apollo.snek.network {
        # Everything EXCEPT the Subsonic API requires Authentik SSO.
        @protected not path /rest/*

        route {
                # Forward outpost traffic directly to Authentik
                reverse_proxy /outpost.goauthentik.io/* https://id.snek.network {
                        header_up Host id.snek.network
                        header_up X-Real-IP {remote_host}
                }

                # Forward auth check — skipped for /rest/*
                forward_auth @protected https://id.snek.network {
                        uri /outpost.goauthentik.io/auth/caddy
                        header_up X-Real-IP {remote_host}
                        header_up Host id.snek.network
                        copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name X-Authentik-Uid
                        trusted_proxies private_ranges
                }

                # Your actual app
                reverse_proxy :4533
        }
}

www.iwannabethevery.best, iwannabethevery.best {
        @discord header User-Agent "Mozilla/5.0 (compatible; Discordbot/2.0; +https://discordapp.com)"
        @notget not method GET
        @notroot not path /

        route {
                abort @discord # Drop Discord to prevent it from crawling and generating an (incorrect) preview which follow the 302
                abort @notget # Drop everything not GET (usual browser behaviour)
                abort @notroot # Drop everything not on root
                reverse_proxy :8090
        }
}

chat.snek.network {
        reverse_proxy :9000
}

www.cola.tf, cola.tf {
        root * /home/cola/http

        handle_errors 404 {
                rewrite * /404.html
        }
        respond /.well-known/atproto-did "did:plc:o2suhoy3k7vt3qffhbkq3xbc" 200
        file_server
}

www.snek.technology, snek.technology {
        root * /home/cola/snek.technology

        handle_errors 404 {
                rewrite * /404.html
        }
        file_server
}

status.snek.network {
        reverse_proxy :3001
}