# Global options
{
    email {TLS_EMAIL}
    admin off
}

# Authelia OIDC provider
auth.{DOMAIN} {
    reverse_proxy 127.0.0.1:9091
}

# Main workspace (forward auth with Authelia)
app.{DOMAIN} {
    # Forward auth to Authelia verify endpoint
    forward_auth 127.0.0.1:9091 {
        uri /api/verify?rd=https://auth.{DOMAIN}/

        # Copy auth headers to upstream
        copy_headers Remote-User Remote-Name Remote-Email Remote-Groups
    }

    # Serve launcher + proxy upstream apps
    reverse_proxy 127.0.0.1:9000
}

# Public landing page
www.{DOMAIN} {
    root * /opt/nextworkspace/www
    file_server
}