konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 1 Packages Projects Releases 1 Wiki Activity

network-policies: agent pods -> shelly-manager API via header-stripping :8081 (REN-931, REN-935) #1161

Merged
Ghost merged 2 commits from atlas/ren-931-agent-shelly-manager into master 2026-10-06 20:00:49 +00:00
Conversation 3 Commits 2 Files Changed 6
+175 -1
2 Commits
Author SHA1 Message Date
atlas-botandClaude Opus 5.5 a3094d56a2 shelly-manager: header-stripping api-proxy on :8081 for agent pods (REN-935)
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/pr-review Pipeline was successful
Details
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details 
Review 1473: shelly-manager signs in whoever X-authentik-username names when
the peer is in the pod CIDR, so opening :8080 to agent pods let any run sign
in with a forged header and no API key.

Agents now get an nginx sidecar on ${POD_IP}:8081 (Service
shelly-manager-api) that drops X-authentik-username and X-Forwarded-User
before proxying to :8080. Both agent CNPs move from 8080 to 8081, so :8080
stays outpost-only and every agent call needs the API key.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-06 19:50:46 +00:00
atlas-botandClaude Opus 5.5 3e7b4003d3 network-policies: agent pods -> shelly-manager :8080 (REN-931)
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/pr-review Pipeline was successful
Details
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details 
Egress from paperclip-renner agent pods and a dedicated ingress CNP on
shelly-manager, container port 8080 (socket-LB). All agents: sandbox pods
carry no per-agent label; the API key gates calls.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-06 19:39:15 +00:00