fix(wordpress): route the outpost OAuth path so the gate is a gate, not a dead end

Verified against the deployed cluster: GET /wp-admin/ correctly 302s to https://www.renner.uno/outpost.goauthentik.io/start?rd=... — and that URL returned WordPress's 404 page, because /outpost.goauthentik.io fell through to the public '/' prefix router. The effect was that /wp-admin was unreachable rather than protected. An attacker gains nothing, but neither does the editor the gate exists for. paperless needs the same route and solves it with a separate Ingress on auth.renner.uno (apps/authentik/paperless-gate-ingress.yaml). Here the whole flow stays on www.renner.uno, so the path belongs in this rule set. These endpoints are the login flow itself and are served by the outpost, so routing them to it is not an authentication hole. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014giKN9N6e5J2DF8QZmVh98
Merge pull request 'fix(wordpress): remove add_filter from wp-config, route xmlrpc through the gate' (#493 ) from fix-wordpress-config-extra into master
2026-08-16 22:22:25 +02:00 · 2026-08-16 20:13:31 +00:00
1 changed files with 18 additions and 0 deletions
@@ -57,6 +57,24 @@ spec:
    - host: www.renner.uno
      http:
        paths:
+          # The outpost's own OAuth leg. Without this the gate is a dead end,
+          # not a gate: hitting /wp-admin redirects to
+          # /outpost.goauthentik.io/start on THIS host, which otherwise falls
+          # through to the public `/` router and lands on WordPress's 404
+          # page — verified exactly that way on first deploy. paperless needs
+          # the same route and has it as a separate Ingress on auth.renner.uno
+          # (apps/authentik/paperless-gate-ingress.yaml); here the flow stays
+          # on www.renner.uno, so it belongs in this rule set.
+          #
+          # It is not an authentication hole: these endpoints ARE the login
+          # flow, and the outpost serves them itself.
+          - path: /outpost.goauthentik.io
+            pathType: Prefix
+            backend:
+              service:
+                name: ak-outpost-wordpress-gate
+                port:
+                  number: 9000
          # Covers admin-ajax.php too. That is only safe because the gift
          # registry plugin -- the sole thing on this site that ever emitted
          # an ajaxurl -- is being dropped in the migration. Verified against