The service no longer schedules work itself. POST /api/v1/encyclopedia/run
syncs and runs the encyclopedia; it answers 502 when the run fails or the
text model stopped it, so a CronJob shows a failed run as a failed Job.
The sync loop keeps its startup sync and the webhook trigger; the 30-min
interval is a CronJob calling POST /api/v1/sync.
Removed: EncyclopediaBackgroundService, Encyclopedia RunAt/TimeZone,
Wiki:Sync IntervalSeconds/RetrySeconds.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A scanner hit in the slug or titles, or the German leak check flagging them, makes the article private in both languages. The plan prompt forbids concrete identifiers in titles and slugs and keeps existing titles; prompt version 5.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Nightly schedule (RunAt 06:00, after the 04:30 distill) instead of a
run after every sync. Reconciler never stops the host; catalog
freshness gate; failure memory in articles/_state.json; a missing or
shrunken plan never deletes; translation unit by unit with structure
reassembled by the service; links and listings to private articles
dropped for anonymous readers; media paths validated; in-page 404;
PilotSlugs; Cache-Control no-store; mermaid strict.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Credentials in the wiki are an upstream failure, not a case the
encyclopedia handles: no credential scanner rule, no writer instruction.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The wiki Ingress carries neither dns.renner.uno/public nor
netbird.renner.uno/public; either publishes the host via
netbird-service-sync.
The deterministic leak filter only counts this house's identifiers:
values found in the article's source notes, names under renner.uno, and
credentials. Reserved example values (RFC 5737, RFC 3849, RFC 2606)
never count. Writer and leak-check prompts keep generic examples public.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
wiki.renner.uno has been plain Traefik with in-app OIDC since homelab
2026-10-19; the gate-based two-hostname split no longer applies.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Wikipedia-style, bilingual (de/en) articles generated from the wiki,
with public/private split via Authentik group, LAN/NetBird only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
#14 put the read API behind a session or an API key. External agents
reach the wiki through wiki-index.renner.uno with BasicAuth only, and
since #14 they got 401: a regression.
The service now checks `Authorization: Basic` itself against the same
htpasswd lines Traefik's wiki-api-basic-auth middleware uses
(Auth:Basic:UsersPath: a file, or a mounted Secret directory where every
visible key is read, as Traefik reads every key of an Opaque Secret).
This is a credential check in the service, not trust in a proxy: the
header proves nothing unless the password matches the hash.
- Hash formats Traefik accepts: bcrypt ($2a$/$2b$/$2y$, BCrypt.Net-Next
4.2.1), Apache MD5 ($apr1$, implemented here and checked against the
Traefik docs example and `openssl passwd -apr1`), SHA1 ({SHA}). Any
other format authenticates nobody.
- The identity is a machine named after the BasicAuth user.
- Policy "read" accepts it; "write" stays API-key only, and the UI stays
OIDC only.
- A verified (user, password, hash) triple is cached in memory, so bcrypt
costs once per process.
- With no UsersPath configured the scheme authenticates nobody, so this
image is safe before the deployment mounts the Secret.
Tests: all three hash formats read the API; a wrong password, an unknown
user, an empty password and a user found only in a hidden Secret entry
are 401; BasicAuth cannot write and does not open the UI.
Auth:Oidc:PublicOrigin was a hand copy of the Ingress host. Traefik routes on
the Host header and Authentik matches redirect URIs strictly, so the URI is
https://<request host>/signin-oidc; https because TLS ends at Traefik and
browsers only reach the wiki over https.
The ProxyHeader scheme took the username from X-Authentik-Username for any
peer inside Auth:ReverseProxy:TrustedProxies. The deployment set that to
the whole pod CIDR (a hand copy of the Talos podSubnets), so every pod the
network policies let reach :8080 (Hermes, Gitea, Traefik, all of ai and
monitoring) could claim any human's name on the Facts page and on saved
answers. Authentik's proxy provider sends no signed identity header, so the
header cannot be verified at all.
Humans now sign in with OpenID Connect against Authentik: a public client
with PKCE, the username is preferred_username from the ID token, whose
signature is checked against the provider's JWKS. Nothing about the
network path or the request headers names a user any more.
- Auth:Oidc:Authority, ClientId and PublicOrigin are required; the host
refuses to start without them. PublicOrigin builds the redirect URI,
because TLS ends at Traefik and the request scheme is http.
- UI pages, static assets and the Blazor hub need a session (fallback
policy); an anonymous browser is redirected to the provider.
- The read API (/api/v1 reads, /ask, /questions, /rank, /status) needs a
session or an API key (policy "read") and answers 401, never a redirect.
Before, it was anonymous and relied on the gate, BasicAuth or network
policy in front.
- Writes still need an API key (policy "write").
- /health, /ready and the HMAC-signed /webhook stay anonymous.
- ProxyHeaderAuthenticationHandler and Auth:ReverseProxy are removed.
Tests: an in-process OpenID provider issues RS256 ID tokens. They cover
the PKCE challenge and redirect URI, the full code flow ending in a
session named after the token's user, rejection of a token signed by a
foreign key, the Authentik header signing in nobody, and 401s for
credential-less API calls.
A statement may carry images (a type label, for instance). The drafter
sees them as image blocks and transcribes what is printed; the deposit
stores each picture beside the note as raw/<stem>-<n>.<ext>, lists it in
the frontmatter and embeds it in the body. INoteStore gains a binary
create and a browse URL, so the raw page can link to the pictures. The
page takes pictures from a file picker (camera on phones) or from paste,
resized in the browser to 1600px.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
IFactDrafter port: a statement in, title/content/tags out. Anthropic
implements it over the transport the answer model already uses (extracted
into MessagesTransport). RecordStatementUseCase drafts, sets the person as
source, keeps the statement verbatim in the body and deposits through the
existing use case. The Facts page is the text box and the receipt; the API
shape for machines is unchanged.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
