konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 1 Packages Projects Releases 1 Wiki Activity

authentik: move auth.renner.uno public edge off Cloudflare tunnel to NetBird proxy #43

Merged
k.renner merged 1 commits from migrate-auth-to-proxy into master 2026-06-26 10:07:17 +00:00
Conversation 0 Commits 1 Files Changed 2
-7
k.renner commented 2026-06-26 10:06:17 +00:00
Owner
Copy Link
Copy Source

Moves auth.renner.uno (Authentik) off the Cloudflare tunnel to the NetBird reverse proxy — the last of the 8 public names.

Drops the external-dns/cloudflare label from the Authentik ingress (helm values) and removes the auth.renner.uno cloudflared route. After this, cloudflared routes nothing but a 404 catch-all.

🛑 auth must be served with NO proxy auth — it is the IdP every other service's SSO (and the proxy's own login) redirects to. SSO-gating it would loop and break all logins.

⚠️ Merge after the auth proxy service + DNS are live, then roll cloudflared — the gap takes down every SSO login.

🤖 Generated with Claude Code

Moves **auth.renner.uno** (Authentik) off the Cloudflare tunnel to the NetBird reverse proxy — the **last** of the 8 public names. Drops the `external-dns/cloudflare` label from the Authentik ingress (helm values) and removes the `auth.renner.uno` cloudflared route. After this, cloudflared routes **nothing but a 404 catch-all**. 🛑 **auth must be served with NO proxy auth** — it is the IdP every other service's SSO (and the proxy's own login) redirects to. SSO-gating it would loop and break all logins. ⚠️ Merge **after** the auth proxy service + DNS are live, then roll cloudflared — the gap takes down every SSO login. 🤖 Generated with Claude Code
k.renner added 1 commit 2026-06-26 10:06:18 +00:00
authentik: move auth.renner.uno public edge off Cloudflare tunnel to NetBird proxy 0c889bc36b 
Drop the external-dns/cloudflare label from the Authentik ingress (helm
values) and remove the auth.renner.uno cloudflared route. auth must be
served with NO proxy auth (it is the IdP every other SSO redirects to).
This is the last of the 8 public names; cloudflared now routes nothing
but a 404 catch-all.

MERGE ONLY AFTER the auth proxy service + DNS are live, then roll
cloudflared, or all SSO logins break in the gap.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
k.renner merged commit 400b6a0eb1 into master 2026-06-26 10:07:17 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#43