mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby HuskyandClaude Sonnet 5
220cdfb00a
Root cause of the Vault OIDC 'Missing auth_url' error (and the same symptom on every other VPS-standby app): the Ingress tls: block makes HTTPS available but Traefik still serves plain HTTP on the same host too - nothing was forcing the redirect. A browser landing on http://vault.vps.huskypup.net gets a Vault UI that computes its OIDC callback using window.location.origin (http://...), which doesn't match the https:// entry in allowed_redirect_uris - Vault silently returns an empty auth_url rather than an obviously-config-looking error. Confirmed via a HAR capture of the actual failing browser request. Adds a per-namespace Traefik Middleware (redirectScheme -> https, permanent) referenced via router.middlewares on each Ingress. Applied directly via kubectl first to test - ArgoCD's selfHeal immediately reverted it since it wasn't in git yet, confirming the fix needs to ship through the normal pipeline rather than live kubectl edits on ArgoCD- managed VPS resources. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>