feat(shelly-manager): enable SSO header trust from the authentik gate #260

2026-07-16T11:31:08Z

claude-bot commented

2026-07-16 11:31:08 +00:00

Companion to shelly-manager PR #40 (merge that first; these env vars are inert on the current image). Enables Auth:ReverseProxy so the outpost-injected X-authentik-username signs the gate session directly into the app — no more double login.

Review point: TrustedProxies is the pod CIDR (10.244.0.0/16) because the outpost pod IP is dynamic — this means any in-cluster pod that can reach the app port could assert an identity header, so the namespace CNP is the real boundary. If you want it tighter, options are an egress-stable identity for the outpost or a dedicated CNP rule review (the known over-permission item).

🤖 Generated with Claude Code

Companion to shelly-manager PR #40 (merge that first; these env vars are inert on the current image). Enables Auth:ReverseProxy so the outpost-injected X-authentik-username signs the gate session directly into the app — no more double login. **Review point:** TrustedProxies is the pod CIDR (10.244.0.0/16) because the outpost pod IP is dynamic — this means any in-cluster pod that can reach the app port could assert an identity header, so the namespace CNP is the real boundary. If you want it tighter, options are an egress-stable identity for the outpost or a dedicated CNP rule review (the known over-permission item). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-07-16 11:31:08 +00:00

feat(shelly-manager): enable SSO header trust from the authentik gate 2478a3cfc2

Turns on the app's new Auth:ReverseProxy mode (shelly-manager PR #40) so
the X-authentik-username header injected by the proxy outpost signs the
gate session straight into the app — removing the double login introduced
with the auth hardening. Trust is scoped to the pod CIDR because the
outpost pod address is dynamic; the namespace CNP remains the control
that keeps other pods off the app port. Inert until the image built from
shelly-manager PR #40 is promoted (unknown env keys are ignored).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

k.renner merged commit 1f521d8ec4 into master

2026-07-16 11:42:40 +00:00

k.renner referenced this issue from a commit

2026-07-16 11:42:41 +00:00

Merge pull request 'feat(shelly-manager): enable SSO header trust from the authentik gate' (#260) from feat/shelly-manager-sso into master

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#260