navidrome: use authentik

docker-compose.yml

@@ -334,8 +334,6 @@ services:
   navidrome:
     image: deluan/navidrome:0.61.2
     container_name: navidrome
-    ports:
-      - "${NAVIDROME_EXTERNAL_PORT}:${NAVIDROME_INTERNAL_PORT}"
     env_file:
       - navidrome.env
     user: "${PUID}:${PGID}"
@@ -347,7 +345,10 @@ services:
         ipv4_address: 192.168.240.14
     labels:
       caddy: music.${DOMAIN_LOCAL}
-      caddy.reverse_proxy: "{{ upstreams $NAVIDROME_INTERNAL_PORT }}"
+      caddy.reverse_proxy: "{{ upstreams 4533 }}"
+      caddy.forward_auth: "authentik-server:9000"
+      caddy.forward_auth.uri: "/outpost.goauthentik.io/auth/caddy"
+      caddy.forward_auth.copy_headers: "X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name"
     restart: unless-stopped
 
   maloja: