k.rennerandClaude Opus 4.7
f0db3f3293
WebAuthn / FIDO / TOTP credentials are bound to the origin they were registered on (auth.renner.uno). Routing the OAuth flow through paperless.renner.uno meant the browser couldn't release the credential during the 2FA stage. Restructure so the dedicated paperless-gate outpost only serves the in-cluster /outpost.goauthentik.io/auth/nginx endpoint that nginx auth_request hits, while every browser-facing leg of the flow (/start, /callback, the /if/flow login UI, /application/o/authorize, /api, /static, /flows, /media) happens on auth.renner.uno via the embedded outpost. Both outposts have the gate's ProxyProvider attached, so the embedded outpost can issue the OAuth code and the dedicated outpost can validate the resulting cookie. The cookie is renner.uno-scoped so it transfers between the two hosts. Drop the paperless-namespace ExternalName services and the second paperless-gate-outpost Ingress that was routing Authentik UI paths on paperless.renner.uno — no longer needed. Update auth-signin to point at auth.renner.uno. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>