# allow the pre-auth page to work
preauth.example.com {
	reverse_proxy preauth:9000 {
		header_up X-Forwarded-Uri {uri}
		header_down -X-Powered-By
		rewrite /preauth.php
		transport fastcgi {
			root /preauth/
			split .php
		}
	}
}

# if using caddy v2.9.x+ you can use this snippet
# snippet to put the pre-auth system in front any service easily
(preauth) {
	reverse_proxy {args[0]} preauth:9000 {
		method GET
		header_up X-Forwarded-Uri {uri}
		header_down -X-Powered-By
		rewrite /preauth.php
		transport fastcgi {
			root /preauth/
			split .php
		}
		@preauth_ok status 2xx
		handle_response @preauth_ok {
			copy_response_headers {
				include Set-Cookie Location
			}
			{block}
		}
	}
}

# snippet usage: this will cause preauth to restrict access to
# https://protected.example.com/secure
protected.example.com {
	import preauth /secure {
		reverse_proxy protected-service:9000
	}
	reverse_proxy exposed-service:9000
}