Gate vscode/code-server behind Authentik passkey step-up #132

2026-07-08T23:19:08Z

k.renner commented

2026-07-08 23:19:08 +00:00

Puts the HA /config editor (code-server, currently --auth=none + root + full /config mount) behind Authentik using the existing paperless-gate proxy-outpost pattern, with the passkey step-up flow.

What changes

Authentik blueprint: new proxy provider + application + dedicated outpost (ak-outpost-vscode-gate, mode: proxy), authorization_flow = passkey-stepup-authorization.
Group: new Home Assistant Config Editors (git-owned membership, k.renner only) bound to the app.
Ingress: vscode.home.renner.uno now backends the gate outpost (ExternalName mirror) instead of code-server directly.
CNP: home-assistant policy no longer lets traefik reach :8080; only the vscode-gate outpost may. Matching scoped egress CNP added in the authentik namespace.
PWA carve-out: skip_path_regex for code-server's static/manifest/service-worker tree to avoid the credentials:'omit' redirect loop that retired the music-assistant gate.

Verified

kubectl kustomize builds clean for home-assistant, authentik, and network-policies.

Post-deploy validation (needs a browser)

Blueprint applies; ak-outpost-vscode-gate deploys; k.renner shows in the new group (if the M2M doesn't take, add via UI — safe-fail: wrong = lockout, not exposure).
https://vscode.home.renner.uno → auth.renner.uno → passkey step-up → editor loads over websocket.
No redirect loop on manifest/service-worker; tune skip_path_regex if code-server asset paths differ.
Non-member (e.g. s.renner) is denied.
traefik→:8080 now denied; code-server reachable only via the gate.

Do not merge until the browser flow is validated — this is a login-path change on a secrets-exposing tool.

Puts the HA `/config` editor (code-server, currently `--auth=none` + root + full `/config` mount) behind Authentik using the existing **paperless-gate proxy-outpost** pattern, with the **passkey step-up** flow. ## What changes - **Authentik blueprint**: new proxy provider + application + dedicated outpost (`ak-outpost-vscode-gate`, mode: proxy), `authorization_flow = passkey-stepup-authorization`. - **Group**: new `Home Assistant Config Editors` (git-owned membership, **k.renner only**) bound to the app. - **Ingress**: `vscode.home.renner.uno` now backends the gate outpost (ExternalName mirror) instead of code-server directly. - **CNP**: home-assistant policy no longer lets traefik reach `:8080`; only the vscode-gate outpost may. Matching scoped egress CNP added in the authentik namespace. - **PWA carve-out**: `skip_path_regex` for code-server's static/manifest/service-worker tree to avoid the `credentials:'omit'` redirect loop that retired the music-assistant gate. ## Verified - `kubectl kustomize` builds clean for home-assistant, authentik, and network-policies. ## Post-deploy validation (needs a browser) 1. Blueprint applies; `ak-outpost-vscode-gate` deploys; `k.renner` shows in the new group (if the M2M doesn't take, add via UI — safe-fail: wrong = lockout, not exposure). 2. `https://vscode.home.renner.uno` → auth.renner.uno → passkey step-up → editor loads over websocket. 3. No redirect loop on manifest/service-worker; tune `skip_path_regex` if code-server asset paths differ. 4. Non-member (e.g. s.renner) is denied. 5. traefik→:8080 now denied; code-server reachable only via the gate. Do not merge until the browser flow is validated — this is a login-path change on a secrets-exposing tool.

k.renner added 1 commit 2026-07-08 23:19:08 +00:00

feat(home-assistant): gate vscode/code-server behind Authentik passkey step-up 760e187ba1

code-server (the HA /config editor sidecar) runs with --auth=none, as
root, mounting the entire /config incl. plaintext secrets.yaml, .storage,
and the git PAT in the PVC remote URL. Until now the only control on it
was network reachability of vscode.home.renner.uno — any LAN client could
read every HA secret and edit config.

Put it behind Authentik using the existing paperless-gate proxy-outpost
pattern:

- New Authentik proxy provider + application + dedicated outpost
  (ak-outpost-vscode-gate) in mode: proxy. authorization_flow is the
  passkey-stepup-authorization flow (same one Homeassistant/Immich/
  Audiobookshelf/Netbird use), so every authorize requires a passkey.
- New "Home Assistant Config Editors" group (git-owned membership,
  k.renner only) bound to the app — explicit allowlist for who can read
  HA secrets via the editor.
- vscode Ingress now backends the gate outpost (ExternalName mirror)
  instead of code-server directly.
- home-assistant CNP tightened: traefik no longer allowed to :8080; only
  the vscode-gate outpost pod may reach code-server. Matching scoped
  egress CNP added in the authentik namespace.
- code-server is a service-worker app; skip_path_regex carves out its
  static/manifest/SW tree to avoid the credentials:'omit' redirect loop
  that forced retirement of the music-assistant gate. Exact skip set to
  be confirmed post-deploy (see PR checklist).

Verified: kubectl kustomize builds clean for home-assistant, authentik,
and network-policies. The Authentik proxy flow + code-server PWA
behaviour require a browser passkey login test after apply.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

k.renner merged commit 7106ff526e into master

2026-07-08 23:20:30 +00:00

k.renner referenced this issue from a commit

2026-07-08 23:20:31 +00:00

Merge pull request 'Gate vscode/code-server behind Authentik passkey step-up' (#132) from feat/vscode-authentik-gate into master

k.renner referenced this pull request

2026-07-09 11:44:01 +00:00

Gate shelly-manager behind Authentik passkey step-up #138

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#132