claude-botandClaude Opus 5
aa53335c2b
llm.renner.uno becomes public and is fronted by a dedicated Authentik proxy
outpost. The gate is the entire access control: llama-server has no
authentication of its own and serves the OpenAI API on the same port as the
chat UI, which is exactly why the hostname was LAN-only until now.
Follows the vscode-gate pattern, including its passkey step-up, for the same
reason — what sits behind the gate is unprotected, so the gate is not a second
factor on top of an app login, it is the only one.
The API stays in-cluster. Home Assistant, Paperless and CI address
llama-server.ai.svc.cluster.local:8080 directly, never traverse Traefik or the
outpost, and so need no credentials. Nothing about them changes.
Traefik is deliberately removed from the ai namespace's ingress policy. It
routes the hostname to the outpost and never to llama-server, and dropping the
rule makes that structural: an Ingress pointing straight at the Service, by
accident or otherwise, would simply not connect.
Two details taken from prior gate failures rather than rediscovered:
- No /outpost.goauthentik.io Ingress on auth.renner.uno. Only paperless-gate
has one; the other gates serve those paths on their own host. Adding a
second would have claimed a host+path paperless already owns and broken its
login.
- skip_path_regex covers manifest.webmanifest and sw.js, both of which the
WebUI serves. A manifest is fetched with credentials omitted per the W3C
spec, so it carries no cookie and the gate answers with a redirect, turning
every page load into a round-trip. That is the failure that forced
paperless-gate's carve-out and retired music-assistant-gate outright.
No group and no policy binding: any user who can authenticate gets in, as with
Immich, Audiobookshelf, Home Assistant and Music Assistant. The gates that pin
membership to a named user in git are admin interfaces — code-server over HA
secrets, esphome, zigbee2mqtt, prometheus — where the allowlist is the point. A
chat UI is not one of those, and its membership belongs in the user directory
rather than in a manifest.
The e2e checks move to the Service. They used to drive the public hostname,
which now answers with an Authentik redirect; going in-cluster is also how every
real consumer reaches it. A new check asserts the public hostname bounces an
anonymous request, so a regression that let Traefik reach llama-server directly
would fail rather than pass quietly.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
32 lines
1.1 KiB
YAML
32 lines
1.1 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- externalsecret.yaml
|
|
- samba-bridge-externalsecret.yaml
|
|
- blueprints-configmap.yaml
|
|
- helmrelease.yaml
|
|
- paperless-gate-ingress.yaml
|
|
- paperless-gate-egress.yaml
|
|
- vscode-gate-egress.yaml
|
|
- shelly-manager-gate-egress.yaml
|
|
- esphome-gate-egress.yaml
|
|
- zigbee2mqtt-gate-egress.yaml
|
|
- zone-configurator-gate-egress.yaml
|
|
- alertmanager-gate-egress.yaml
|
|
- prometheus-gate-egress.yaml
|
|
- wordpress-gate-egress.yaml
|
|
- llama-gate-egress.yaml
|
|
- outpost-servicemonitors.yaml
|
|
- ldap-outpost-cert.yaml
|
|
- ldap-outpost-lb.yaml
|
|
- ldap-outpost-cnp.yaml
|
|
# ak-pg CNPG Postgres backend (moved here from the retired seed-authentik KS;
|
|
# each carries prune: disabled so ownership transferred without a teardown).
|
|
# authentik has no data PVCs — all state lives in ak-pg. This KS gains the
|
|
# infrastructure-cnpg-barman dep + CNPG Cluster healthCheckExprs (see
|
|
# clusters/homelab/authentik.yaml).
|
|
- cluster.yaml
|
|
- objectstore.yaml
|
|
- scheduled-backup.yaml
|
|
- hetzner-creds-externalsecret.yaml
|