wip

nixos/server/git.nix

@@ -441,6 +441,24 @@ See:
       replace-notes.headers = {
         customRequestHeaders.Host = "notes-8efb78.pages.eisfunke.com";
       };
+      auth-private-notes.forwardAuth = {
+        # localhost:61022 is the authentik container
+        address = "http://localhost:61022/outpost.goauthentik.io/auth/TODO";
+        trustForwardHeader = true;
+        authResponseHeaders = [
+          "X-authentik-username"
+          "X-authentik-groups"
+          "X-authentik-email"
+          "X-authentik-name"
+          "X-authentik-uid"
+          "X-authentik-jwt"
+          "X-authentik-meta-jwks"
+          "X-authentik-meta-outpost"
+          "X-authentik-meta-provider"
+          "X-authentik-meta-app"
+          "X-authentik-meta-version"
+        ];
+      };
     };
     services = {
       git.loadBalancer.servers = [ { url = "http://localhost:61026"; } ];