# =============================================================================
# Authelia + Caddy integration snippets
#
# Merge these blocks into your real Caddyfile (typically the one your
# dockerized Caddy mounts from its own ~/docker/caddy/ folder). Reload Caddy
# after editing:
#   docker compose -f ~/docker/caddy/docker-compose.yml exec caddy \
#     caddy reload --config /etc/caddy/Caddyfile
#
# Requires:
#   - Caddy v2.5.1 or newer
#   - Caddy joined to the external `caddy_net` docker network so it can
#     resolve `authelia` by container name
#   - access_control.rules in authelia/configuration.yml have an entry
#     for each protected domain (otherwise Authelia's default_policy of
#     `deny` will refuse access)
# =============================================================================

# -----------------------------------------------------------------------------
# Reusable forward_auth snippet -- import into any site you want gated.
# -----------------------------------------------------------------------------
(authelia) {
    forward_auth authelia:9091 {
        uri /api/authz/forward-auth
        copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
    }
}

# -----------------------------------------------------------------------------
# Caddy access logging -- fail2ban needs JSON access logs at a host path
# both Caddy and fail2ban can see. Mount /var/log/caddy in BOTH compose
# files (Caddy as rw, fail2ban as ro). The roll directives keep it bounded.
# -----------------------------------------------------------------------------
(accesslog) {
    log {
        output file /var/log/caddy/access.log {
            roll_size     10MiB
            roll_keep     5
            roll_keep_for 720h
        }
        format json
    }
}

# -----------------------------------------------------------------------------
# Authelia login portal -- bypass policy in access_control.rules
# -----------------------------------------------------------------------------
auth.example.com {
    import accesslog
    reverse_proxy authelia:9091
}

# -----------------------------------------------------------------------------
# Example: gate cam.example.com (Frigate UI on a different VLAN/host)
# Per-domain policy lives in authelia/configuration.yml, NOT here.
# -----------------------------------------------------------------------------
cam.example.com {
    import accesslog
    import authelia
    reverse_proxy 192.168.x.x:8971 {
        transport http {
            read_timeout  60s
            write_timeout 60s
        }
    }
}

# -----------------------------------------------------------------------------
# Example: gate doorbell.example.com (Pi PTT page + same-origin Frigate proxy)
# -----------------------------------------------------------------------------
doorbell.example.com {
    import accesslog
    import authelia

    handle_path /frigate/* {
        reverse_proxy 192.168.x.x:8971 {
            transport http {
                read_timeout  60s
                write_timeout 60s
            }
        }
    }

    handle {
        reverse_proxy 192.168.x.x:5555
    }
}