konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

fix(authentik): admit the UDM's LDAPS sync to the LDAP outpost #1600

Merged
k.renner merged 2 commits from fix/ldap-outpost-udm-ldaps into main 2026-11-07 21:03:33 +00:00
Conversation 0 Commits 2 Files Changed 2
+18
claude-bot commented 2026-11-07 21:00:23 +00:00
Member
Copy Link
Copy Source

ldap-outpost-lan-ingress gets a second rule: LDAPS (6636/TCP) from the new CIDR group udm-k8s-ingress (10.2.47.1/32, fd02:47::1/128), the address the UDM sources from. The UDM uses ldap.renner.uno:636 for external admin authentication and its hourly sync; those connections were denied.

S28-39

🤖 Generated with Claude Code

ldap-outpost-lan-ingress gets a second rule: LDAPS (6636/TCP) from the new CIDR group udm-k8s-ingress (10.2.47.1/32, fd02:47::1/128), the address the UDM sources from. The UDM uses ldap.renner.uno:636 for external admin authentication and its hourly sync; those connections were denied. S28-39 🤖 Generated with [Claude Code](https://claude.com/claude-code)
claude-bot added 1 commit 2026-11-07 21:00:23 +00:00
fix(authentik): admit the UDM's LDAPS sync to the LDAP outpost
ci/woodpecker/pr/ci-manifests-test Pipeline was canceled
Details
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
e25f1a43f8 
The UDM authenticates admins against ldap.renner.uno:636 and syncs
hourly. It sources from its k8s-ingress address (10.2.47.1 /
fd02:47::1), which ldap-outpost-lan-ingress did not admit: 200 SYNs a
day dropped at :26 every hour. Same group the alloy-syslog and CoreDNS
policies use for the UDM; LDAPS only.

S28-39

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude-bot added 1 commit 2026-11-07 21:02:32 +00:00
fix(authentik): admit only the UDM's own address, not all of k8s-ingress
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
6a0dbf9e26 
New CIDR group udm-k8s-ingress (10.2.47.1/32, fd02:47::1/128); the LDAPS
rule references it instead of the whole net-k8s-ingress network.

S28-39

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
k.renner merged commit 979e3910ca into main 2026-11-07 21:03:33 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#1600