≫ intranet.raab.cc:443/ { ≪

    # forward authentication to outpost
    forward_auth authentik-server-1 {
        uri /outpost.goauthentik.io/auth/intranet

        # capitalization of headers
        copy_headers X-Authentik-Email

        # in this config trust all private ranges only
        trusted_proxies private_ranges
    }
    # always forward outpost path to actual outpost
    reverse_proxy /outpost.goauthentik.io/* authentik-server-1

    # actual site configuration below, for example
    reverse_proxy intranet:80
}