mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby HuskyandClaude Sonnet 5
220cdfb00a
Root cause of the Vault OIDC 'Missing auth_url' error (and the same symptom on every other VPS-standby app): the Ingress tls: block makes HTTPS available but Traefik still serves plain HTTP on the same host too - nothing was forcing the redirect. A browser landing on http://vault.vps.huskypup.net gets a Vault UI that computes its OIDC callback using window.location.origin (http://...), which doesn't match the https:// entry in allowed_redirect_uris - Vault silently returns an empty auth_url rather than an obviously-config-looking error. Confirmed via a HAR capture of the actual failing browser request. Adds a per-namespace Traefik Middleware (redirectScheme -> https, permanent) referenced via router.middlewares on each Ingress. Applied directly via kubectl first to test - ArgoCD's selfHeal immediately reverted it since it wasn't in git yet, confirming the fix needs to ship through the normal pipeline rather than live kubectl edits on ArgoCD- managed VPS resources. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
49 lines
1.5 KiB
YAML
49 lines
1.5 KiB
YAML
---
|
|
# See infrastructure/vps-standby/vault/manifests/ingress.yaml for the
|
|
# vps.huskypup.net subdomain design rationale, and for why this
|
|
# https-redirect Middleware is needed (found live 2026-08-21 diagnosing
|
|
# the exact same "Missing auth_url"-shaped symptom on Vault's OIDC login -
|
|
# applies equally to every VPS-standby app on this Traefik).
|
|
#
|
|
# CAVEAT: Authentik's provider/application configs (redirect_uris, etc.)
|
|
# are replicated byte-for-byte from home and point at *.kube.huskypup.net
|
|
# - SSO logins between VPS-hosted apps and this VPS Authentik instance
|
|
# won't complete correctly (redirect mismatch) until that's addressed
|
|
# separately. Direct/local Authentik admin login still works fine for
|
|
# browsing and verifying replicated data.
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: https-redirect
|
|
namespace: authentik
|
|
spec:
|
|
redirectScheme:
|
|
scheme: https
|
|
permanent: true
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: vps-authentik
|
|
namespace: authentik
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-production
|
|
traefik.ingress.kubernetes.io/router.middlewares: authentik-https-redirect@kubernetescrd
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- auth.vps.huskypup.net
|
|
secretName: vps-authentik-tls
|
|
rules:
|
|
- host: auth.vps.huskypup.net
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: vps-authentik-server
|
|
port:
|
|
number: 80
|