caddy-security

Build or troubleshoot portal JSON/native login clients, refresh, Documents, profile and admin APIs, and public JWKS. Use for HTTP contracts; portal Caddyfile wiring belongs to configuration-authentication.

Diagnose caddy-security deployment and runtime failures from configs, logs, versions, and HTTP evidence. Use for focused fixes, unresolved support handoffs, or preparing break-fix issue reports.

Implement or review caddy-security Go code, Caddy modules, parsers, lifecycle, and HTTP delegation. Use for app/plugin boundaries, authcrunch integration, errors, logging, and code conventions.

Build or review caddy-security Caddyfiles and select focused configuration skills. Use for security app declarations and authenticate/authorize route wiring.

Configure authentication portals, backend selection, redirect trust, refresh, Documents storage, and portal wiring. Delegates cookies, UI, transforms, crypto, and OIDC provider details to focused skills.

Configure portal cookie names, prefixes, domains, paths, attributes, and refresh overrides. Use for cookie precedence and coordination with authorization token discovery.

Configure and verify optional cross-device portal login, QR activation, explicit approval, browser binding, cancellation, and lifecycle through Caddy. Native login and external provider configuration retain their own owners.

Configure portal UI templates, static assets, themes, languages, links, and custom CSS/JS/HTML. Use for branding and refresh-aware templates; transform-generated links belong to user transforms.

Configure portal user transforms: matchers, typed claims, role actions, conditional challenges, MFA, and deny rules. Use for authentication-time policy; stored account rules belong to configuration-users.

Configure authorization policies, ACLs, static claims enrichment, required external decisions, bypasses, identity headers, JWT verification, remote Basic/API-key auth, SQLite API keys, and direct OAuth without a portal.

Configure reusable named username/password credentials for messaging consumers, including optional domains and runtime values. LDAP bind credentials belong to identity stores.

Configure portal/policy JWT keys, named access signers, strict access-token profiles, token names and lifetimes, discovery, rotation, and System API encryption keys.

Mount authenticate and authorize handlers, separate portal and protected routes, align auth URLs, and preserve trusted proxy metadata. Use for path conflicts, split hosts, public JWKS, and route ordering.

Configure local, LDAP or SQLite password identity stores, trusted SQLite administration, realms, databases, binds, TLS trust and group mappings. Delegates static local entries to configuration-users.

Configure AuthCrunch diagnostic skip rules, Caddy credential redaction, and logger boundaries. Use for component/message filtering and safe credential diagnostics; authorization outcomes remain unchanged.

Configure email, file and SQLite messaging providers, bounded delivery workers, SMTP transport, sender credentials and registration notifications.

Register named OAuth clients, manage private registration storage, and configure portal OIDC providers. Owns security oauth/oidc provisioning commands; external login providers and security local are separate.

Configure external OAuth/OIDC login providers, credentials, scopes, issuer/audience trust, JWKS, PKCE, portal enablement, and named pending-login storage. Named relying-party registrations and portal OPs belong to OAuth applications.

Configure legacy signup and SQLite email-confirmed enrollment, portal selection, messaging, storage and recovery. OAuth client registration is separate.

Configure and validate Caddy runtime placeholders, secret lookups, encoded instructions, and resolved fixtures. Use to determine which fields resolve and preserve exact values; manager blocks belong to secrets.