Forward Auth mode
As a Ghost operator, I want to protect the /ghost path with my existing forward-auth infrastructure so that authorized staff members can sign in using their existing identity while unauthorized users cannot reach the administration interface.
This protects Ghost Admin at the reverse-proxy level while NiceOAuth connects the authenticated external identity to the corresponding Ghost staff account.
User outcome
An operator can place Ghost behind a supported forward-auth setup and use NiceOAuth to authenticate existing Ghost staff accounts.
Authorized staff members can access Ghost Admin without entering separate Ghost credentials. Users who are unauthenticated, unauthorized, or do not have a matching Ghost staff account are rejected safely.
Success criteria
- An authorized staff member can sign in to an existing Ghost staff account through the external authentication system.
- The staff member does not need to enter separate Ghost credentials.
- Unauthenticated users cannot reach Ghost Admin.
- Unauthorized users cannot reach Ghost Admin.
- Users without a matching Ghost staff account are not granted access.
- A user cannot gain access by supplying forged identity headers.
- Removing external access prevents subsequent access to Ghost Admin.
- An operator can deploy and verify the setup using the project documentation.
- A working Caddy and Authelia example is documented and explained in detail.
Scope boundary
This milestone covers authentication through an existing forward-auth system and protection of Ghost Admin at the reverse-proxy level.
It does not cover:
- independent JWT verification
- a native OIDC login flow
- automatic Ghost user creation
- Ghost role synchronization
- automatic account deprovisioning
