From 7d837d7f6dbd7aab495150601a3223214689967c Mon Sep 17 00:00:00 2001
From: Tim <29161710+Tim-Sc@users.noreply.github.com>
Date: Mon, 22 Jul 2024 12:47:02 +0200
Subject: [PATCH] www/caddy: Add authentik auth provider (#4104)

---
 www/caddy/Makefile                            |  2 +-
 www/caddy/pkg-descr                           |  4 ++++
 .../OPNsense/Caddy/forms/authprovider.xml     |  2 +-
 .../mvc/app/models/OPNsense/Caddy/Caddy.xml   |  1 +
 .../OPNsense/Caddy/includeAuthProvider        | 24 +++++++++++++++----
 5 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/www/caddy/Makefile b/www/caddy/Makefile
index cde2e3915..1c2aedae1 100644
--- a/www/caddy/Makefile
+++ b/www/caddy/Makefile
@@ -1,5 +1,5 @@
 PLUGIN_NAME=		caddy
-PLUGIN_VERSION=		1.6.1
+PLUGIN_VERSION=		1.6.2
 PLUGIN_DEPENDS=		caddy-custom
 PLUGIN_COMMENT=		Easy to configure Reverse Proxy with Automatic HTTPS and Dynamic DNS
 PLUGIN_MAINTAINER=	cedrik@pischem.com
diff --git a/www/caddy/pkg-descr b/www/caddy/pkg-descr
index 7ef7b776b..4c2b95605 100644
--- a/www/caddy/pkg-descr
+++ b/www/caddy/pkg-descr
@@ -25,6 +25,10 @@ DOC: https://docs.opnsense.org/manual/how-tos/caddy.html
 Plugin Changelog
 ================
 
+1.6.2
+
+* Add Authentik as authentication provider (contributed by Tim-Sc)
+
 1.6.1
 
 Add: Run Caddy as "www" user and group, by enabling "Disable Superuser" in General Settings.
diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/authprovider.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/authprovider.xml
index 1790ceda4..29527af13 100644
--- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/authprovider.xml
+++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/authprovider.xml
@@ -3,7 +3,7 @@
         <id>caddy.general.AuthProvider</id>
         <label>Forward Auth Provider</label>
         <type>dropdown</type>
-        <help><![CDATA[Select a Forward Auth Provider. It can be added inside a "Handler" by enabling the "Forward Auth" checkbox. For Authelia only the basic subdomain example is supported. More information: https://www.authelia.com/integration/proxies/caddy/#basic-examples]]></help>
+        <help><![CDATA[Select a Forward Auth Provider. It can be added inside a "Handler" by enabling the "Forward Auth" checkbox. For Authelia only the basic subdomain example is supported. More information: https://www.authelia.com/integration/proxies/caddy/#basic-examples. For Authentik custom headers are not supported. More information: https://docs.goauthentik.io/docs/providers/proxy/server_caddy]]></help>
     </field>
     <field>
         <id>caddy.general.AuthToDomain</id>
diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
index c5f3474de..38cec5fc2 100644
--- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
+++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
@@ -129,6 +129,7 @@
                 <BlankDesc>None (default)</BlankDesc>
                 <OptionValues>
                     <authelia>Authelia</authelia>
+                    <authentik>Authentik</authentik>
                 </OptionValues>
             </AuthProvider>
             <AuthToDomain type="HostnameField"/>
diff --git a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeAuthProvider b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeAuthProvider
index 4bf4b09ef..8dd207f85 100644
--- a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeAuthProvider
+++ b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeAuthProvider
@@ -2,12 +2,28 @@
 # This file gets imported to configure forward auth in handlers.
 # - Section: Reverse Proxy Configurations
 #}
-{% if generalSettings.AuthProvider == 'authelia' %}
+{% if generalSettings.AuthProvider %}
     {# Check if the domain is IPv6 and wrap in square brackets if necessary #}
     {% set is_ipv6 = (':' in generalSettings.AuthToDomain and generalSettings.AuthToDomain.count(':') >= 2) %}
-    forward_auth {% if generalSettings.AuthToTls|default("0") == "1" %}https://{% endif %}{{ '[' if is_ipv6 else '' }}{{ generalSettings.AuthToDomain|default("") }}{{ ']' if is_ipv6 else '' }}{% if generalSettings.AuthToPort %}:{{ generalSettings.AuthToPort }}{% endif %} {
-    {% if generalSettings.AuthToUri %}uri {{ generalSettings.AuthToUri|default("") }}{% endif %}
-
+    {% set auth_url = (generalSettings.AuthToTls|default("0") == "1" and 'https://' or 'http://') + (is_ipv6 and '[' or '') + generalSettings.AuthToDomain|default("") + (is_ipv6 and ']' or '') + (generalSettings.AuthToPort and ':' + generalSettings.AuthToPort or '') %}
+{% endif %}
+{% if generalSettings.AuthProvider == 'authelia' %}
+    forward_auth {{ auth_url }} {
+    {% if generalSettings.AuthToUri %}
+        uri {{ generalSettings.AuthToUri|default("") }}
+    {% endif %}
     copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
     }
+{% elif generalSettings.AuthProvider == 'authentik' %}
+    reverse_proxy /outpost.goauthentik.io/* {{ auth_url }} {
+    {% if generalSettings.AuthToTls|default("0") == "1" %}
+        header_up Host {http.reverse_proxy.upstream.hostport}
+    {% endif %}
+    }
+    forward_auth {{ auth_url }} {
+    {% if generalSettings.AuthToUri %}
+        uri {{ generalSettings.AuthToUri|default("") }}
+    {% endif %}
+    copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
+    }
 {% endif %}