fix(auth): align service SSO routing

gitea/compose.yml

@@ -33,9 +33,15 @@ services:
       GITEA__database__HOST: db:5432
       GITEA__database__NAME: giteadb
       GITEA__database__USER: gitea
+      GITEA__server__PROTOCOL: http
+      GITEA__server__DOMAIN: gitea.xiteng.site
+      GITEA__server__ROOT_URL: https://gitea.xiteng.site/
       GITEA__server__SSH_PORT: 22
       GITEA__server__SSH_LISTEN_PORT: 22
       GITEA__server__SSH_DOMAIN: git.xiteng.site
+      GITEA__service__ENABLE_PASSWORD_SIGNIN_FORM: "false"
+      GITEA__service__ENABLE_BASIC_AUTHENTICATION: "false"
+      GITEA__service__ENABLE_PASSKEY_AUTHENTICATION: "false"
     volumes:
       - ./data:/data
       - ./custom/extra_links.tmpl:/data/gitea/templates/custom/extra_links.tmpl:ro
@@ -48,10 +54,14 @@ services:
       - "traefik.http.routers.gitea.rule=Host(`gitea.xiteng.site`)"
       - "traefik.http.services.gitea.loadbalancer.server.port=3000"
       - "traefik.http.routers.gitea.entrypoints=websecure"
+      - "traefik.http.routers.gitea.middlewares=gitea-scheme"
       # --- HTTP 入口（来自 cloudflared tunnel）---
       - "traefik.http.routers.gitea-http.rule=Host(`gitea.xiteng.site`)"
       - "traefik.http.routers.gitea-http.service=gitea"
       - "traefik.http.routers.gitea-http.entrypoints=web"
+      - "traefik.http.routers.gitea-http.middlewares=gitea-scheme"
+      # --- 中间件：强制 X-Forwarded-Proto（Cloudflare Tunnel 用 HTTP 连 Traefik，但用户端是 HTTPS）---
+      - "traefik.http.middlewares.gitea-scheme.headers.customrequestheaders.X-Forwarded-Proto=https"
       # --- 开启 TLS 并指定解析器 ---
       - "traefik.http.routers.gitea.tls=true"
       - "traefik.http.routers.gitea.tls.certresolver=cfresolver"

hedgedoc2/compose.yml

@@ -23,11 +23,7 @@ services:
       - HD_AUTH_OIDC_AUTHENTIK_CLIENT_ID=hedgedoc2
       - HD_AUTH_OIDC_AUTHENTIK_CLIENT_SECRET=hedgedoc2-secret-9
       - HD_AUTH_OIDC_AUTHENTIK_PROVIDER_NAME=Authentik
-      - HD_AUTH_OIDC_AUTHENTIK_AUTHORIZE_URL=https://auth.xiteng.site/application/o/authorize/
-      - HD_AUTH_OIDC_AUTHENTIK_TOKEN_URL=https://auth.xiteng.site/application/o/token/
-      - HD_AUTH_OIDC_AUTHENTIK_USERINFO_URL=https://auth.xiteng.site/application/o/userinfo/
-      - HD_AUTH_OIDC_AUTHENTIK_END_SESSION_URL=https://auth.xiteng.site/application/o/hedgedoc2/end-session/
-      - HD_AUTH_LOCAL_ENABLE_LOGIN=true
+      - HD_AUTH_LOCAL_ENABLE_LOGIN=false
       # Permissions
       - HD_NOTE_PERMISSIONS_DEFAULT_EVERYONE=write
       # Media

traefik/compose.yml

@@ -43,7 +43,10 @@ services:
       - "xiteng.site.component.traefik.accent=red"
       - "xiteng.site.component.traefik.order=110"
     networks:
-      - homelab_net
+      homelab_net:
+        aliases:
+          # Keep server-to-server Authentik traffic inside the Docker network.
+          - auth.xiteng.site
 
 networks:
   homelab_net: