2026-08-16 20:24:10 +00:00
1 changed files with 18 additions and 0 deletions
@@ -57,6 +57,24 @@ spec:
    - host: www.renner.uno
      http:
        paths:
+          # The outpost's own OAuth leg. Without this the gate is a dead end,
+          # not a gate: hitting /wp-admin redirects to
+          # /outpost.goauthentik.io/start on THIS host, which otherwise falls
+          # through to the public `/` router and lands on WordPress's 404
+          # page — verified exactly that way on first deploy. paperless needs
+          # the same route and has it as a separate Ingress on auth.renner.uno
+          # (apps/authentik/paperless-gate-ingress.yaml); here the flow stays
+          # on www.renner.uno, so it belongs in this rule set.
+          #
+          # It is not an authentication hole: these endpoints ARE the login
+          # flow, and the outpost serves them itself.
+          - path: /outpost.goauthentik.io
+            pathType: Prefix
+            backend:
+              service:
+                name: ak-outpost-wordpress-gate
+                port:
+                  number: 9000
          # Covers admin-ajax.php too. That is only safe because the gift
          # registry plugin -- the sole thing on this site that ever emitted
          # an ajaxurl -- is being dropped in the migration. Verified against