Runner updated and eurovote

modules/caddy.nix

@@ -42,19 +42,16 @@ let
 
   # Reusable Authelia forward_auth snippet
   # Returns a Caddyfile snippet block that applies forward_auth.
+  # Uses the v4.38+ /api/authz/forward-auth endpoint which correctly honours
+  # one_factor policy without forcing TOTP enrollment on new users.
   # copy_headers makes Authelia's Remote-* headers available downstream.
   autheliaForwardAuth = ''
     forward_auth localhost:9091 {
-      uri /api/verify?rd=https://auth.${domain}
+      uri /api/authz/forward-auth?authelia_url=https://auth.${domain}
       copy_headers Remote-User Remote-Name Remote-Groups Remote-Email
       # Always tell Authelia the scheme is https (cloudflared terminates TLS
       # externally; Caddy's http:// vhosts are only for the tunnel loopback).
       header_up X-Forwarded-Proto https
-      # On auth failure, redirect to the authelia login page
-      @goauth status 401
-      handle_response @goauth {
-        redir https://auth.${domain}?rm={method} 302
-      }
     }
   '';
 
@@ -236,6 +233,30 @@ in
           extraConfig = cfProxy 2586;
         };
 
+        # ------------------------------------------------------------------
+        # Eurovision Vote — one_factor for all authenticated users.
+        # /admin/* is restricted to group:admins by Authelia access_control.
+        # Caddy passes Remote-User → X-Remote-User so Django auto-logs in
+        # the SSO-authenticated user via RemoteUserMiddleware.
+        # ------------------------------------------------------------------
+        "eurovision-vote.${domain}" = {
+          extraConfig = ''
+            ${autheliaForwardAuth}
+            reverse_proxy localhost:8007 {
+              header_up X-Remote-User {http.request.header.Remote-User}
+            }
+          '';
+        };
+        "http://eurovision-vote.${domain}" = {
+          extraConfig = ''
+            ${autheliaForwardAuth}
+            reverse_proxy localhost:8007 {
+              header_up X-Forwarded-Proto https
+              header_up X-Remote-User {http.request.header.Remote-User}
+            }
+          '';
+        };
+
         # ------------------------------------------------------------------
         # Grafana — two_factor, admins only (enforced by authelia policy).
         # After Authelia verifies the user, Caddy maps the Remote-User header