# Traefik ForwardAuth → Authelia (fleet SSO).
# Pattern: net-kingdom sso-mfa Authelia at auth.coulomb.social
# ACTIVITY-WP-0025
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: authelia-forwardauth
  namespace: activity-core
  labels:
    app.kubernetes.io/name: activity-core
    app.kubernetes.io/part-of: activity-core
    app.kubernetes.io/component: sso
spec:
  forwardAuth:
    # rd= sends the browser to the Authelia login portal when unauthenticated.
    address: http://authelia.sso.svc.cluster.local:9091/api/verify?rd=https://auth.coulomb.social/
    trustForwardHeader: true
    authResponseHeaders:
      - Remote-User
      - Remote-Groups
      - Remote-Name
      - Remote-Email