feat(wiki): wiki-index.renner.uno becomes the wiki service's machine door #946

2026-09-24T14:00:19Z

claude-bot commented

2026-09-24 14:00:19 +00:00

Cutover step for the workstation scripts: wiki-index.renner.uno now routes to the wiki service (/rank, /api/v1/*), BasicAuth with the same OpenBao credential (wiki-api-basic-auth ExternalSecret from apps/ai/wiki-index-basic-auth), plus a headers middleware that clears X-Authentik-Username on that path, so the service's proxy-header trust (pod networks) cannot be exercised from the LAN; only the outpost path carries the header. The wiki CNP admits Traefik again. The Python wiki-index keeps its Deployment, Service and webhook but loses its Ingress; it is retired in a follow-up once the scripts are verified against the new service (wiki_rank.py --probe-index, the 40-query eval, a wiki_ask.py run).

New TLS secret wiki-api-tls (fresh cert); the old wiki-index-tls goes with the old Ingress.

🤖 Generated with Claude Code

Cutover step for the workstation scripts: `wiki-index.renner.uno` now routes to the wiki service (`/rank`, `/api/v1/*`), BasicAuth with the same OpenBao credential (`wiki-api-basic-auth` ExternalSecret from `apps/ai/wiki-index-basic-auth`), plus a headers middleware that clears `X-Authentik-Username` on that path, so the service's proxy-header trust (pod networks) cannot be exercised from the LAN; only the outpost path carries the header. The wiki CNP admits Traefik again. The Python `wiki-index` keeps its Deployment, Service and webhook but loses its Ingress; it is retired in a follow-up once the scripts are verified against the new service (`wiki_rank.py --probe-index`, the 40-query eval, a `wiki_ask.py` run). New TLS secret `wiki-api-tls` (fresh cert); the old `wiki-index-tls` goes with the old Ingress. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-09-24 14:00:20 +00:00

feat(wiki): wiki-index.renner.uno becomes the wiki service's machine door

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/pr-review Pipeline was successful

Details

38156c12a7

BasicAuth as before, X-Authentik-Username stripped on that path, Traefik
admitted by the wiki CNP again. The Python service keeps running without
an ingress until the scripts are verified against the new one.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

review-bot reviewed

2026-09-24 14:04:35 +00:00

review-bot left a comment

🤖 Automated review — model CLI default (complexity: complex), commit 38156c12a79cd7e4b03b2fb20efbdd3d5d995ad8.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

This PR cuts wiki-index.renner.uno over from the Python wiki-index service to the new C# wiki service: it drops the old Ingress, adds a "machine door" Ingress/Middleware pair (Traefik BasicAuth + an identity-header-stripping Middleware) in front of the wiki Service, and widens the wiki CiliumNetworkPolicy to admit Traefik on port 8080. I traced the trust model end-to-end (outpost header-trust model, Auth__ReverseProxy__TrustedProxies, the CNP change, and the customRequestHeaders: "" semantics) and it holds together: the new route can't forge X-Authentik-Username because the strip-identity Middleware runs before BasicAuth on every request to that host, and no other Ingress points at the wiki Service directly. No blocking issues found.

🟡 Suggestions

kubernetes/apps/wiki/deployment.yaml:70-71 — the comment on Auth__ReverseProxy__TrustedProxies ("Pod networks: the CNP admits only the wiki-gate outpost and Gitea.") is now stale: the CNP this PR edits (ai-ns.yaml) also admits Traefik. Since this comment is exactly the kind of thing someone re-derives the trust boundary from later, it's worth a follow-up update so it doesn't understate who can reach the pod.
kubernetes/apps/authentik/blueprints-configmap.yaml:979-982 — the wiki-gate blueprint comment says "its CNP admits only this outpost, so the gate is the whole access control for wiki.renner.uno." The conclusion about wiki.renner.uno is still correct (that host still only backends to the outpost), but the premise is now false — Traefik is admitted too, for the new host. Minor doc drift caused by this PR, not touched by the diff.
kubernetes/apps/wiki-index/deployment.yaml:29 — "serves POST /rank to ~/Notes/bin/wiki_rank.py through wiki-index.renner.uno" is now inaccurate: that hostname routes to the new wiki service after this PR (its own Ingress was removed here). Worth fixing in this PR or the retirement follow-up so the Python service's manifest doesn't claim traffic it no longer receives.
Unverifiable from this repo: whether the Wiki app's proxy-header auth handler trusts only X-Authentik-Username or also other X-Authentik-* headers (groups/email/uid) for authorization. Only X-Authentik-Username is stripped by the new wiki-api-strip-identity Middleware (kubernetes/apps/wiki/ingress.yaml:41-49). If the handler also keys off another Authentik header for privilege decisions, that header would still reach the backend unstripped through the new Traefik-admitted path. The app source lives in k.renner/wiki, not this repo, so I can't confirm either way — worth a quick check of the proxy-header handler.
Minor duplication (not a bug): wiki-index-basic-auth (kubernetes/apps/wiki-index/ingress.yaml) and the new wiki-api-basic-auth (kubernetes/apps/wiki/externalsecrets.yaml:64-79) are two separate ExternalSecrets pulling the same OpenBao key apps/ai/wiki-index-basic-auth into two different Secrets, matching the PR's stated "same OpenBao credential" intent. Fine as a transitional state since wiki-index is slated for retirement anyway.

