claude-botandClaude Opus 5.5
67a1eb2ba5
Stage 2 of unifying the auth flows, after the llama and paperless trial of stage 1 was confirmed: - Brand authentik.srv.renner.uno: flow_authentication = sso-authentication (was NULL, i.e. the slug-first default-authentication-flow with password + MFA). Every provider without its own authentication_flow logs in through it, PVE and PBS included. - The 7 blueprint OIDC providers (Home Assistant, NetBird, Audiobookshelf, Immich, Gitea, Grafana, Matrix MAS): authentication flow unset (brand), authorization implicit consent. - authentik-gate-sync: default authorization flow implicit consent, via DEFAULT_AUTHORIZATION_FLOW on the Deployment and in the code; the per-gate login/authorization annotations are dropped. Paperless keeps paperless-authorization. Every flow referenced here already exists, so the gate controller does not hit the missing-flow removal seen in stage 1. Stage 3 removes the passkey-only flows once nothing references them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
98 lines
2.9 KiB
YAML
98 lines
2.9 KiB
YAML
# Two routers on one host. The site itself must stay readable by anyone --
|
|
# it is a family blog -- while the editing surface sits behind Authentik.
|
|
#
|
|
# Why not one gated Ingress with a skip-path, the way paperless carves out
|
|
# /static/: that works when the PUBLIC paths are enumerable. Here
|
|
# it is the reverse -- every post URL is public and only two paths are gated
|
|
# -- which would need a negative lookahead. The outpost is Go, and RE2 has no
|
|
# lookahead. So the split happens at the router instead.
|
|
#
|
|
# Traefik orders routers by rule length, so PathPrefix(`/wp-admin`) is
|
|
# evaluated before PathPrefix(`/`); no explicit priority is needed.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: wordpress
|
|
namespace: wordpress
|
|
labels:
|
|
dns.renner.uno/public: "true"
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-cluster
|
|
spec:
|
|
ingressClassName: traefik
|
|
rules:
|
|
- host: www.renner.uno
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: wordpress
|
|
port:
|
|
number: 80
|
|
tls:
|
|
- secretName: wordpress-tls
|
|
hosts:
|
|
- www.renner.uno
|
|
---
|
|
# wp-admin, wp-login.php, xmlrpc.php and the outpost's own OAuth leg
|
|
# (/outpost.goauthentik.io) are gated by authentik-gate-sync (ingress class
|
|
# authentik-gate): WordPress Authors only. The public Ingress above owns the
|
|
# Certificate for wordpress-tls.
|
|
#
|
|
# /wp-admin covers admin-ajax.php, which is safe because no plugin on the site
|
|
# emits an ajaxurl. xmlrpc.php goes through the gate because an Ingress has no
|
|
# deny verb.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: wordpress-admin
|
|
namespace: wordpress
|
|
labels:
|
|
# external-dns-unifi runs with --label-filter=dns.renner.uno/public!=true,
|
|
# so an unlabelled Ingress on this host would gain a UDM A-record pointing
|
|
# LAN clients at the Traefik VIP.
|
|
dns.renner.uno/public: "true"
|
|
annotations:
|
|
auth.renner.uno/group: WordPress Authors
|
|
spec:
|
|
ingressClassName: authentik-gate
|
|
tls:
|
|
- secretName: wordpress-tls
|
|
hosts:
|
|
- www.renner.uno
|
|
rules:
|
|
- host: www.renner.uno
|
|
http:
|
|
paths:
|
|
- path: /outpost.goauthentik.io
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: wordpress
|
|
port:
|
|
number: 80
|
|
# anchor: gated-paths
|
|
- path: /wp-admin
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: wordpress
|
|
port:
|
|
number: 80
|
|
- path: /wp-login.php
|
|
pathType: Exact
|
|
backend:
|
|
service:
|
|
name: wordpress
|
|
port:
|
|
number: 80
|
|
- path: /xmlrpc.php
|
|
pathType: Exact
|
|
backend:
|
|
service:
|
|
name: wordpress
|
|
port:
|
|
number: 80
|