# NPM Forward Auth Configuration Files

This directory contains Nginx configuration snippets for Nginx Proxy Manager (NPM) forward authentication with Authentik.

## Deployment Strategy

Services to protect with forward auth (in order):
1. Core API (api.schweitz.net) - Use OIDC instead of forward auth
2. Nextcloud (cloud.schweitz.net)
3. Gitea (git.schweitz.net)
4. Jellyfin (media.schweitz.net)
5. Open WebUI, etc.

**Rule:** Deploy to ONE service at a time, test for 24 hours before proceeding to next.

## Important Notes

### Services That Should NOT Have Forward Auth
- ❌ **auth.schweitz.net** - The Authentik server itself (causes redirect loops)
- ❌ **Any service not listed in the gradual rollout plan**

### Before Applying Configuration
1. Create backup of NPM database
2. Have rollback procedure ready
3. Test in incognito window first
4. Monitor logs actively

## Configuration Template Structure

All forward auth configs follow this structure:

```nginx
# 1. Buffer sizes (required for large auth headers)
proxy_buffers 8 16k;
proxy_buffer_size 32k;

# 2. Auth request directive
auth_request /outpost.goauthentik.io/auth/nginx;
error_page 401 = @goauthentik_proxy_signin;

# 3. Capture auth response headers
auth_request_set $auth_cookie $upstream_http_set_cookie;
# ... (other headers)

# 4. Forward headers to application
add_header Set-Cookie $auth_cookie;
proxy_set_header X-authentik-username $authentik_username;
# ... (other headers)

# 5. Outpost proxy location
location /outpost.goauthentik.io {
    proxy_pass https://authentik-proxy:9443/outpost.goauthentik.io;
    # ... (proxy settings)
}

# 6. Signin redirect handler
location @goauthentik_proxy_signin {
    internal;
    return 302 https://auth.schweitz.net/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
}
```

## Monitoring During Rollout

After applying forward auth to any service, monitor:

1. **Authentik Proxy Logs:**
   ```bash
   docker logs authentik-proxy -f
   ```

2. **NPM Logs:**
   ```bash
   docker logs npm -f
   ```

3. **Service-Specific Logs:**
   ```bash
   docker logs <service-name> -f
   ```

4. **Memory Usage:**
   ```bash
   docker stats authentik-proxy --no-stream
   ```

## Success Criteria

Before proceeding to next service:
- ✅ No redirect loops
- ✅ Authentication works consistently
- ✅ Logout works correctly
- ✅ No errors in logs
- ✅ No memory leaks or performance issues
- ✅ SSO cookie persists across sessions

## Rollback Procedure

If issues occur with ANY service:
1. Edit the proxy host in NPM
2. Go to Advanced tab
3. Delete the forward auth configuration
4. Save
5. Service will be accessible without authentication again
6. Investigate logs and fix issues before re-applying

---

**Last Updated:** 2025-11-21
**Authentik Version:** 2024.8.4
**Outpost Type:** Standalone (authentik-proxy container)