Authentik Logs:

INF auth_via=unauthenticated domain_url=authentik.domain.com/event=/application/o/authorize/?client_id=XXX&redirect_uri=https%3A%2F%service.domain.com/%2Foutpost.goauthentik.io%2Fcallback%3FX-authentik-auth-callback%3Dtrue&response_type=code&scope=openid+ak_proxy+entitlements+email+profile&state=XXX.c_AtVKLhD_75i5aZd1m_7a06qNngdhvx5L9wa-F6iDI host=authentik.domain.com logger=authentik.asgi method=GET pid=66 request_id=d842acd107624f82862a5301bfa4def2 runtime=89 schema_name=public scheme=https status=302 timestamp=2025-10-01T21:12:37.950940 user= user_agent=Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0
warning error=NOAUTH Authentication required. event=failed to save session logger=authentik.outpost.proxyv2.application name=Provider for navidrome-proxy timestamp=2025-10-01T16:12:43-05:00
INF event=/outpost.goauthentik.io/auth/traefik host=service.domain.com logger=authentik.outpost.proxyv2.application method=GET name=Provider for navidrome-proxy  runtime=10.585 scheme=http size=749 status=302 timestamp=2025-10-01T16:12:43-05:00 user_agent=Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0
DBG auth_via=unauthenticated domain_url=authentik.domain.com event=Not buffering request, no flow plan active host=authentik.domain.com logger=authentik.policies.views pid=67 request_id=XXX schema_name=public timestamp=2025-10-01T21:12:44.057710
INF auth_via=unauthenticated domain_url=authentik.domain.com event=/application/o/authorize/?client_id=XXX=https%3A%2Fauthentik.domain.com%2Foutpost.goauthentik.io%2Fcallback%3FX-authentik-auth-callback%3Dtrue&response_type=code&scope=openid+ak_proxy+entitlements+email+profile&state=XXX.G53sxTh00iexFsDqVpLEB5JCzpz66lStBIkQwXeCIvg host=auth.mcpc.cloud logger=authentik.asgi method=GET pid=67 request_id=X runtime=193 schema_name=public scheme=https status=302 timestamp=2025-10-01T21:12:44.144102 user= user_agent=Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0

Service labels:

- "traefik.enable=true"
- "traefik.http.routers.navidrome.rule=Host(`service.domain.com`)"
- "traefik.http.routers.navidrome.entrypoints=websecure"
- "traefik.http.routers.navidrome.tls=true"
- "traefik.http.routers.navidrome.tls.certresolver=cloudflare"
- "traefik.http.routers.navidrome.middlewares=authentik@file"
- "traefik.http.routers.navidrome-subsonic.entrypoints=websecure"
# - "traefik.http.services.navidrome.loadbalancer.server.port=4533"
# Unauthenticated paths router
- "traefik.http.routers.navidrome-api.entrypoints=websecure"
- "traefik.http.routers.navidrome-api.rule=Host(`service.domain.com`) && PathPrefix(`/api`,`/stream`)"
- "traefik.http.routers.navidrome-api.tls=true"
- "traefik.http.routers.navidrome-api.tls.certresolver=cloudflare"
- "traefik.http.routers.navidrome-api.middlewares="  # no Authentik middleware

Authentik Middleware file
http:
middlewares:
authentik:
forwardAuth:
address: http://authentik-nas-server:9000/outpost.goauthentik.io/auth/traefik
trustForwardHeader: true
authResponseHeaders:
- X-authentik-username
- X-authentik-groups
- X-authentik-entitlements
- X-authentik-email
- X-authentik-name
- X-authentik-uid
- X-authentik-jwt
- X-authentik-meta-jwks
- X-authentik-meta-outpost
- X-authentik-meta-provider
- X-authentik-meta-app
- X-authentik-meta-version