Port conflict resolution:
- Add HelmChartConfig to pin Traefik web entrypoint to NodePort 30080
(not host :80) so k3s Traefik and host Caddy do not race for the port
- Add host Caddy on :80 as a minimal pass-through to Traefik :30080;
carries X-Forwarded-* headers so Traefik sees the real client IP and
the correct Host. No TLS, no Porkbun, no subdomain logic — all of
that stays on the edge Caddy (k3s-edge.nix)
- Caddy after= k3s.service so Traefik NodePort is ready before proxying
Authentik port fix:
- Change authentik server + worker services from NodePort 30080 to
ClusterIP; Traefik reaches Authentik via the rs-auth Ingress and
cluster DNS, no NodePort required
New manifests (internal, no public-traffic impact):
- manifests/ingress/: Traefik Ingress resources + Middleware CRDs
(/apps/*, /server/* → forward_auth + strip-prefix; /api/* → strip only;
/ → Homer + forward_auth; auth.* → Authentik, no middleware)
- manifests/hermes/: placeholder chat/orchestrator service
- manifests/credential-server/: token-auth credential vault stub
- manifests/control-plane/: registry-api, jobs-api, blobs-api health stubs
- manifests/homer/configmap.yaml: updated dashboard links to canonical paths
Deploy order: rebuild k3s-server first, verify Traefik + Ingress
internally, then deploy k3s-edge (commit 3 / next step).
Generated with Devin (https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Tests the full traffic path against live researchstack.info infrastructure:
Edge Caddy (TLS) → Tailscale → Traefik Ingress → k3s services
Coverage:
- edge-tls-redirects: HTTPS reachability, cert validity, legacy subdomain
301s (status/dash/home/media/books/music/vault/pulse/apps), stable
subdomains (auth, mail), wildcard fallback
- path-routing: /apps/*, /server/*, /api/* routes; prefix stripping; SSO
redirect vs token-auth isolation
- auth-integration: Authentik login page, OIDC discovery, forward_auth
gating on protected paths, /api/* bypass
19/40 tests pass against current live infrastructure (pre-deploy). The 21
failures are "not yet deployed" signals, not design errors. Run after each
phase of the deployment plan to use as a regression gate.
Run: cd 4-Infrastructure/k3s-flake/tests && npm test
Generated with Devin (https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
