navidrome.tournesol.me {
   # Remove any client-supplied user header
	request_header -X-Auth-Request-Preferred-Username

	@protected not path /share/* /rest/*
	handle @protected {
		import oauth2_forwardauth
	}
	reverse_proxy navidrome:4533
}