Add Authelia configuration and secrets management

caddy.nix

@@ -2,11 +2,20 @@
 {
   services.caddy = {
     enable = true;
-    email = "admin@srazka.com"; # Replace with your actual email
+    email  = "admin@srazka.com";
 
-    # The new hello container
+    # Authelia's own login portal
+    virtualHosts."auth.srazka.com".extraConfig = ''
+      reverse_proxy 127.0.0.1:9091
+    '';
+
+    # Every protected site uses this snippet
     virtualHosts."hello.srazka.com".extraConfig = ''
+      forward_auth 127.0.0.1:9091 {
+        uri /api/authz/forward-auth
+        copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
+      }
       reverse_proxy 192.168.100.11:80
     '';
   };
-}
+}