Clarify authentication proxies

website/Authentication Proxy.md

@@ -0,0 +1,8 @@
+In case you would like to run SilverBullet behind an authentication proxy (such as Authelia, Authentik or the ones integrated with Cloudflare Zero Trust or Pangolin) there is one key configuration tweak you need to make:
+
+**You must exclude a few paths from authentication**. If you don’t do this a lot of PWA functionality may not work and SilverBullet may break in unexpected ways. Doing this is perfectly safe, it just gives browsers unauthorized access to some client code, not any of your content.
+
+In your configuration add **rules to allow unauthenticated access** for the following paths:
+
+* `/service_worker.js`
+* `/.client/*`

website/Authentication.md

@@ -9,3 +9,5 @@ docker run -e SB_USER=pete:1234 ...
 Will let `pete` authenticate with password `1234`. 
 
 For more options see [[Install/Configuration]].
+
+Alternatively, or in addition, you can also use an [[Authentication Proxy]].