# Truncated, sanitized example - real Caddyfile has one block per app.
# Shows the pattern: mTLS + Authentik forward-auth in front of every
# reverse-proxied service.

{
    servers {
        protocols h1 h2
    }
}

# -------------------------
# mTLS
# -------------------------
(local_mtls) {
    tls /etc/caddy/certs/example.com.crt /etc/caddy/certs/example.com.key {
        client_auth {
            mode require_and_verify

            trust_pool file {
                pem_file /etc/caddy/certs/example.com.ca.crt
            }
        }
    }
}

# -------------------------
# Authentik forward auth
# -------------------------
(authentik_forward_auth) {
    forward_auth http://authentik.internal:9054 {
        uri /outpost.goauthentik.io/auth/caddy

        trusted_proxies private_ranges

        header_up Host {host}
        header_up X-Forwarded-Host {host}
        header_up X-Forwarded-Proto {scheme}
        header_up X-Forwarded-For {remote_host}
        header_up X-Real-IP {remote_host}

        copy_headers {
            X-Authentik-Username
            X-Authentik-Email
            X-Authentik-Groups
            X-Authentik-Uid
        }
    }
}

# -------------------------
# Example app entries
# -------------------------
app1.example.com {
    import local_mtls
    import authentik_forward_auth
    reverse_proxy http://app1.internal:8080
}

app2.example.com {
    import local_mtls
    reverse_proxy http://app2.internal:9000 {
        header_up Host {host}
        header_up X-Forwarded-Host {host}
        header_up X-Forwarded-Proto {scheme}
        header_up X-Forwarded-For {remote_host}
        header_up X-Real-IP {remote_host}
    }
}