# --- define once, top of Caddyfile ---
(sso) {
        handle /.sso/* {
                reverse_proxy unix//run/authsvc/http.sock
        }
        @sso_protected not path /.sso/*
        forward_auth @sso_protected unix//run/authsvc/http.sock {
                uri /authz?require={args[0]}
                copy_headers Remote-User Remote-Groups Remote-Name
        }
        request_header @sso_protected -Remote-Email
        request_header @sso_protected Cookie "(?:^|;)\s*__Host-authsvc_[^;]*" ""
        request_header @sso_protected Cookie "^;\s*" ""
}
(sso_any) {
        handle /.sso/* {
                reverse_proxy unix//run/authsvc/http.sock
        }
        @sso_protected not path /.sso/*
        forward_auth @sso_protected unix//run/authsvc/http.sock {
                uri /authz
                copy_headers Remote-User Remote-Groups Remote-Name
        }
        request_header @sso_protected -Remote-Email
        request_header @sso_protected Cookie "(?:^|;)\s*__Host-authsvc_[^;]*" ""
        request_header @sso_protected Cookie "^;\s*" ""
}