feat: drive domain from DOMAIN env var -- no manual find-and-replace

Previously every example.com had to be found and replaced manually.
Now a single DOMAIN=yourdomain.com in .env propagates everywhere:

- .env.example: add DOMAIN=example.com with explanation
- docker-compose.yml: pass DOMAIN into authelia container environment
- authelia/configuration.yml: use {{ env "DOMAIN" }} in totp.issuer,
  access_control.rules, and all four session.cookies[] fields
  (Authelia 4.38+ Go template substitution)
- caddy/Caddyfile: use {env.DOMAIN} in all site block addresses
  (Caddy native env substitution); update header comment explaining
  how to set DOMAIN for system vs dockerized Caddy
- README.md: update step 3 to explain DOMAIN is the only change needed;
  update step 4 to say just uncomment the right rule; update Caddy
  wiring section with DOMAIN env var instructions for both Caddy modes

https://claude.ai/code/session_012eTokAaGiZo7aGt1T2W9BC

authelia/configuration.yml

@@ -11,6 +11,10 @@
 # Secrets are NOT in this file. They are loaded from files mounted at
 # /secrets via the AUTHELIA_*_FILE env vars in docker-compose.yml.
 #
+# Your domain comes from the DOMAIN variable in .env -- no manual
+# find-and-replace needed. Authelia 4.38+ processes this file as a Go
+# template, so {{ env "DOMAIN" }} is substituted at startup.
+#
 # After editing, validate before restarting:
 #   docker compose run --rm authelia authelia validate-config --config /config/configuration.yml
 ###############################################################################
@@ -37,7 +41,7 @@ identity_validation:
 
 totp:
   disable: false
-  issuer: 'example.com'      # CHANGE: your root domain (shown in authenticator app)
+  issuer: '{{ env "DOMAIN" }}'   # shown in your authenticator app
   algorithm: 'sha1'
   digits: 6
   period: 30
@@ -75,8 +79,6 @@ authentication_backend:
 # ---------------------------------------------------------------------------
 # WHICH SITES NEED A RULE HERE?
 #
-# There are four ways a site can relate to Authelia:
-#
 # CASE 1 -- App has NO built-in auth (e.g. Pi doorbell PTT page).
 #   -> Rule required + `import authelia` in Caddy.
 #   -> Authelia is the ONLY login. Use two_factor for hardware-control pages.
@@ -104,7 +106,7 @@ access_control:
   rules:
 
     # The Authelia portal itself is always bypass.
-    - domain: 'auth.example.com'                # CHANGE
+    - domain: 'auth.{{ env "DOMAIN" }}'
       policy: 'bypass'
 
     # -------------------------------------------------------------------
@@ -112,24 +114,24 @@ access_control:
     # The Pi doorbell PTT page has no built-in authentication.
     # two_factor is appropriate -- this URL controls a speaker in your house.
     # -------------------------------------------------------------------
-    # - domain: 'doorbell.example.com'          # CHANGE
+    # - domain: 'doorbell.{{ env "DOMAIN" }}'
     #   policy: 'two_factor'
 
     # -------------------------------------------------------------------
     # CASE 2: App supports trusted-header proxy auth -- replace app login.
-    # Frigate 0.14+: set `auth.enabled: False` and configure `proxy:` in
-    # frigate_config/config.yml (see README.md "Switching Frigate to Authelia").
-    # Single login: Authelia authenticates, Frigate reads Remote-User/Groups.
+    # Frigate: set auth.enabled: False and configure proxy: in
+    # frigate_config/config.yml (see README.md). Authelia handles login
+    # and passes Remote-User/Remote-Groups to Frigate for role mapping.
     # -------------------------------------------------------------------
-    # - domain: 'cam.example.com'               # CHANGE
+    # - domain: 'cam.{{ env "DOMAIN" }}'
     #   policy: 'two_factor'
 
     # -------------------------------------------------------------------
     # CASE 3: App keeps its own auth; Authelia adds a 2FA gate in front.
-    # The app's login form is still shown after Authelia passes the request.
-    # User logs into Authelia (2FA) then into the app separately.
+    # User authenticates with Authelia (2FA) then with the app itself.
+    # Add entries for any extra-gated domains here.
     # -------------------------------------------------------------------
-    # - domain: 'nas.example.com'               # CHANGE/REMOVE example
+    # - domain: 'nas.{{ env "DOMAIN" }}'
     #   policy: 'two_factor'
 
     # CASE 4: No rule here, no `import authelia` in Caddy. App handles auth.
@@ -138,9 +140,9 @@ session:
   # secret loaded via AUTHELIA_SESSION_SECRET_FILE
   cookies:
     - name: 'authelia_session'
-      domain: 'example.com'                          # CHANGE: your root domain
-      authelia_url: 'https://auth.example.com'       # CHANGE
-      default_redirection_url: 'https://example.com' # CHANGE
+      domain: '{{ env "DOMAIN" }}'
+      authelia_url: 'https://auth.{{ env "DOMAIN" }}'
+      default_redirection_url: 'https://{{ env "DOMAIN" }}'
       expiration: '1 hour'
       inactivity: '5 minutes'
       remember_me: '1 month'