claude-botandClaude Opus 5.5
0b7a2b6c46
The gate is now declared on the app's own traefik Ingress: naming the static Middleware authentik/gate (ForwardAuth against the embedded outpost) in router.middlewares opts in, and its auth.renner.uno/* annotations configure it. No generated route Ingress, ExternalName Service or per-gate Middleware; the IngressClass authentik-gate is gone. authentik-gate-sync keeps building the Authentik side (forward_single provider on the embedded outpost, application, group policy) and the backend CNP admitting Traefik, and sweeps the objects it generated before. Traefik publishes the Ingress status itself. The outpost's own paths (/outpost.goauthentik.io/) are one static IngressRoute above the app routes. The embedded outpost answers 404 for a host without a provider (checked live: auth/traefik with X-Forwarded-Host no-such-gate.renner.uno), so a gate without its provider stays closed. docs.renner.uno points at paperless:80 behind redirect + gate (Paperless Users) instead of the removed paperless-gate Service. Drops __pycache__ committed by mistake. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>