From a8172324b7a4da01dd8b66dbfb4c0882836b198b Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Mon, 15 Jun 2026 09:49:53 +0000
Subject: [PATCH] feat(proxy): NextWks proxies /auth/* to Authelia internally

---
 src/main.go | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/main.go b/src/main.go
index 1d406b5..58288e5 100644
--- a/src/main.go
+++ b/src/main.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"log/slog"
 	"net/http"
+	"net/http/httputil"
 	"net/url"
 	"os"
 	"os/signal"
@@ -107,6 +108,23 @@ func main() {
 	// Setup HTTP router
 	mux := http.NewServeMux()
 
+	// Reverse proxy: /auth/* → Authelia (except /auth/callback)
+	autheliaProxy := httputil.NewSingleHostReverseProxy(&url.URL{
+		Scheme: "http",
+		Host:   fmt.Sprintf("%s:%d", "127.0.0.1", 9091),
+	})
+	mux.HandleFunc("GET /auth/", func(w http.ResponseWriter, r *http.Request) {
+		// Skip /auth/callback and /auth/login /auth/logout — handled by NextWks
+		if r.URL.Path == "/auth/callback" || r.URL.Path == "/auth/login" || r.URL.Path == "/auth/logout" {
+			http.NotFound(w, r)
+			return
+		}
+		autheliaProxy.ServeHTTP(w, r)
+	})
+	mux.HandleFunc("POST /auth/", func(w http.ResponseWriter, r *http.Request) {
+		autheliaProxy.ServeHTTP(w, r)
+	})
+
 	// --- Public endpoints ---
 	mux.HandleFunc("GET /api/health", func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")