# Authenticated external access

DockDeck has no built-in authentication. Keep its Compose bind on `127.0.0.1` or a trusted LAN address unless an authenticated HTTPS reverse proxy protects every route.

## Recommended topology

```text
Internet -> HTTPS reverse proxy -> Authentik forward auth -> DockDeck :1218
Trusted LAN -----------------------------------------------> DockDeck :1218
```

## Minimum requirements

1. Terminate TLS with a valid certificate.
2. Require authentication before proxying `/`, static assets and every `/api/*` route.
3. Do not create an unauthenticated exception for `/api/diagnostics`, integration settings or exports.
4. Preserve the original host and forwarding headers.
5. Restrict the upstream to `http://192.168.10.150:1218`; never publish the internal Docker socket proxy.
6. Use a separate minimum-scope account/token for each provider and protect `/data/integrations.env` backups.

## Validation checklist

- An incognito request is redirected to authentication before DockDeck HTML or API JSON is returned.
- A signed-in user can load the dashboard, search, edit a harmless presentation preference and read diagnostics.
- Signing out invalidates both page and API access.
- The browser reports HTTPS without mixed content.
- The reverse proxy does not cache `/api/*` responses.

Nginx Proxy Manager discovery in DockDeck remains read-only and does not create or change proxy hosts. Proxy and Authentik configuration therefore stay an explicit deployment responsibility.