mirror of
https://github.com/allaunthefox/Research-Stack.git
synced 2026-07-31 03:05:21 +00:00
cfa43cf07f
Port conflict resolution: - Add HelmChartConfig to pin Traefik web entrypoint to NodePort 30080 (not host :80) so k3s Traefik and host Caddy do not race for the port - Add host Caddy on :80 as a minimal pass-through to Traefik :30080; carries X-Forwarded-* headers so Traefik sees the real client IP and the correct Host. No TLS, no Porkbun, no subdomain logic — all of that stays on the edge Caddy (k3s-edge.nix) - Caddy after= k3s.service so Traefik NodePort is ready before proxying Authentik port fix: - Change authentik server + worker services from NodePort 30080 to ClusterIP; Traefik reaches Authentik via the rs-auth Ingress and cluster DNS, no NodePort required New manifests (internal, no public-traffic impact): - manifests/ingress/: Traefik Ingress resources + Middleware CRDs (/apps/*, /server/* → forward_auth + strip-prefix; /api/* → strip only; / → Homer + forward_auth; auth.* → Authentik, no middleware) - manifests/hermes/: placeholder chat/orchestrator service - manifests/credential-server/: token-auth credential vault stub - manifests/control-plane/: registry-api, jobs-api, blobs-api health stubs - manifests/homer/configmap.yaml: updated dashboard links to canonical paths Deploy order: rebuild k3s-server first, verify Traefik + Ingress internally, then deploy k3s-edge (commit 3 / next step). Generated with Devin (https://cli.devin.ai/docs) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
120 lines
2.5 KiB
YAML
120 lines
2.5 KiB
YAML
# Traefik middlewares for the Research Stack Ingress
|
|
#
|
|
# forward-auth: Authentik SSO gate (applied to /apps/*, /server/*)
|
|
# strip-apps-chat: strip /apps/chat prefix before forwarding to Hermes
|
|
# strip-apps-budget: strip /apps/budget prefix
|
|
# strip-server-status: strip /server/status prefix
|
|
# strip-server-dash: strip /server/dash prefix
|
|
# strip-server-vault: strip /server/vault prefix
|
|
# strip-api-cred: strip /api/cred prefix
|
|
# strip-api-registry: strip /api/registry prefix
|
|
# strip-api-jobs: strip /api/jobs prefix
|
|
# strip-api-blobs: strip /api/blobs prefix
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: authentik-forward-auth
|
|
namespace: services
|
|
spec:
|
|
forwardAuth:
|
|
address: http://authentik.services.svc.cluster.local/outpost.goauthentik.io/auth/caddy
|
|
authResponseHeaders:
|
|
- X-Authentik-Username
|
|
- X-Authentik-Email
|
|
- X-Authentik-Name
|
|
- X-Authentik-Uid
|
|
- X-Authentik-Jwt
|
|
- X-Authentik-Meta-Jwt
|
|
- X-Authentik-Meta-App
|
|
- X-Authentik-Meta-Version
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: strip-apps-chat
|
|
namespace: services
|
|
spec:
|
|
stripPrefix:
|
|
prefixes:
|
|
- /apps/chat
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: strip-apps-budget
|
|
namespace: services
|
|
spec:
|
|
stripPrefix:
|
|
prefixes:
|
|
- /apps/budget
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: strip-server-status
|
|
namespace: services
|
|
spec:
|
|
stripPrefix:
|
|
prefixes:
|
|
- /server/status
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: strip-server-dash
|
|
namespace: services
|
|
spec:
|
|
stripPrefix:
|
|
prefixes:
|
|
- /server/dash
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: strip-server-vault
|
|
namespace: services
|
|
spec:
|
|
stripPrefix:
|
|
prefixes:
|
|
- /server/vault
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: strip-api-cred
|
|
namespace: services
|
|
spec:
|
|
stripPrefix:
|
|
prefixes:
|
|
- /api/cred
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: strip-api-registry
|
|
namespace: services
|
|
spec:
|
|
stripPrefix:
|
|
prefixes:
|
|
- /api/registry
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: strip-api-jobs
|
|
namespace: services
|
|
spec:
|
|
stripPrefix:
|
|
prefixes:
|
|
- /api/jobs
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: strip-api-blobs
|
|
namespace: services
|
|
spec:
|
|
stripPrefix:
|
|
prefixes:
|
|
- /api/blobs
|