feat(paperless): Syncthing UI behind the Authentik gate

Serve the UI at syncthing.paperless.renner.uno for Paperless Admins. That hostname was the sync LoadBalancer's DNS name, so the LoadBalancer moves to sync.paperless.renner.uno and the DNS probe follows it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kubernetes/apps/authentik/blueprints-configmap.yaml

@@ -103,6 +103,16 @@ data:
           slug: paperless-proxy
         state: absent
 
+      # syncthing.paperless.renner.uno is gated by authentik-gate-sync
+      # (kubernetes/apps/paperless/syncthing.yaml), which admits this group.
+      # Members are managed in Authentik.
+      - model: authentik_core.group
+        identifiers:
+          name: Paperless Admins
+        state: present
+        attrs:
+          is_superuser: false
+
       # vscode.home.renner.uno is gated by authentik-gate-sync
       # (kubernetes/apps/home-assistant/vscode-ingress.yaml), which admits this
       # group. Members are managed in Authentik.

kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml

@@ -64,7 +64,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: shelly-manager
-          image: gitea.renner.uno/konairius/shelly-manager:2026-10-29-1803 # {"$imagepolicy": "flux-system:shelly-manager"}
+          image: gitea.renner.uno/konairius/shelly-manager:2026-10-30-0913 # {"$imagepolicy": "flux-system:shelly-manager"}
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

kubernetes/apps/monitoring-rules/probes-dns.yaml

@@ -142,4 +142,4 @@ spec:
         - "[fd02:47::1]:53"
         - "10.2.47.1:53"
       labels:
-        dns_name: syncthing.paperless.renner.uno
+        dns_name: sync.paperless.renner.uno

kubernetes/apps/monitoring/helmrelease-blackbox-exporter.yaml

@@ -136,7 +136,7 @@ spec:
           prober: dns
           timeout: 5s
           dns:
-            query_name: syncthing.paperless.renner.uno
+            query_name: sync.paperless.renner.uno
             query_type: A
             valid_rcodes: [NOERROR]
             validate_answer_rrs:

kubernetes/apps/navidrome/lidarr.yaml

@@ -93,7 +93,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: lidarr
-          image: ghcr.io/linuxserver/lidarr:3.1.6.5079-ls46 # {"$imagepolicy": "flux-system:lidarr"}
+          image: lscr.io/linuxserver/lidarr:3.1.6.5079-ls46 # {"$imagepolicy": "flux-system:lidarr"}
           env:
             - name: PUID
               value: "1000"
@@ -140,7 +140,7 @@ spec:
               drop: ["ALL"]
               add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "SETGID", "SETUID"]
         - name: reconcile
-          image: ghcr.io/linuxserver/lidarr:3.1.6.5079-ls46 # {"$imagepolicy": "flux-system:lidarr"}
+          image: lscr.io/linuxserver/lidarr:3.1.6.5079-ls46 # {"$imagepolicy": "flux-system:lidarr"}
           command: ["sh", "/scripts/reconcile.sh"]
           volumeMounts:
             - name: config

kubernetes/apps/paperless/kumamonitors.yaml

@@ -138,3 +138,25 @@ spec:
     expiryNotification: true
   keyword:
     keyword: "<title>authentik</title>"
+---
+apiVersion: uptime.renner.uno/v1alpha1
+kind: KumaMonitor
+metadata:
+  name: syncthing-ui-gate
+  namespace: paperless
+spec:
+  type: keyword
+  displayName: Syncthing Login
+  parentRef:
+    name: docs
+  interval: 60
+  retryInterval: 60
+  maxRetries: 1
+  timeout: 20
+  http:
+    # behind the Authentik gate; asserts the login page the redirect chain ends on
+    url: https://syncthing.paperless.renner.uno/
+    acceptedStatusCodes: ["200-299"]
+    expiryNotification: true
+  keyword:
+    keyword: "<title>authentik</title>"

kubernetes/apps/paperless/paperless.yaml

@@ -182,7 +182,7 @@ spec:
               drop: ["ALL"]
       containers:
         - name: paperless
-          image: ghcr.io/paperless-ngx/paperless-ngx:3.3.4 # {"$imagepolicy": "flux-system:paperless-ngx"}
+          image: ghcr.io/paperless-ngx/paperless-ngx:3.4.0 # {"$imagepolicy": "flux-system:paperless-ngx"}
           ports:
             - name: http
               containerPort: 8000

kubernetes/apps/paperless/syncthing.yaml

@@ -52,11 +52,8 @@ spec:
         - name: syncthing
           image: syncthing/syncthing:2.1.7@sha256:2b71da7c0d0a91a6ae5285ad079226fecc0a365d08b27720e1f7037b018f7546
           env:
-            # UI bind: any-interface so the ClusterIP Service can reach
-            # it. Network exposure is gated by the absence of an Ingress
-            # and the namespace default-deny CNP — set a UI password in
-            # the Syncthing UI on first port-forward access before
-            # publishing it.
+            # UI bind: any-interface so the ClusterIP Service can reach it.
+            # External access goes through the syncthing-ui Ingress only.
             - name: STGUIADDRESS
               value: "0.0.0.0:8384"
             - name: PUID
@@ -115,10 +112,6 @@ spec:
           persistentVolumeClaim:
             claimName: paperless-consume
 ---
-# UI Service — ClusterIP only. Access via `kubectl -n paperless
-# port-forward svc/syncthing-ui 8384:8384` for first-time setup
-# (set admin password). Future Ingress + Authentik gate is a
-# separate change once auth is configured.
 apiVersion: v1
 kind: Service
 metadata:
@@ -132,6 +125,36 @@ spec:
       port: 8384
       targetPort: ui
 ---
+# LAN-only UI: Paperless Admins through the Authentik gate.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: syncthing-ui
+  namespace: paperless
+  labels:
+    dns.renner.uno/internal: "true"
+  annotations:
+    traefik.ingress.kubernetes.io/router.middlewares: authentik-gate@kubernetescrd
+    cert-manager.io/cluster-issuer: letsencrypt-cluster
+    auth.renner.uno/group: Paperless Admins
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: syncthing.paperless.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: syncthing-ui
+                port:
+                  number: 8384
+  tls:
+    - secretName: syncthing-ui-tls
+      hosts:
+        - syncthing.paperless.renner.uno
+---
 # Sync ports — LAN-reachable LoadBalancer. Peers (phones, laptops)
 # connect here for the dropbox sync. external-dns publishes the
 # hostname into UniFi DNS only (no cloudflare label); off-LAN peers
@@ -146,7 +169,7 @@ metadata:
     dns.renner.uno/internal: "true"
   annotations:
     io.cilium/lb-ipam-ips: "10.2.99.85,fd99::85"
-    external-dns.kubernetes.io/hostname: syncthing.paperless.renner.uno
+    external-dns.kubernetes.io/hostname: sync.paperless.renner.uno
 spec:
   type: LoadBalancer
   externalTrafficPolicy: Local

kubernetes/infrastructure/network-policies/paperless-ns.yaml

@@ -145,8 +145,8 @@ spec:
 # Allow Syncthing peer-to-peer sync from the LAN/world.
 # - 22000 TCP+QUIC: actual sync traffic between peers.
 # - 21027 UDP: local-discovery broadcast packets from peers on the LAN.
-# UI (8384) is intentionally NOT listed — accessed via port-forward
-# until an Ingress + Authentik gate is added.
+# UI (8384) is intentionally NOT listed — authentik-gate-sync generates the
+# CNP syncthing-ui-gate that admits traefik.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata: