fix(wiki): the service reads the wiki-index BasicAuth users

#1383 + konairius/Wiki#14 put the wiki's read API behind an OIDC session
or an API key. External agents only have the wiki-index.renner.uno
BasicAuth credentials and got 401 since.

konairius/Wiki (feat/basic-auth-machines) checks `Authorization: Basic`
in the service against the htpasswd lines Traefik uses. This mounts the
existing Secret wiki-api-basic-auth (OpenBao apps/ai/wiki-index-basic-auth,
already the wiki's own) read-only at /var/run/secrets/wiki-basic-auth.
Auth__Basic__UsersPath points at the directory, because the service reads
every key there, as Traefik does. A rotated Secret now also rolls the pod
(reloader annotation).

Order does not matter: the current image ignores the setting, and the new
image without it authenticates nobody over BasicAuth. Traefik's middleware
on wiki-index stays.

kubernetes/apps/authentik/blueprints-configmap.yaml

@@ -295,8 +295,8 @@ data:
           name: llama-gate
         state: absent
 
-      # Retired: wiki-gate. wiki.renner.uno is gated by authentik-gate-sync
-      # (kubernetes/apps/wiki/ingress.yaml).
+      # Retired: wiki-gate. The wiki signs humans in itself (application
+      # `wiki` in passkey-stepup.yaml).
       - model: authentik_outposts.outpost
         identifiers:
           name: wiki-gate
@@ -1011,6 +1011,7 @@ data:
             - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
             - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
             - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-offline_access]]
           redirect_uris:
             - url: https://hermes.renner.uno/auth/callback
               matching_mode: strict

kubernetes/apps/hermes/hermes.yaml

@@ -71,6 +71,30 @@ spec:
           volumeMounts:
             - name: data
               mountPath: /opt/data
+        # WebSocket keepalive ping interval in seconds (default 20).
+        - name: config-ws-ping
+          image: gitea.renner.uno/konairius/hermes:build.1792397861 # {"$imagepolicy": "flux-system:hermes"}
+          command:
+            - /opt/hermes/.venv/bin/hermes
+            - config
+            - set
+            - dashboard.ws_ping_interval
+            - "60"
+          env:
+            - name: HERMES_HOME
+              value: /opt/data
+            - name: HOME
+              value: /opt/data
+          securityContext:
+            runAsUser: 10000
+            runAsGroup: 10000
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: data
+              mountPath: /opt/data
         # Skills from git (ConfigMap hermes-skills) beside the PVC's skills/.
         - name: skills-config
           image: gitea.renner.uno/konairius/hermes:build.1792397861 # {"$imagepolicy": "flux-system:hermes"}
@@ -140,6 +164,9 @@ spec:
               value: https://auth.renner.uno/application/o/hermes/
             - name: HERMES_DASHBOARD_OIDC_CLIENT_ID
               value: hermes-dashboard
+            # offline_access: Authentik issues a refresh token only when requested.
+            - name: HERMES_DASHBOARD_OIDC_SCOPES
+              value: openid profile email offline_access
             - name: API_SERVER_ENABLED
               value: "true"
             - name: API_SERVER_HOST

kubernetes/apps/wiki/deployment.yaml

@@ -24,7 +24,7 @@ metadata:
   namespace: ai
   annotations:
     # Keys, tokens and the Anthropic key arrive via envFrom; a rotated Secret rolls the pod.
-    secret.reloader.stakater.com/reload: wiki-gitea,wiki-api-keys,wiki-typesafe,wiki-anthropic
+    secret.reloader.stakater.com/reload: wiki-gitea,wiki-api-keys,wiki-typesafe,wiki-anthropic,wiki-api-basic-auth
   labels:
     app.kubernetes.io/name: wiki
 spec:
@@ -53,7 +53,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: wiki
-          image: gitea.renner.uno/konairius/wiki:build.1790322994 # {"$imagepolicy": "flux-system:wiki"}
+          image: gitea.renner.uno/konairius/wiki:build.1792404861 # {"$imagepolicy": "flux-system:wiki"}
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
@@ -77,11 +77,9 @@ spec:
               value: https://auth.renner.uno/application/o/wiki/
             - name: Auth__Oidc__ClientId
               value: wiki
-            # Pod networks: the CNPs admit only the gate outpost and Gitea.
-            - name: Auth__ReverseProxy__TrustedProxies__0
-              value: fd10:244::/48
-            - name: Auth__ReverseProxy__TrustedProxies__1
-              value: 10.244.0.0/16
+            # wiki-index BasicAuth users (htpasswd), checked by the service for the read API.
+            - name: Auth__Basic__UsersPath
+              value: /var/run/secrets/wiki-basic-auth
           envFrom:
             - secretRef:
                 name: wiki-gitea
@@ -127,12 +125,18 @@ spec:
               mountPath: /data
             - name: tmp
               mountPath: /tmp
+            - name: basic-auth
+              mountPath: /var/run/secrets/wiki-basic-auth
+              readOnly: true
       volumes:
         - name: data
           persistentVolumeClaim:
             claimName: wiki-data
         - name: tmp
           emptyDir: {}
+        - name: basic-auth
+          secret:
+            secretName: wiki-api-basic-auth
 ---
 apiVersion: v1
 kind: Service

kubernetes/apps/wiki/externalsecrets.yaml

@@ -87,7 +87,7 @@ spec:
         key: apps/ai/wiki-anthropic
         property: api_key
 ---
-# BasicAuth users for the machine door; same OpenBao key as the Python service used.
+# BasicAuth users for the machine door, read by Traefik and by the service; same OpenBao key as the Python service used.
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:

kubernetes/apps/wiki/ingress.yaml

@@ -1,7 +1,6 @@
-# wiki.renner.uno — LAN-only (no dns.renner.uno/public label). Gated by
-# authentik-gate-sync (ingress class authentik-gate); the service trusts
-# X-Authentik-Username only from pod addresses, and the generated CNP admits
-# only the gate outpost.
+# wiki.renner.uno — LAN-only (no dns.renner.uno/public label). Plain Traefik:
+# the service signs humans in itself with OIDC (application `wiki` in
+# apps/authentik/blueprints-configmap.yaml).
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -10,7 +9,7 @@ metadata:
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-cluster
 spec:
-  ingressClassName: authentik-gate
+  ingressClassName: traefik
   tls:
     - hosts:
         - wiki.renner.uno
@@ -28,8 +27,7 @@ spec:
                   number: 8080
 ---
 # wiki-index.renner.uno — the machine door (bin/wiki_rank.py, wiki_ask.py):
-# Traefik BasicAuth, and the identity header stripped so only the outpost path
-# can carry X-Authentik-Username to the service.
+# Traefik BasicAuth; the service checks the same credentials itself.
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
@@ -40,16 +38,6 @@ spec:
     secret: wiki-api-basic-auth
     realm: wiki
 ---
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: wiki-api-strip-identity
-  namespace: ai
-spec:
-  headers:
-    customRequestHeaders:
-      X-Authentik-Username: ""
----
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -57,7 +45,7 @@ metadata:
   namespace: ai
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-cluster
-    traefik.ingress.kubernetes.io/router.middlewares: ai-wiki-api-strip-identity@kubernetescrd,ai-wiki-api-basic-auth@kubernetescrd
+    traefik.ingress.kubernetes.io/router.middlewares: ai-wiki-api-basic-auth@kubernetescrd
 spec:
   ingressClassName: traefik
   tls:

kubernetes/infrastructure/image-automation/gitea-mcp.yaml

@@ -4,7 +4,7 @@ metadata:
   name: gitea-mcp
   namespace: flux-system
 spec:
-  image: docker.gitea.com/gitea-mcp-server@sha256:20701c3dcf3b71df384417d04f9f6382205b7f362380b258fb8e4dcf9599091f
+  image: docker.gitea.com/gitea-mcp-server
   interval: 1h
 ---
 apiVersion: image.toolkit.fluxcd.io/v1

kubernetes/infrastructure/network-policies/ai-ns.yaml

@@ -140,10 +140,9 @@ spec:
             - port: "8080"
               protocol: TCP
 ---
-# wiki: Traefik (the machine door wiki-index.renner.uno, BasicAuth with
-# X-Authentik-Username stripped), Gitea (push webhook) and Hermes Agent (API
-# key) may reach it; the gate outpost (humans, after Authentik) is admitted
-# by the CNP wiki-gate that authentik-gate-sync generates. Gitea and wiki-embed
+# wiki: Traefik (wiki.renner.uno, OIDC login in the service, and the machine
+# door wiki-index.renner.uno, BasicAuth), Gitea (push webhook) and Hermes Agent
+# (API key) may reach it. Gitea, wiki-embed and auth.renner.uno (via Traefik)
 # are reached through the namespace egress above; no OpenBao access.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy