From 220cdfb00a501f792804d59286acd593063a9e8e Mon Sep 17 00:00:00 2001 From: Scooby Husky Date: Thu, 20 Aug 2026 20:58:40 -0500 Subject: [PATCH] VPS-standby: force HTTPS redirect on all 5 Traefik ingresses Root cause of the Vault OIDC 'Missing auth_url' error (and the same symptom on every other VPS-standby app): the Ingress tls: block makes HTTPS available but Traefik still serves plain HTTP on the same host too - nothing was forcing the redirect. A browser landing on http://vault.vps.huskypup.net gets a Vault UI that computes its OIDC callback using window.location.origin (http://...), which doesn't match the https:// entry in allowed_redirect_uris - Vault silently returns an empty auth_url rather than an obviously-config-looking error. Confirmed via a HAR capture of the actual failing browser request. Adds a per-namespace Traefik Middleware (redirectScheme -> https, permanent) referenced via router.middlewares on each Ingress. Applied directly via kubectl first to test - ArgoCD's selfHeal immediately reverted it since it wasn't in git yet, confirming the fix needs to ship through the normal pipeline rather than live kubectl edits on ArgoCD- managed VPS resources. Co-Authored-By: Claude Sonnet 5 --- .../authentik/manifests/ingress.yaml | 16 ++++++++++++- .../vps-standby/gitea/manifests/ingress.yaml | 15 +++++++++++- .../vps-standby/n8n/manifests/ingress.yaml | 15 +++++++++++- .../nextcloud/manifests/ingress.yaml | 15 +++++++++++- .../vps-standby/vault/manifests/ingress.yaml | 24 +++++++++++++++++++ 5 files changed, 81 insertions(+), 4 deletions(-) diff --git a/infrastructure/vps-standby/authentik/manifests/ingress.yaml b/infrastructure/vps-standby/authentik/manifests/ingress.yaml index 0d1a825..3a68d2b 100644 --- a/infrastructure/vps-standby/authentik/manifests/ingress.yaml +++ b/infrastructure/vps-standby/authentik/manifests/ingress.yaml @@ -1,6 +1,9 @@ --- # See infrastructure/vps-standby/vault/manifests/ingress.yaml for the -# vps.huskypup.net subdomain design rationale. +# vps.huskypup.net subdomain design rationale, and for why this +# https-redirect Middleware is needed (found live 2026-08-21 diagnosing +# the exact same "Missing auth_url"-shaped symptom on Vault's OIDC login - +# applies equally to every VPS-standby app on this Traefik). # # CAVEAT: Authentik's provider/application configs (redirect_uris, etc.) # are replicated byte-for-byte from home and point at *.kube.huskypup.net @@ -8,6 +11,16 @@ # won't complete correctly (redirect mismatch) until that's addressed # separately. Direct/local Authentik admin login still works fine for # browsing and verifying replicated data. +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: https-redirect + namespace: authentik +spec: + redirectScheme: + scheme: https + permanent: true +--- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: @@ -15,6 +28,7 @@ metadata: namespace: authentik annotations: cert-manager.io/cluster-issuer: letsencrypt-production + traefik.ingress.kubernetes.io/router.middlewares: authentik-https-redirect@kubernetescrd spec: ingressClassName: traefik tls: diff --git a/infrastructure/vps-standby/gitea/manifests/ingress.yaml b/infrastructure/vps-standby/gitea/manifests/ingress.yaml index a0bb9f2..008507b 100644 --- a/infrastructure/vps-standby/gitea/manifests/ingress.yaml +++ b/infrastructure/vps-standby/gitea/manifests/ingress.yaml @@ -1,6 +1,18 @@ --- # See infrastructure/vps-standby/vault/manifests/ingress.yaml for the -# vps.huskypup.net subdomain design rationale. +# vps.huskypup.net subdomain design rationale, and for why this +# https-redirect Middleware is needed (found live 2026-08-21 diagnosing +# the exact same symptom on this app's OIDC login). +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: https-redirect + namespace: gitea +spec: + redirectScheme: + scheme: https + permanent: true +--- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: @@ -8,6 +20,7 @@ metadata: namespace: gitea annotations: cert-manager.io/cluster-issuer: