Scooby HuskyandClaude Sonnet 5 220cdfb00a VPS-standby: force HTTPS redirect on all 5 Traefik ingresses ...

Root cause of the Vault OIDC 'Missing auth_url' error (and the same
symptom on every other VPS-standby app): the Ingress tls: block makes
HTTPS available but Traefik still serves plain HTTP on the same host too
- nothing was forcing the redirect. A browser landing on
http://vault.vps.huskypup.net gets a Vault UI that computes its OIDC
callback using window.location.origin (http://...), which doesn't match
the https:// entry in allowed_redirect_uris - Vault silently returns an
empty auth_url rather than an obviously-config-looking error. Confirmed
via a HAR capture of the actual failing browser request.

Adds a per-namespace Traefik Middleware (redirectScheme -> https,
permanent) referenced via router.middlewares on each Ingress. Applied
directly via kubectl first to test - ArgoCD's selfHeal immediately
reverted it since it wasn't in git yet, confirming the fix needs to ship
through the normal pipeline rather than live kubectl edits on ArgoCD-
managed VPS resources.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-08-20 20:58:40 -05:00

..

ingress.yaml

VPS-standby: force HTTPS redirect on all 5 Traefik ingresses

2026-08-20 20:58:40 -05:00

restore-cronjob.yaml

Optimize vault-restore: don't wait on condition=Ready (verified working already)

2026-08-17 21:57:52 -05:00