From 04e84fde7aa82ca7e5261272db3cb370770f40e8 Mon Sep 17 00:00:00 2001 From: Goyban Date: Thu, 3 Sep 2026 14:27:22 +0200 Subject: [PATCH] docs: explain the proxy target address in the forward auth example --- docs/authentik-sso.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/docs/authentik-sso.md b/docs/authentik-sso.md index 5dd8417..3cc9247 100644 --- a/docs/authentik-sso.md +++ b/docs/authentik-sso.md @@ -114,6 +114,13 @@ firefly.domain.com { Only the last line changes per service: swap the address and port, and the hostname at the top. Everything between is identical for every app. +`10.10.0.2` there is a **private address, not a public one** — in this setup a +WireGuard host, so Caddy reaches the app over the tunnel rather than across the +internet. Whatever address your proxy uses to reach the service goes there: a +LAN IP, a WireGuard or Tailscale peer, or a container name if Caddy runs in the +same Compose project. The only requirement is that Caddy can reach it and the +outside world can't. + ### Why each piece is there **`route { }` is not optional.** Caddy normally executes directives in its own