1# --- define once, top of Caddyfile ---
 2(sso) {
 3        handle /.sso/* {
 4                reverse_proxy unix//run/authsvc/http.sock
 5        }
 6        @sso_protected not path /.sso/*
 7        forward_auth @sso_protected unix//run/authsvc/http.sock {
 8                uri /authz?require={args[0]}
 9                copy_headers Remote-User Remote-Groups Remote-Name
10        }
11        request_header @sso_protected -Remote-Email
12        request_header @sso_protected Cookie "(?:^|;)\s*__Host-authsvc_[^;]*" ""
13        request_header @sso_protected Cookie "^;\s*" ""
14}
15(sso_any) {
16        handle /.sso/* {
17                reverse_proxy unix//run/authsvc/http.sock
18        }
19        @sso_protected not path /.sso/*
20        forward_auth @sso_protected unix//run/authsvc/http.sock {
21                uri /authz
22                copy_headers Remote-User Remote-Groups Remote-Name
23        }
24        request_header @sso_protected -Remote-Email
25        request_header @sso_protected Cookie "(?:^|;)\s*__Host-authsvc_[^;]*" ""
26        request_header @sso_protected Cookie "^;\s*" ""
27}