code-server (the HA /config editor sidecar) runs with --auth=none, as
root, mounting the entire /config incl. plaintext secrets.yaml, .storage,
and the git PAT in the PVC remote URL. Until now the only control on it
was network reachability of vscode.home.renner.uno — any LAN client could
read every HA secret and edit config.
Put it behind Authentik using the existing paperless-gate proxy-outpost
pattern:
- New Authentik proxy provider + application + dedicated outpost
(ak-outpost-vscode-gate) in mode: proxy. authorization_flow is the
passkey-stepup-authorization flow (same one Homeassistant/Immich/
Audiobookshelf/Netbird use), so every authorize requires a passkey.
- New "Home Assistant Config Editors" group (git-owned membership,
k.renner only) bound to the app — explicit allowlist for who can read
HA secrets via the editor.
- vscode Ingress now backends the gate outpost (ExternalName mirror)
instead of code-server directly.
- home-assistant CNP tightened: traefik no longer allowed to :8080; only
the vscode-gate outpost pod may reach code-server. Matching scoped
egress CNP added in the authentik namespace.
- code-server is a service-worker app; skip_path_regex carves out its
static/manifest/SW tree to avoid the credentials:'omit' redirect loop
that forced retirement of the music-assistant gate. Exact skip set to
be confirmed post-deploy (see PR checklist).
Verified: kubectl kustomize builds clean for home-assistant, authentik,
and network-policies. The Authentik proxy flow + code-server PWA
behaviour require a browser passkey login test after apply.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
k.rennerandClaude Opus 4.8