apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: authentik-forward-auth
  namespace: monitoring # adjust as needed
spec:
  forwardAuth:
    address: http://ak-outpost-authentik-embedded-outpost.auth.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
    trustForwardHeader: true
    authResponseHeaders:
      - X-Authentik-Username
      - X-Authentik-Groups
      - X-Authentik-Email
    authRequestHeaders:
      - Accept
      - Cookie
      - Host
      - X-Forwarded-For
      - X-Forwarded-Host
      - X-Forwarded-Proto
      - X-Forwarded-Uri
      - X-Forwarded-Port
      - X-Forwarded-Method
    # Add these to handle redirect
    authResponseHeadersRegex: "X-.*"