From b797602cbc68b48ba6f52bd54434163cea19ddc3 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 26 Apr 2026 15:36:32 +0000
Subject: [PATCH] Fix Plex/Emby Authelia caveat: Case 4, not Case 3

Native clients (mobile, TV, desktop) DO route through Caddy via FQDN,
but cannot complete Authelia's browser-redirect login flow -- they get a
302 to auth.DOMAIN and fail. `import authelia` breaks all native clients.

Correct setup is Case 4: Caddy terminates TLS, import accesslog for
fail2ban, NO import authelia. Plex/Emby token auth handles access control.

https://claude.ai/code/session_012eTokAaGiZo7aGt1T2W9BC
---
 README.md                |  4 ++--
 caddy/snippets.caddyfile | 25 +++++++++++++++----------
 2 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/README.md b/README.md
index f0a4a19..3eb71cb 100644
--- a/README.md
+++ b/README.md
@@ -184,8 +184,8 @@ upstream", "trusted proxies", "header-based auth", "SSO via reverse proxy".
 | **App keeps own auth (case 3)** | | |
 | Uptime Kuma | 3 | No proxy auth, no native TOTP -- Authelia is the only way to add 2FA |
 | qBittorrent | 3 | Web UI has own auth; no proxy headers |
-| Plex | 3 ⚠ | Web UI gate only -- Plex clients bypass Caddy entirely; VPN is better |
-| Emby | 3 ⚠ | Same caveat as Plex; clients bypass Caddy |
+| Plex | 4 ⚠ | Do NOT use `import authelia` -- native clients go through Caddy but cannot complete browser-redirect auth; use Case 4, Plex handles its own auth |
+| Emby | 4 ⚠ | Same as Plex |
 | Gotify | 3 | Notification server; own auth |
 | ntfy | 3 | Notification server; token-based auth |
 | wg-easy | 3 | WireGuard web UI; WireGuard clients bypass Caddy (UDP 51820) |
diff --git a/caddy/snippets.caddyfile b/caddy/snippets.caddyfile
index 5d95405..f9be83f 100644
--- a/caddy/snippets.caddyfile
+++ b/caddy/snippets.caddyfile
@@ -344,23 +344,28 @@ portainer.{env.DOMAIN} {
 # }
 
 # --- Plex ---
-# IMPORTANT: Plex is tightly coupled to plex.tv cloud auth -- Authelia cannot
-# replace it. This gate applies to the web UI only. Plex clients (mobile, TV,
-# desktop apps) communicate directly with the server port and bypass Caddy
-# entirely, so the gate does not protect those paths. Tailscale or VPN is
-# the better approach for Plex remote access.
+# DO NOT use `import authelia` with Plex/Emby. Plex is coupled to plex.tv
+# cloud auth -- Authelia cannot replace it. More importantly, native clients
+# (mobile, TV, desktop apps) connect via FQDN through Caddy but CANNOT
+# complete Authelia's browser-redirect login flow (no cookie, no TOTP prompt).
+# `import authelia` will break all native clients with a connection error.
+#
+# Correct approach: Case 4. Caddy terminates TLS and reverse proxies; Plex's
+# own token auth handles access control. `import accesslog` keeps fail2ban
+# watching the subdomain for scanners.
+#
 # plex.{env.DOMAIN} {
 #     import accesslog
-#     import authelia
-#     reverse_proxy 192.168.x.x:32400              # CHANGE IP
+#     reverse_proxy 192.168.x.x:32400              # CHANGE IP -- NO import authelia
 # }
 
 # --- Emby ---
-# Same caveat as Plex: Emby clients bypass Caddy. Web UI gate only.
+# Same situation as Plex: native clients go through Caddy but cannot handle
+# Authelia's login redirect. Use Case 4 -- Caddy + TLS, Emby's own auth.
+#
 # emby.{env.DOMAIN} {
 #     import accesslog
-#     import authelia
-#     reverse_proxy 192.168.x.x:8096               # CHANGE IP
+#     reverse_proxy 192.168.x.x:8096               # CHANGE IP -- NO import authelia
 # }
 
 # --- Gotify ---