From 38156c12a79cd7e4b03b2fb20efbdd3d5d995ad8 Mon Sep 17 00:00:00 2001
From: Claude Bot <claude-bot@renner.uno>
Date: Thu, 24 Sep 2026 15:59:58 +0200
Subject: [PATCH] feat(wiki): wiki-index.renner.uno becomes the wiki service's
 machine door

BasicAuth as before, X-Authentik-Username stripped on that path, Traefik
admitted by the wiki CNP again. The Python service keeps running without
an ingress until the scripts are verified against the new one.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 kubernetes/apps/wiki-index/ingress.yaml       | 26 ----------
 kubernetes/apps/wiki/externalsecrets.yaml     | 17 +++++++
 kubernetes/apps/wiki/ingress.yaml             | 49 +++++++++++++++++++
 .../network-policies/ai-ns.yaml               | 11 +++--
 4 files changed, 73 insertions(+), 30 deletions(-)

diff --git a/kubernetes/apps/wiki-index/ingress.yaml b/kubernetes/apps/wiki-index/ingress.yaml
index f10b2dc0..9c01a9ed 100644
--- a/kubernetes/apps/wiki-index/ingress.yaml
+++ b/kubernetes/apps/wiki-index/ingress.yaml
@@ -28,29 +28,3 @@ spec:
   dataFrom:
     - extract:
         key: apps/ai/wiki-index-basic-auth
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: wiki-index
-  namespace: ai
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-cluster
-    traefik.ingress.kubernetes.io/router.middlewares: ai-wiki-index-basic-auth@kubernetescrd
-spec:
-  ingressClassName: traefik
-  tls:
-    - hosts:
-        - wiki-index.renner.uno
-      secretName: wiki-index-tls
-  rules:
-    - host: wiki-index.renner.uno
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: wiki-index
-                port:
-                  number: 8080
diff --git a/kubernetes/apps/wiki/externalsecrets.yaml b/kubernetes/apps/wiki/externalsecrets.yaml
index 7dd2d280..6d21a013 100644
--- a/kubernetes/apps/wiki/externalsecrets.yaml
+++ b/kubernetes/apps/wiki/externalsecrets.yaml
@@ -60,3 +60,20 @@ spec:
       remoteRef:
         key: apps/ai/wiki-typesafe
         property: api_key
+---
+# BasicAuth users for the machine door; same OpenBao key as the Python service used.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: wiki-api-basic-auth
+  namespace: ai
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: wiki-api-basic-auth
+  dataFrom:
+    - extract:
+        key: apps/ai/wiki-index-basic-auth
diff --git a/kubernetes/apps/wiki/ingress.yaml b/kubernetes/apps/wiki/ingress.yaml
index 6bd9c032..61d6e70e 100644
--- a/kubernetes/apps/wiki/ingress.yaml
+++ b/kubernetes/apps/wiki/ingress.yaml
@@ -24,3 +24,52 @@ spec:
                 name: ak-outpost-wiki-gate
                 port:
                   number: 9000
+---
+# wiki-index.renner.uno — the machine door (bin/wiki_rank.py, wiki_ask.py):
+# Traefik BasicAuth, and the identity header stripped so only the outpost path
+# can carry X-Authentik-Username to the service.
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: wiki-api-basic-auth
+  namespace: ai
+spec:
+  basicAuth:
+    secret: wiki-api-basic-auth
+    realm: wiki
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: wiki-api-strip-identity
+  namespace: ai
+spec:
+  headers:
+    customRequestHeaders:
+      X-Authentik-Username: ""
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: wiki-api
+  namespace: ai
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-cluster
+    traefik.ingress.kubernetes.io/router.middlewares: ai-wiki-api-strip-identity@kubernetescrd,ai-wiki-api-basic-auth@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - wiki-index.renner.uno
+      secretName: wiki-api-tls
+  rules:
+    - host: wiki-index.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: wiki
+                port:
+                  number: 8080
diff --git a/kubernetes/infrastructure/network-policies/ai-ns.yaml b/kubernetes/infrastructure/network-policies/ai-ns.yaml
index f4758fd8..fae41b92 100644
--- a/kubernetes/infrastructure/network-policies/ai-ns.yaml
+++ b/kubernetes/infrastructure/network-policies/ai-ns.yaml
@@ -149,10 +149,10 @@ spec:
             - port: "8080"
               protocol: TCP
 ---
-# wiki: only the wiki-gate outpost (humans, after Authentik) and Gitea (push
-# webhook) may reach it; Traefik is not admitted, so the X-Authentik-Username
-# header the service trusts cannot arrive from the LAN. Gitea and wiki-embed
-# are reached through the namespace egress above; no OpenBao access.
+# wiki: the wiki-gate outpost (humans, after Authentik), Traefik (the machine
+# door wiki-index.renner.uno, BasicAuth with X-Authentik-Username stripped) and
+# Gitea (push webhook) may reach it. Gitea and wiki-embed are reached through
+# the namespace egress above; no OpenBao access.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -167,6 +167,9 @@ spec:
         - matchLabels:
             "k8s:io.kubernetes.pod.namespace": authentik
             goauthentik.io/outpost-name: wiki-gate
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ingress
+            app.kubernetes.io/name: traefik
         - matchLabels:
             "k8s:io.kubernetes.pod.namespace": gitea
             app.kubernetes.io/name: gitea
-- 
2.54.0