mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
VPS-standby: force HTTPS redirect on all 5 Traefik ingresses
Root cause of the Vault OIDC 'Missing auth_url' error (and the same symptom on every other VPS-standby app): the Ingress tls: block makes HTTPS available but Traefik still serves plain HTTP on the same host too - nothing was forcing the redirect. A browser landing on http://vault.vps.huskypup.net gets a Vault UI that computes its OIDC callback using window.location.origin (http://...), which doesn't match the https:// entry in allowed_redirect_uris - Vault silently returns an empty auth_url rather than an obviously-config-looking error. Confirmed via a HAR capture of the actual failing browser request. Adds a per-namespace Traefik Middleware (redirectScheme -> https, permanent) referenced via router.middlewares on each Ingress. Applied directly via kubectl first to test - ArgoCD's selfHeal immediately reverted it since it wasn't in git yet, confirming the fix needs to ship through the normal pipeline rather than live kubectl edits on ArgoCD- managed VPS resources. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Scooby Husky
co-authored by
Claude Sonnet 5
Claude Sonnet 5
parent
bb749b32b9
commit
220cdfb00a
@@ -1,6 +1,9 @@
|
||||
---
|
||||
# See infrastructure/vps-standby/vault/manifests/ingress.yaml for the
|
||||
# vps.huskypup.net subdomain design rationale.
|
||||
# vps.huskypup.net subdomain design rationale, and for why this
|
||||
# https-redirect Middleware is needed (found live 2026-08-21 diagnosing
|
||||
# the exact same "Missing auth_url"-shaped symptom on Vault's OIDC login -
|
||||
# applies equally to every VPS-standby app on this Traefik).
|
||||
#
|
||||
# CAVEAT: Authentik's provider/application configs (redirect_uris, etc.)
|
||||
# are replicated byte-for-byte from home and point at *.kube.huskypup.net
|
||||
@@ -8,6 +11,16 @@
|
||||
# won't complete correctly (redirect mismatch) until that's addressed
|
||||
# separately. Direct/local Authentik admin login still works fine for
|
||||
# browsing and verifying replicated data.
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: https-redirect
|
||||
namespace: authentik
|
||||
spec:
|
||||
redirectScheme:
|
||||
scheme: https
|
||||
permanent: true
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
@@ -15,6 +28,7 @@ metadata:
|
||||
namespace: authentik
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-production
|
||||
traefik.ingress.kubernetes.io/router.middlewares: authentik-https-redirect@kubernetescrd
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
tls:
|
||||
|
||||
@@ -1,6 +1,18 @@
|
||||
---
|
||||
# See infrastructure/vps-standby/vault/manifests/ingress.yaml for the
|
||||
# vps.huskypup.net subdomain design rationale.
|
||||
# vps.huskypup.net subdomain design rationale, and for why this
|
||||
# https-redirect Middleware is needed (found live 2026-08-21 diagnosing
|
||||
# the exact same symptom on this app's OIDC login).
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: https-redirect
|
||||
namespace: gitea
|
||||
spec:
|
||||
redirectScheme:
|
||||
scheme: https
|
||||
permanent: true
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
@@ -8,6 +20,7 @@ metadata:
|
||||
namespace: gitea
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-production
|
||||
traefik.ingress.kubernetes.io/router.middlewares: gitea-https-redirect@kubernetescrd
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
tls:
|
||||
|
||||
@@ -1,6 +1,18 @@
|
||||
---
|
||||
# See infrastructure/vps-standby/vault/manifests/ingress.yaml for the
|
||||
# vps.huskypup.net subdomain design rationale.
|
||||
# vps.huskypup.net subdomain design rationale, and for why this
|
||||
# https-redirect Middleware is needed (found live 2026-08-21 diagnosing
|
||||
# the exact same symptom on this app's OIDC login).
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: https-redirect
|
||||
namespace: n8n
|
||||
spec:
|
||||
redirectScheme:
|
||||
scheme: https
|
||||
permanent: true
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
@@ -8,6 +20,7 @@ metadata:
|
||||
namespace: n8n
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-production
|
||||
traefik.ingress.kubernetes.io/router.middlewares: n8n-https-redirect@kubernetescrd
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
tls:
|
||||
|
||||
@@ -1,6 +1,18 @@
|
||||
---
|
||||
# See infrastructure/vps-standby/vault/manifests/ingress.yaml for the
|
||||
# vps.huskypup.net subdomain design rationale.
|
||||
# vps.huskypup.net subdomain design rationale, and for why this
|
||||
# https-redirect Middleware is needed (found live 2026-08-21 diagnosing
|
||||
# the exact same symptom on this app's OIDC login).
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: https-redirect
|
||||
namespace: nextcloud
|
||||
spec:
|
||||
redirectScheme:
|
||||
scheme: https
|
||||
permanent: true
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
@@ -8,6 +20,7 @@ metadata:
|
||||
namespace: nextcloud
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-production
|
||||
traefik.ingress.kubernetes.io/router.middlewares: nextcloud-https-redirect@kubernetescrd
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
tls:
|
||||
|
||||
@@ -4,6 +4,29 @@
|
||||
# (vault.vps.huskypup.net) that doesn't depend on home being up at all -
|
||||
# see the vps.huskypup.net subdomain design note in
|
||||
# infrastructure/vps-standby/cert-manager/manifests/cluster-issuer.yaml.
|
||||
#
|
||||
# https-redirect Middleware: found live 2026-08-21 that this Ingress's
|
||||
# tls: block makes HTTPS available but does NOT stop Traefik from ALSO
|
||||
# serving plain HTTP on the same host - a browser landing on
|
||||
# http://vault.vps.huskypup.net (no redirect) gets a Vault UI that
|
||||
# computes its OIDC callback URL using window.location.origin, i.e.
|
||||
# http://..., which doesn't match the https:// entry registered in
|
||||
# allowed_redirect_uris (auth/oidc/role/default) - Vault silently returns
|
||||
# an empty auth_url ("Missing auth_url" in the UI) rather than an
|
||||
# obviously-DNS/config-looking error. Applies to every VPS-standby app on
|
||||
# this same Traefik, not just Vault (same fix needed and applied in each
|
||||
# of infrastructure/vps-standby/{gitea,n8n,nextcloud,authentik}/manifests/
|
||||
# ingress.yaml too).
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: https-redirect
|
||||
namespace: vault
|
||||
spec:
|
||||
redirectScheme:
|
||||
scheme: https
|
||||
permanent: true
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
@@ -11,6 +34,7 @@ metadata:
|
||||
namespace: vault
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-production
|
||||
traefik.ingress.kubernetes.io/router.middlewares: vault-https-redirect@kubernetescrd
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
tls:
|
||||
|
||||
Reference in New Issue
Block a user