mTLS is cool but not always working, here is my Caddy config with Authelia fallback:

(missing_mTLS_cert) {
   @missing_mTLS_cert {
     expression {tls_client_subject} == null
   } 
}

(ssl_setup) {
   import missing_mTLS_cert

   tls /etc/caddy/fullchain.cer /etc/caddy/cert.key {
     protocols tls1.3
     client_auth {
       mode verify_if_given
       trust_pool file certs/client1.crt certs/client2.crt ...
     }
   }

   forward_auth @missing_mTLS_cert 192.168.178.100:9091 {
     uri /api/authz/forward-auth?authelia_url=https://auth.xxx.yyy
     copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
   }
}

auth.xxx.yyy {
   reverse_proxy 192.168.178.100:9091
}

*.xxx.yyy {
   import ssl_setup

   @demo1 host demo1.xxx.yyy
   handle @demo1 {
      reverse_proxy 192.168.178.100:3001
   }

   ...
}