authentik-uid
          - X-authentik-jwt
          - X-authentik-meta-jwks
          - X-authentik-meta-outpost
          - X-authentik-meta-provider
          - X-authentik-meta-app
          - X-authentik-meta-version
    ak-fw-errors:
      # turns the outpost 401 into its login redirect for browsers;
      # machine paths bypass via dedicated routers and never see this
      errors:
        status: ["401-403"]
        service: ak-authentik
        query: /outpost.goauthentik.io/start?rd={url}

  routers:
    # Outpost endpoints on each gated host (forward_single mode needs these
    # public: start/callback/sign_out live on the application domain).
    ak-infisical-outpost:
      rule: Host(`infisical.paginica.com`) && PathPrefix(`/outpost.goauthentik.io`)
      service: ak-authentik
      entryPoints: [websecure]
      tls:
        certResolver: letsencrypt
      priority: 1000
    ak-panel-outpost:
      rule: Host(`panel.paginica.com`) && PathPrefix(`/outpost.goauthentik.io`)
      service: ak-authentik
      entryPoints: [websecure]
      tls:
        certResolver: letsencrypt
      priority: 1000



    # Infisical API bypass — UI fetches, CLI, SDK, agentes y syncs usan /api
    # con tokens propios de Infisical; gated /api romperia el propio web vault.
    ak-infisical-api:
      rule: Host(`infisical.paginica.com`) && PathPrefix(`/api`)
      service: ak-infisical
      entryPoints: [websecure]
      tls:
        certResolver: letsencrypt
      priority: 900

    # Panel API bypass — keeps /api (tRPC, better-auth, deploy webhooks)
    # outside the auth gate. Higher priority than the gated root router.
    ak-panel-api:
      rule: Host(`panel.paginica.com`) && PathPrefix(`/api`)
      service: ak-dokploy
      entryPoints: [websecure]
      tls:
        certResolver: letsencrypt
      priority: 900