From fb3724f6031fd1e7bacc6804ad318b7f5c86efbf Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Sun, 16 Aug 2026 22:22:25 +0200 Subject: [PATCH] fix(wordpress): route the outpost OAuth path so the gate is a gate, not a dead end MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Verified against the deployed cluster: GET /wp-admin/ correctly 302s to https://www.renner.uno/outpost.goauthentik.io/start?rd=... — and that URL returned WordPress's 404 page, because /outpost.goauthentik.io fell through to the public '/' prefix router. The effect was that /wp-admin was unreachable rather than protected. An attacker gains nothing, but neither does the editor the gate exists for. paperless needs the same route and solves it with a separate Ingress on auth.renner.uno (apps/authentik/paperless-gate-ingress.yaml). Here the whole flow stays on www.renner.uno, so the path belongs in this rule set. These endpoints are the login flow itself and are served by the outpost, so routing them to it is not an authentication hole. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_014giKN9N6e5J2DF8QZmVh98 --- kubernetes/apps/wordpress/ingress.yaml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/kubernetes/apps/wordpress/ingress.yaml b/kubernetes/apps/wordpress/ingress.yaml index dcae097b..e51efdd1 100644 --- a/kubernetes/apps/wordpress/ingress.yaml +++ b/kubernetes/apps/wordpress/ingress.yaml @@ -57,6 +57,24 @@ spec: - host: www.renner.uno http: paths: + # The outpost's own OAuth leg. Without this the gate is a dead end, + # not a gate: hitting /wp-admin redirects to + # /outpost.goauthentik.io/start on THIS host, which otherwise falls + # through to the public `/` router and lands on WordPress's 404 + # page — verified exactly that way on first deploy. paperless needs + # the same route and has it as a separate Ingress on auth.renner.uno + # (apps/authentik/paperless-gate-ingress.yaml); here the flow stays + # on www.renner.uno, so it belongs in this rule set. + # + # It is not an authentication hole: these endpoints ARE the login + # flow, and the outpost serves them itself. + - path: /outpost.goauthentik.io + pathType: Prefix + backend: + service: + name: ak-outpost-wordpress-gate + port: + number: 9000 # Covers admin-ajax.php too. That is only safe because the gift # registry plugin -- the sole thing on this site that ever emitted # an ajaxurl -- is being dropped in the migration. Verified against -- 2.54.0