mirror of
https://github.com/allaunthefox/Research-Stack.git
synced 2026-07-31 03:05:21 +00:00
38f1022a20
Port conflict resolution: - Add HelmChartConfig to pin Traefik web entrypoint to NodePort 30080 (not host :80) so k3s Traefik and host Caddy do not race for the port - Add host Caddy on :80 as a minimal pass-through to Traefik :30080; carries X-Forwarded-* headers so Traefik sees the real client IP and the correct Host. No TLS, no Porkbun, no subdomain logic — all of that stays on the edge Caddy (k3s-edge.nix) - Caddy after= k3s.service so Traefik NodePort is ready before proxying Authentik port fix: - Change authentik server + worker services from NodePort 30080 to ClusterIP; Traefik reaches Authentik via the rs-auth Ingress and cluster DNS, no NodePort required New manifests (internal, no public-traffic impact): - manifests/ingress/: Traefik Ingress resources + Middleware CRDs (/apps/*, /server/* → forward_auth + strip-prefix; /api/* → strip only; / → Homer + forward_auth; auth.* → Authentik, no middleware) - manifests/hermes/: placeholder chat/orchestrator service - manifests/credential-server/: token-auth credential vault stub - manifests/control-plane/: registry-api, jobs-api, blobs-api health stubs - manifests/homer/configmap.yaml: updated dashboard links to canonical paths Deploy order: rebuild k3s-server first, verify Traefik + Ingress internally, then deploy k3s-edge (commit 3 / next step). Generated with Devin (https://cli.devin.ai/docs) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
81 lines
2.2 KiB
YAML
81 lines
2.2 KiB
YAML
apiVersion: helm.cattle.io/v1
|
|
kind: HelmChart
|
|
metadata:
|
|
name: authentik
|
|
namespace: services
|
|
spec:
|
|
chart: authentik
|
|
repo: https://goauthentik.github.io/helm
|
|
targetNamespace: services
|
|
version: "2026.5.0"
|
|
valuesContent: |
|
|
authentik:
|
|
existingSecret:
|
|
secretName: authentik-env
|
|
postgresql:
|
|
enabled: true
|
|
global:
|
|
postgresql:
|
|
auth:
|
|
existingSecret: authentik-secrets
|
|
secretKeys:
|
|
adminPasswordKey: postgresql-password
|
|
userPasswordKey: postgresql-password
|
|
primary:
|
|
persistence:
|
|
size: 8Gi
|
|
nodeAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
nodeSelectorTerms:
|
|
- matchExpressions:
|
|
- key: topology.researchstack.io/role
|
|
operator: In
|
|
values:
|
|
- core
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Equal
|
|
value: "true"
|
|
effect: NoSchedule
|
|
redis:
|
|
enabled: true
|
|
master:
|
|
persistence:
|
|
size: 2Gi
|
|
nodeAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
nodeSelectorTerms:
|
|
- matchExpressions:
|
|
- key: topology.researchstack.io/role
|
|
operator: In
|
|
values:
|
|
- core
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Equal
|
|
value: "true"
|
|
effect: NoSchedule
|
|
server:
|
|
nodeSelector:
|
|
kubernetes.io/hostname: steamdeck
|
|
resources:
|
|
requests:
|
|
memory: 256Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 512Mi
|
|
service:
|
|
# ClusterIP — Traefik reaches Authentik via cluster DNS through the
|
|
# rs-auth Ingress (manifests/ingress/ingress.yaml). No NodePort needed.
|
|
type: ClusterIP
|
|
worker:
|
|
nodeSelector:
|
|
kubernetes.io/hostname: steamdeck
|
|
resources:
|
|
requests:
|
|
memory: 256Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 512Mi
|
|
service:
|
|
type: ClusterIP
|