fix(coder): trust LE staging roots for OIDC to Authentik #2

2026-04-24T16:05:13Z

k.renner commented

2026-04-24 16:05:13 +00:00

Summary

Coder's OIDC init was crashlooping with x509: certificate signed by unknown authority against auth.renner.uno, because every ingress uses letsencrypt-staging.
Mount staging roots (Pretend Pear X1 + Bogus Broccoli X2) via coder.certs.secrets; Go picks them up from /etc/ssl/certs/.
Remove once the cluster moves to letsencrypt-prod.

Test plan

Coder pod starts past OIDC init (no more x509 error in logs)
OIDC login against Authentik succeeds

🤖 Generated with Claude Code

## Summary - Coder's OIDC init was crashlooping with `x509: certificate signed by unknown authority` against `auth.renner.uno`, because every ingress uses `letsencrypt-staging`. - Mount staging roots (Pretend Pear X1 + Bogus Broccoli X2) via `coder.certs.secrets`; Go picks them up from `/etc/ssl/certs/`. - Remove once the cluster moves to `letsencrypt-prod`. ## Test plan - [ ] Coder pod starts past OIDC init (no more x509 error in logs) - [ ] OIDC login against Authentik succeeds 🤖 Generated with [Claude Code](https://claude.com/claude-code)

k.renner added 1 commit 2026-04-24 16:05:13 +00:00

fix(coder): trust LE staging roots for OIDC to Authentik 74aefdc28f

Coder's OIDC init was crashlooping with "x509: certificate signed by
unknown authority" when fetching auth.renner.uno's OpenID discovery
document, because every ingress in this cluster uses the
letsencrypt-staging ClusterIssuer today.

Mount the staging roots (Pretend Pear X1 + Bogus Broccoli X2) via
coder.certs.secrets; the chart drops them at /etc/ssl/certs/ where
Go's crypto/x509 picks them up on Linux.

Remove once the cluster migrates to letsencrypt-prod.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

k.renner merged commit fd4c1da5ed into master

2026-04-24 16:05:19 +00:00

k.renner referenced this issue from a commit

2026-04-24 16:05:20 +00:00

Merge pull request 'fix(coder): trust LE staging roots for OIDC to Authentik' (#2) from coder-migration into master

k.renner referenced this issue from a commit

2026-06-27 14:42:34 +00:00

traefik: real client-IP visibility via X-Forwarded-For (CrowdSec prereq #1)

k.renner referenced this pull request

2026-06-27 14:42:46 +00:00

traefik: real client-IP visibility via X-Forwarded-For (CrowdSec prereq #1) #81

k.renner referenced this pull request