fix: fix x-forwarded-proto borked by authentik

config/proxy-traefik.nix

@@ -175,6 +175,10 @@ in
                 "Remote-Name"
               ];
             };
+            fix-headers.headers.customRequestHeaders = {
+              X-Forwarded-Proto = "https";
+              X-Forwarded-Ssl = "on";
+            };
             matrix-wellknown-mw = {
               plugin = {
                 staticResponse = {
@@ -204,7 +208,13 @@ in
                         );
                         service = "${d.subdomain}-service";
                         entryPoints = [ "websecure" ];
-                        middlewares = if (d.auth) then [ "authentik" ] else [ ];
+                        middlewares =
+                          if (d.auth) then
+                            [
+                              "authentik"
+                            ]
+                          else
+                            [ ];
                         tls.certResolver = "letsencrypt";
                       };
                     }
@@ -215,7 +225,14 @@ in
                         rule = "Host(`${ct}${dmn}`) " + (if (def.private == true) then internal else "");
                         service = "${ct}-service";
                         entryPoints = [ "websecure" ];
-                        middlewares = if (def.auth) then [ "authentik" ] else [ ];
+                        middlewares =
+                          if (def.auth) then
+                            [
+                              "authentik"
+                              "fix-headers"
+                            ]
+                          else
+                            [ ];
                         tls.certResolver = "letsencrypt";
                       };
                     })