The site is reachable at https://atlas.d-ma.be (NPM proxy-host id 20 → ingress-nginx 10.0.1.20:30080 → cad-atlas svc; LE cert id 26). NPM access_list_id:0 (no gate), mirroring books/tapir — but those gate in-app via Dex OIDC, and cad-atlas has no auth yet. So the homelab's architecture (machines, ports, agentsquad/councils/model names) is currently exposed to the public internet.
Scope — mirror tapir's auth
OIDC middleware in the Go app (Dex at auth.d-ma.be); protect all routes.
Register a Dex client for cad-atlas; store client-id/secret as ExternalSecrets in infrak3s/apps/cad-atlas/ (mirror tapir-dex-client-id/secret-externalsecret.yaml).
Session handling (mirror tapir-session-secret).
Note the NPM-behind issuer gotcha: OIDC issuer must use forwarded headers (brain: wiki/homelab/failures/authentik-oidc-http-issuer-behind-npm-use-forwarded-headers.md).
Interim (until this lands)
Options: (a) accept short public window; (b) add an NPM Access List (basic-auth) on proxy-host 20 as a stopgap. Recommend (b) if the window isn't short.
Blocks / precedes #4 (Gitea integration needs the authenticated user identity).
## Priority — atlas.d-ma.be is live and PUBLIC
The site is reachable at https://atlas.d-ma.be (NPM proxy-host id 20 → ingress-nginx `10.0.1.20:30080` → `cad-atlas` svc; LE cert id 26). NPM `access_list_id:0` (no gate), mirroring books/tapir — but those gate **in-app** via Dex OIDC, and cad-atlas has **no auth yet**. So the homelab's architecture (machines, ports, agentsquad/councils/model names) is currently exposed to the public internet.
## Scope — mirror tapir's auth
- OIDC middleware in the Go app (Dex at `auth.d-ma.be`); protect all routes.
- Register a Dex client for cad-atlas; store client-id/secret as ExternalSecrets in `infra` `k3s/apps/cad-atlas/` (mirror `tapir-dex-client-id/secret-externalsecret.yaml`).
- Session handling (mirror `tapir-session-secret`).
- Note the NPM-behind issuer gotcha: OIDC issuer must use forwarded headers (brain: `wiki/homelab/failures/authentik-oidc-http-issuer-behind-npm-use-forwarded-headers.md`).
## Interim (until this lands)
Options: (a) accept short public window; (b) add an NPM Access List (basic-auth) on proxy-host 20 as a stopgap. Recommend (b) if the window isn't short.
Blocks / precedes #4 (Gitea integration needs the authenticated user identity).
Resolved — gated via Authentik forward-auth, not in-app OIDC
atlas.d-ma.be is now Authentik-only, gated at the edge (ingress-nginx forward-auth → embedded outpost) with zero app code — simpler than the tapir-style in-app Dex OIDC this issue proposed.
Done:
Authentik ProxyProvider cad-atlas (forward_single, external_host https://atlas.d-ma.be) + Application, bound to the embedded outpost.
Set the embedded outpost authentik_host=https://authentik.d-ma.be (was empty → authorize redirected to http://localhost).
ingress-nginx: main ingress auth annotations + no-auth /outpost.goauthentik.io ingress + ExternalName to the outpost. Committed to mathias/infrak3s/apps/cad-atlas/.
Verified: unauth GET / → 302 → Authentik login. Fail-closed.
Caveat: Authentik objects + outpost config are DB state, not GitOps — reproducibility follow-up would be Authentik blueprints. Closing; reopen only if we want the blueprint.
## Resolved — gated via Authentik **forward-auth**, not in-app OIDC
atlas.d-ma.be is now Authentik-only, gated at the edge (ingress-nginx forward-auth → embedded outpost) with **zero app code** — simpler than the tapir-style in-app Dex OIDC this issue proposed.
Done:
- Authentik ProxyProvider `cad-atlas` (forward_single, external_host https://atlas.d-ma.be) + Application, bound to the embedded outpost.
- Set the embedded outpost `authentik_host=https://authentik.d-ma.be` (was empty → authorize redirected to `http://localhost`).
- ingress-nginx: main ingress auth annotations + no-auth `/outpost.goauthentik.io` ingress + ExternalName to the outpost. Committed to `mathias/infra` `k3s/apps/cad-atlas/`.
- Verified: unauth `GET /` → 302 → Authentik login. Fail-closed.
Reusable recipe: brain `wiki/homelab/decisions/authentik-forward-auth-recipe-ingress-nginx.md`.
Caveat: Authentik objects + outpost config are **DB state, not GitOps** — reproducibility follow-up would be Authentik blueprints. Closing; reopen only if we want the blueprint.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Priority — atlas.d-ma.be is live and PUBLIC
The site is reachable at https://atlas.d-ma.be (NPM proxy-host id 20 → ingress-nginx
10.0.1.20:30080→cad-atlassvc; LE cert id 26). NPMaccess_list_id:0(no gate), mirroring books/tapir — but those gate in-app via Dex OIDC, and cad-atlas has no auth yet. So the homelab's architecture (machines, ports, agentsquad/councils/model names) is currently exposed to the public internet.Scope — mirror tapir's auth
auth.d-ma.be); protect all routes.infrak3s/apps/cad-atlas/(mirrortapir-dex-client-id/secret-externalsecret.yaml).tapir-session-secret).wiki/homelab/failures/authentik-oidc-http-issuer-behind-npm-use-forwarded-headers.md).Interim (until this lands)
Options: (a) accept short public window; (b) add an NPM Access List (basic-auth) on proxy-host 20 as a stopgap. Recommend (b) if the window isn't short.
Blocks / precedes #4 (Gitea integration needs the authenticated user identity).
Resolved — gated via Authentik forward-auth, not in-app OIDC
atlas.d-ma.be is now Authentik-only, gated at the edge (ingress-nginx forward-auth → embedded outpost) with zero app code — simpler than the tapir-style in-app Dex OIDC this issue proposed.
Done:
cad-atlas(forward_single, external_host https://atlas.d-ma.be) + Application, bound to the embedded outpost.authentik_host=https://authentik.d-ma.be(was empty → authorize redirected tohttp://localhost)./outpost.goauthentik.ioingress + ExternalName to the outpost. Committed tomathias/infrak3s/apps/cad-atlas/.GET /→ 302 → Authentik login. Fail-closed.Reusable recipe: brain
wiki/homelab/decisions/authentik-forward-auth-recipe-ingress-nginx.md.Caveat: Authentik objects + outpost config are DB state, not GitOps — reproducibility follow-up would be Authentik blueprints. Closing; reopen only if we want the blueprint.