# Global options
{
    email {TLS_EMAIL}
    admin off
}

# Authelia OIDC provider
auth.{DOMAIN} {
    reverse_proxy authelia:9091
}

# Main workspace (forward auth with Authelia)
app.{DOMAIN} {
    forward_auth authelia:9091 {
        uri /api/verify?rd=https://auth.{DOMAIN}/
        copy_headers Remote-User Remote-Name Remote-Email Remote-Groups
    }
    reverse_proxy launcher:9000
}

# Public landing page
www.{DOMAIN} {
    root * /opt/nextworkspace/www
    file_server
}