ingress: switch dns hostname to technitium native oidc

ingress/traefik/dynamic/routes.yml

@@ -7,13 +7,20 @@ http:
       middlewares:
         - security-headers
 
+    gitea-authentik-outpost:
+      rule: Host(`gitea.paccoco.com`) && PathPrefix(`/outpost.goauthentik.io/`)
+      priority: 15
+      entryPoints: [web]
+      service: authentik-outpost
+      middlewares:
+        - security-headers
+
     gitea:
       rule: Host(`gitea.paccoco.com`)
       entryPoints: [web]
       service: gitea
       middlewares:
         - security-headers
-        - authelia-forwardauth
 
     grafana:
       rule: Host(`grafana.paccoco.com`)
@@ -28,15 +35,32 @@ http:
       service: technitium
       middlewares:
         - security-headers
-        - authelia-forwardauth
 
-    traefik-dashboard:
-      rule: Host(`traefik.paccoco.com`)
+    traefik-dashboard-authentik-outpost:
+      rule: Host(`traefik.paccoco.com`) && PathPrefix(`/outpost.goauthentik.io/`)
+      priority: 20
+      entryPoints: [web]
+      service: authentik-outpost
+      middlewares:
+        - security-headers
+
+    traefik-dashboard-root:
+      rule: Host(`traefik.paccoco.com`) && Path(`/`)
+      priority: 15
       entryPoints: [web]
       service: api@internal
       middlewares:
         - security-headers
-        - authelia-forwardauth
+        - traefik-dashboard-root-redirect
+
+    traefik-dashboard:
+      rule: Host(`traefik.paccoco.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))
+      priority: 10
+      entryPoints: [web]
+      service: api@internal
+      middlewares:
+        - security-headers
+        - authentik-forwardauth
 
   services:
     authelia:
@@ -44,6 +68,11 @@ http:
         servers:
           - url: http://authelia:9091
 
+    authentik-outpost:
+      loadBalancer:
+        servers:
+          - url: http://authentik-server:9000
+
     gitea:
       loadBalancer:
         servers:
@@ -72,6 +101,29 @@ http:
           - Remote-Name
           - Remote-Email
 
+    authentik-forwardauth:
+      forwardAuth:
+        address: http://authentik-server:9000/outpost.goauthentik.io/auth/traefik
+        trustForwardHeader: true
+        authResponseHeaders:
+          - X-authentik-username
+          - X-authentik-groups
+          - X-authentik-email
+          - X-authentik-name
+          - X-authentik-uid
+          - X-authentik-jwt
+          - X-authentik-meta-jwks
+          - X-authentik-meta-outpost
+          - X-authentik-meta-provider
+          - X-authentik-meta-app
+          - X-authentik-entitlements
+
+    traefik-dashboard-root-redirect:
+      redirectRegex:
+        regex: ^https?://([^/]+)/?$
+        replacement: https://${1}/dashboard/
+        permanent: false
+
     security-headers:
       headers:
         frameDeny: true