diff --git a/clanServices/zitadel/default.nix b/clanServices/zitadel/default.nix
index 7edf795..441fd33 100644
--- a/clanServices/zitadel/default.nix
+++ b/clanServices/zitadel/default.nix
@@ -129,6 +129,23 @@ in
             }
           ];
         };
+
+        services.caddy = {
+          enable = true;
+          virtualHosts = {
+            "auth.amarth.cloud".extraConfig = ''
+              reverse_proxy h2c://127.0.0.1:9092
+            '';
+          };
+          extraConfig = ''
+            (auth-z) {
+              forward_auth h2c://127.0.0.1:9092 {
+                uri /api/authz/forward-auth
+                copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
+              }
+            }
+          '';
+        };
       };
     };
   };