Tests

This is a GitOps manifests repo; there's no unit-test layer for Kubernetes YAML here. The PR body defers functional verification to the documented manual checks (wiki_rank.py --probe-index, the 40-query eval, a wiki_ask.py run) before retiring the Python service, which matches the phased "Verify" steps in kubernetes/PROPOSAL-wiki-web-api.md. I don't have kustomize/kubectl in this environment to confirm the edited kustomizations build cleanly, so I checked structurally instead: ingress.yaml is listed in both kubernetes/apps/wiki/kustomization.yaml and kubernetes/apps/wiki-index/kustomization.yaml, YAML indentation and --- document separators are consistent with the surrounding style, and cross-references (Service names/ports, Middleware names, Secret names) all resolve within the diff and checkout. Recommend a kustomize build / flux diff pass in CI as the real gate here.

Recommendation

Looks reasonable — no blocking issues; comments above are optional.

🤖 **Automated review** — model `CLI default` (complexity: complex), commit `38156c12a79cd7e4b03b2fb20efbdd3d5d995ad8`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary This PR cuts `wiki-index.renner.uno` over from the Python `wiki-index` service to the new C# `wiki` service: it drops the old Ingress, adds a "machine door" Ingress/Middleware pair (Traefik BasicAuth + an identity-header-stripping Middleware) in front of the `wiki` Service, and widens the `wiki` CiliumNetworkPolicy to admit Traefik on port 8080. I traced the trust model end-to-end (outpost header-trust model, `Auth__ReverseProxy__TrustedProxies`, the CNP change, and the `customRequestHeaders: ""` semantics) and it holds together: the new route can't forge `X-Authentik-Username` because the strip-identity Middleware runs before BasicAuth on every request to that host, and no other Ingress points at the `wiki` Service directly. No blocking issues found. ## 🟡 Suggestions - `kubernetes/apps/wiki/deployment.yaml:70-71` — the comment on `Auth__ReverseProxy__TrustedProxies` ("Pod networks: the CNP admits only the wiki-gate outpost and Gitea.") is now stale: the CNP this PR edits (`ai-ns.yaml`) also admits Traefik. Since this comment is exactly the kind of thing someone re-derives the trust boundary from later, it's worth a follow-up update so it doesn't understate who can reach the pod. - `kubernetes/apps/authentik/blueprints-configmap.yaml:979-982` — the `wiki-gate` blueprint comment says "its CNP admits only this outpost, so the gate is the whole access control for wiki.renner.uno." The conclusion about `wiki.renner.uno` is still correct (that host still only backends to the outpost), but the premise is now false — Traefik is admitted too, for the new host. Minor doc drift caused by this PR, not touched by the diff. - `kubernetes/apps/wiki-index/deployment.yaml:29` — "serves POST /rank to ~/Notes/bin/wiki_rank.py through wiki-index.renner.uno" is now inaccurate: that hostname routes to the new `wiki` service after this PR (its own Ingress was removed here). Worth fixing in this PR or the retirement follow-up so the Python service's manifest doesn't claim traffic it no longer receives. - Unverifiable from this repo: whether the Wiki app's proxy-header auth handler trusts *only* `X-Authentik-Username` or also other `X-Authentik-*` headers (groups/email/uid) for authorization. Only `X-Authentik-Username` is stripped by the new `wiki-api-strip-identity` Middleware (`kubernetes/apps/wiki/ingress.yaml:41-49`). If the handler also keys off another Authentik header for privilege decisions, that header would still reach the backend unstripped through the new Traefik-admitted path. The app source lives in `k.renner/wiki`, not this repo, so I can't confirm either way — worth a quick check of the proxy-header handler. - Minor duplication (not a bug): `wiki-index-basic-auth` (`kubernetes/apps/wiki-index/ingress.yaml`) and the new `wiki-api-basic-auth` (`kubernetes/apps/wiki/externalsecrets.yaml:64-79`) are two separate ExternalSecrets pulling the same OpenBao key `apps/ai/wiki-index-basic-auth` into two different Secrets, matching the PR's stated "same OpenBao credential" intent. Fine as a transitional state since `wiki-index` is slated for retirement anyway. ## Tests This is a GitOps manifests repo; there's no unit-test layer for Kubernetes YAML here. The PR body defers functional verification to the documented manual checks (`wiki_rank.py --probe-index`, the 40-query eval, a `wiki_ask.py` run) before retiring the Python service, which matches the phased "Verify" steps in `kubernetes/PROPOSAL-wiki-web-api.md`. I don't have `kustomize`/`kubectl` in this environment to confirm the edited kustomizations build cleanly, so I checked structurally instead: `ingress.yaml` is listed in both `kubernetes/apps/wiki/kustomization.yaml` and `kubernetes/apps/wiki-index/kustomization.yaml`, YAML indentation and `---` document separators are consistent with the surrounding style, and cross-references (Service names/ports, Middleware names, Secret names) all resolve within the diff and checkout. Recommend a `kustomize build` / `flux diff` pass in CI as the real gate here. ## Recommendation Looks reasonable — no blocking issues; comments above are optional.

k.renner merged commit 27a54e6ede into master

2026-09-24 14:08:15 +00:00

k.renner referenced this issue from a commit

2026-09-24 14:08:17 +00:00

Merge pull request 'feat(wiki): wiki-index.renner.uno becomes the wiki service's machine door' (#946) from feat/wiki-machine-door into master

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#946