fix(wordpress): route the outpost OAuth path so the gate is a gate, not a dead end #494

2026-08-16T20:22:50Z

claude-bot commented

2026-08-16 20:22:50 +00:00

Found by testing the deployed cluster rather than reading the manifest.

GET /wp-admin/ correctly redirects to https://www.renner.uno/outpost.goauthentik.io/start?rd=... — and that URL returned WordPress's 404 page, because /outpost.goauthentik.io fell through to the public / prefix router. The gate was a dead end, not a gate: /wp-admin was unreachable rather than protected.

paperless needs the same route and solves it with a separate Ingress on auth.renner.uno (apps/authentik/paperless-gate-ingress.yaml). Here the whole flow stays on www.renner.uno, so the path belongs in this rule set.

These endpoints are the login flow itself and are served by the outpost, so routing them to it is not an authentication hole.

Live state after the merge of #492 / #493

Verified against the Traefik VIP with SNI, so no hairpin or public DNS in the path:

Pfad	Ergebnis
`/`	200
`/wir-haben-geheiratet/`	200
`/impressum/`	200
`/wp-admin/`	302 → Authentik
`/wp-login.php`	302 → Authentik
`/xmlrpc.php`	302 → Authentik
`/outpost.goauthentik.io/start`	404 (this PR fixes it)

Also done and verified: database imported (17 tables, all posts incl. the unpublished draft), wp-content seeded (13 MB uploads), search-replace to https://www.renner.uno — 54 replacements, of which 6 were in PHP-serialised values, which is why this went through wp-cli and not sed. wpgiftregistry removed from active_plugins and from the volume. Certificate CN=www.renner.uno, Let's Encrypt, valid to 14 Nov.

🤖 Generated with Claude Code

https://claude.ai/code/session_014giKN9N6e5J2DF8QZmVh98

Found by testing the deployed cluster rather than reading the manifest. `GET /wp-admin/` correctly redirects to `https://www.renner.uno/outpost.goauthentik.io/start?rd=...` — and **that URL returned WordPress's 404 page**, because `/outpost.goauthentik.io` fell through to the public `/` prefix router. The gate was a dead end, not a gate: `/wp-admin` was unreachable rather than protected. paperless needs the same route and solves it with a separate Ingress on `auth.renner.uno` (`apps/authentik/paperless-gate-ingress.yaml`). Here the whole flow stays on `www.renner.uno`, so the path belongs in this rule set. These endpoints are the login flow itself and are served by the outpost, so routing them to it is not an authentication hole. ## Live state after the merge of #492 / #493 Verified against the Traefik VIP with SNI, so no hairpin or public DNS in the path: | Pfad | Ergebnis | |---|---| | `/` | 200 | | `/wir-haben-geheiratet/` | 200 | | `/impressum/` | 200 | | `/wp-admin/` | 302 → Authentik | | `/wp-login.php` | 302 → Authentik | | `/xmlrpc.php` | 302 → Authentik | | `/outpost.goauthentik.io/start` | **404 (this PR fixes it)** | Also done and verified: database imported (17 tables, all posts incl. the unpublished draft), `wp-content` seeded (13 MB uploads), `search-replace` to `https://www.renner.uno` — 54 replacements, of which 6 were in PHP-serialised values, which is why this went through wp-cli and not sed. `wpgiftregistry` removed from `active_plugins` and from the volume. Certificate `CN=www.renner.uno`, Let's Encrypt, valid to 14 Nov. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_014giKN9N6e5J2DF8QZmVh98

claude-bot added 1 commit 2026-08-16 20:22:50 +00:00

fix(wordpress): route the outpost OAuth path so the gate is a gate, not a dead end

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

ci/woodpecker/pr/pr-review Pipeline was successful

Details

fb3724f603

Verified against the deployed cluster: GET /wp-admin/ correctly 302s to
https://www.renner.uno/outpost.goauthentik.io/start?rd=... — and that URL
returned WordPress's 404 page, because /outpost.goauthentik.io fell through to
the public '/' prefix router.

The effect was that /wp-admin was unreachable rather than protected. An
attacker gains nothing, but neither does the editor the gate exists for.

paperless needs the same route and solves it with a separate Ingress on
auth.renner.uno (apps/authentik/paperless-gate-ingress.yaml). Here the whole
flow stays on www.renner.uno, so the path belongs in this rule set.

These endpoints are the login flow itself and are served by the outpost, so
routing them to it is not an authentication hole.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014giKN9N6e5J2DF8QZmVh98

k.renner merged commit d9b4c47cf2 into master

2026-08-16 20:24:10 +00:00

k.renner referenced this issue from a commit

2026-08-16 20:24:11 +00:00

Merge pull request 'fix(wordpress): route the outpost OAuth path so the gate is a gate, not a dead end' (#494) from fix-outpost-callback-path into master

review-bot reviewed

2026-08-16 20:25:29 +00:00

review-bot left a comment

🤖 Automated review — model CLI default (complexity: complex), commit fb3724f6031fd1e7bacc6804ad318b7f5c86efbf.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

Adds a /outpost.goauthentik.io path to the wordpress-admin Ingress (kubernetes/apps/wordpress/ingress.yaml), routing it to the existing ak-outpost-wordpress-gate service on port 9000. This closes the gap where Authentik's own OAuth flow (/outpost.goauthentik.io/start, /callback, /sign_out) fell through to the public / router and hit WordPress's 404 page instead of the outpost — exactly the pattern already established for paperless in kubernetes/apps/authentik/paperless-gate-ingress.yaml. No blocking issues found.

🟡 Suggestions

kubernetes/apps/wordpress/ingress.yaml:71-77: The new rule reuses the existing ak-outpost-wordpress-gate ExternalName Service (gate-service.yaml) and port 9000, consistent with the other three rules in this Ingress, and the same CiliumNetworkPolicy/egress surface these already exercise — so there's no new network-policy gap to close here. Worth a quick post-merge check with kubectl get ingressroute -n wordpress (or the live-state table already in the PR body, re-run once) that Traefik's rule-length ordering actually puts /outpost.goauthentik.io ahead of the public / rule as expected, since that ordering is implicit rather than declared with an explicit priority.

Tests

No test suite applies to Ingress manifests in this repo; the PR body documents manual verification against the live cluster (/outpost.goauthentik.io/start now presumably reaching Authentik instead of 404), which is the appropriate verification method here. Nothing further needed.

Recommendation

Looks reasonable — no blocking issues; comment above is optional.

🤖 **Automated review** — model `CLI default` (complexity: complex), commit `fb3724f6031fd1e7bacc6804ad318b7f5c86efbf`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary Adds a `/outpost.goauthentik.io` path to the `wordpress-admin` Ingress (`kubernetes/apps/wordpress/ingress.yaml`), routing it to the existing `ak-outpost-wordpress-gate` service on port 9000. This closes the gap where Authentik's own OAuth flow (`/outpost.goauthentik.io/start`, `/callback`, `/sign_out`) fell through to the public `/` router and hit WordPress's 404 page instead of the outpost — exactly the pattern already established for paperless in `kubernetes/apps/authentik/paperless-gate-ingress.yaml`. No blocking issues found. ## 🟡 Suggestions - `kubernetes/apps/wordpress/ingress.yaml:71-77`: The new rule reuses the existing `ak-outpost-wordpress-gate` `ExternalName` Service (`gate-service.yaml`) and port 9000, consistent with the other three rules in this Ingress, and the same CiliumNetworkPolicy/egress surface these already exercise — so there's no new network-policy gap to close here. Worth a quick post-merge check with `kubectl get ingressroute -n wordpress` (or the live-state table already in the PR body, re-run once) that Traefik's rule-length ordering actually puts `/outpost.goauthentik.io` ahead of the public `/` rule as expected, since that ordering is implicit rather than declared with an explicit priority. ## Tests No test suite applies to Ingress manifests in this repo; the PR body documents manual verification against the live cluster (`/outpost.goauthentik.io/start` now presumably reaching Authentik instead of 404), which is the appropriate verification method here. Nothing further needed. ## Recommendation Looks reasonable — no blocking issues; comment above is optional.

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#494