kubernetes/apps/wiki-index/ingress.yaml

@@ -28,29 +28,3 @@ spec:
   dataFrom:
     - extract:
         key: apps/ai/wiki-index-basic-auth
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: wiki-index
-  namespace: ai
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-cluster
-    traefik.ingress.kubernetes.io/router.middlewares: ai-wiki-index-basic-auth@kubernetescrd
-spec:
-  ingressClassName: traefik
-  tls:
-    - hosts:
-        - wiki-index.renner.uno
-      secretName: wiki-index-tls
-  rules:
-    - host: wiki-index.renner.uno
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: wiki-index
-                port:
-                  number: 8080

kubernetes/apps/wiki/externalsecrets.yaml

@@ -60,3 +60,20 @@ spec:
       remoteRef:
         key: apps/ai/wiki-typesafe
         property: api_key
+---
+# BasicAuth users for the machine door; same OpenBao key as the Python service used.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: wiki-api-basic-auth
+  namespace: ai
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: wiki-api-basic-auth
+  dataFrom:
+    - extract:
+        key: apps/ai/wiki-index-basic-auth

kubernetes/apps/wiki/ingress.yaml

@@ -24,3 +24,52 @@ spec:
                 name: ak-outpost-wiki-gate
                 port:
                   number: 9000
+---
+# wiki-index.renner.uno — the machine door (bin/wiki_rank.py, wiki_ask.py):
+# Traefik BasicAuth, and the identity header stripped so only the outpost path
+# can carry X-Authentik-Username to the service.
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: wiki-api-basic-auth
+  namespace: ai
+spec:
+  basicAuth:
+    secret: wiki-api-basic-auth
+    realm: wiki
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: wiki-api-strip-identity
+  namespace: ai
+spec:
+  headers:
+    customRequestHeaders:
+      X-Authentik-Username: ""
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: wiki-api
+  namespace: ai
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-cluster
+    traefik.ingress.kubernetes.io/router.middlewares: ai-wiki-api-strip-identity@kubernetescrd,ai-wiki-api-basic-auth@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - wiki-index.renner.uno
+      secretName: wiki-api-tls
+  rules:
+    - host: wiki-index.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: wiki
+                port:
+                  number: 8080

kubernetes/infrastructure/network-policies/ai-ns.yaml

@@ -149,10 +149,10 @@ spec:
             - port: "8080"
               protocol: TCP
 ---
-# wiki: only the wiki-gate outpost (humans, after Authentik) and Gitea (push
-# webhook) may reach it; Traefik is not admitted, so the X-Authentik-Username
-# header the service trusts cannot arrive from the LAN. Gitea and wiki-embed
-# are reached through the namespace egress above; no OpenBao access.
+# wiki: the wiki-gate outpost (humans, after Authentik), Traefik (the machine
+# door wiki-index.renner.uno, BasicAuth with X-Authentik-Username stripped) and
+# Gitea (push webhook) may reach it. Gitea and wiki-embed are reached through
+# the namespace egress above; no OpenBao access.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -167,6 +167,9 @@ spec:
         - matchLabels:
             "k8s:io.kubernetes.pod.namespace": authentik
             goauthentik.io/outpost-name: wiki-gate
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ingress
+            app.kubernetes.io/name: traefik
         - matchLabels:
             "k8s:io.kubernetes.pod.namespace": gitea
             app.kubernetes.io/name: gitea