claude-botandClaude Opus 5
fb3724f603
Verified against the deployed cluster: GET /wp-admin/ correctly 302s to https://www.renner.uno/outpost.goauthentik.io/start?rd=... — and that URL returned WordPress's 404 page, because /outpost.goauthentik.io fell through to the public '/' prefix router. The effect was that /wp-admin was unreachable rather than protected. An attacker gains nothing, but neither does the editor the gate exists for. paperless needs the same route and solves it with a separate Ingress on auth.renner.uno (apps/authentik/paperless-gate-ingress.yaml). Here the whole flow stays on www.renner.uno, so the path belongs in this rule set. These endpoints are the login flow itself and are served by the outpost, so routing them to it is not an authentication hole. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014giKN9N6e5J2DF8QZmVh98