letsencrypt-production + traefik.ingress.kubernetes.io/router.middlewares: gitea-https-redirect@kubernetescrd spec: ingressClassName: traefik tls: diff --git a/infrastructure/vps-standby/n8n/manifests/ingress.yaml b/infrastructure/vps-standby/n8n/manifests/ingress.yaml index 17f09c8..f19eef9 100644 --- a/infrastructure/vps-standby/n8n/manifests/ingress.yaml +++ b/infrastructure/vps-standby/n8n/manifests/ingress.yaml @@ -1,6 +1,18 @@ --- # See infrastructure/vps-standby/vault/manifests/ingress.yaml for the -# vps.huskypup.net subdomain design rationale. +# vps.huskypup.net subdomain design rationale, and for why this +# https-redirect Middleware is needed (found live 2026-08-21 diagnosing +# the exact same symptom on this app's OIDC login). +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: https-redirect + namespace: n8n +spec: + redirectScheme: + scheme: https + permanent: true +--- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: @@ -8,6 +20,7 @@ metadata: namespace: n8n annotations: cert-manager.io/cluster-issuer: letsencrypt-production + traefik.ingress.kubernetes.io/router.middlewares: n8n-https-redirect@kubernetescrd spec: ingressClassName: traefik tls: diff --git a/infrastructure/vps-standby/nextcloud/manifests/ingress.yaml b/infrastructure/vps-standby/nextcloud/manifests/ingress.yaml index ac40c04..e647fac 100644 --- a/infrastructure/vps-standby/nextcloud/manifests/ingress.yaml +++ b/infrastructure/vps-standby/nextcloud/manifests/ingress.yaml @@ -1,6 +1,18 @@ --- # See infrastructure/vps-standby/vault/manifests/ingress.yaml for the -# vps.huskypup.net subdomain design rationale. +# vps.huskypup.net subdomain design rationale, and for why this +# https-redirect Middleware is needed (found live 2026-08-21 diagnosing +# the exact same symptom on this app's OIDC login). +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: https-redirect + namespace: nextcloud +spec: + redirectScheme: + scheme: https + permanent: true +--- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: @@ -8,6 +20,7 @@ metadata: namespace: nextcloud annotations: cert-manager.io/cluster-issuer: letsencrypt-production + traefik.ingress.kubernetes.io/router.middlewares: nextcloud-https-redirect@kubernetescrd spec: ingressClassName: traefik tls: diff --git a/infrastructure/vps-standby/vault/manifests/ingress.yaml b/infrastructure/vps-standby/vault/manifests/ingress.yaml index 7ee9d3e..54eb5e2 100644 --- a/infrastructure/vps-standby/vault/manifests/ingress.yaml +++ b/infrastructure/vps-standby/vault/manifests/ingress.yaml @@ -4,6 +4,29 @@ # (vault.vps.huskypup.net) that doesn't depend on home being up at all - # see the vps.huskypup.net subdomain design note in # infrastructure/vps-standby/cert-manager/manifests/cluster-issuer.yaml. +# +# https-redirect Middleware: found live 2026-08-21 that this Ingress's +# tls: block makes HTTPS available but does NOT stop Traefik from ALSO +# serving plain HTTP on the same host - a browser landing on +# http://vault.vps.huskypup.net (no redirect) gets a Vault UI that +# computes its OIDC callback URL using window.location.origin, i.e. +# http://..., which doesn't match the https:// entry registered in +# allowed_redirect_uris (auth/oidc/role/default) - Vault silently returns +# an empty auth_url ("Missing auth_url" in the UI) rather than an +# obviously-DNS/config-looking error. Applies to every VPS-standby app on +# this same Traefik, not just Vault (same fix needed and applied in each +# of infrastructure/vps-standby/{gitea,n8n,nextcloud,authentik}/manifests/ +# ingress.yaml too). +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: https-redirect + namespace: vault +spec: + redirectScheme: + scheme: https + permanent: true +--- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: @@ -11,6 +34,7 @@ metadata: namespace: vault annotations: cert-manager.io/cluster-issuer: letsencrypt-production + traefik.ingress.kubernetes.io/router.middlewares: vault-https-redirect@kubernetescrd spec: ingressClassName: traefik tls: