Reference: riotpiao.com action run 496/707
Unified structure:
- test job: all branches + PRs
- build-push job: main push only, depends on test
- Install Node.js before checkout
- Install docker only in build-push
- Proper secrets and env handling
- Docker login + build + push + prune
Container override breaks docker socket access to dind sidecar.
Changes:
- Remove 'container: image: golang:1.26-bookworm'
- Install Node.js before checkout (required by actions runtime)
- Install docker.io in build step (required for docker build/push)
Now works with shared docker socket via dind sidecar.
## Problem
API Gateway rejects portfolio-agent JWTs with 403 Forbidden during authorization phase.
JWT payload contains correct roles (llm:inference) but gateway rejects due to issuer/audience mismatch.
**JWT received**:
```json
{
"iss": "https://authentik.riotpiao.com/application/o/portfolio-agent/",
"aud": "portfolio-agent",
"roles": ["llm:inference", "memory:read"]
}
```
**Gateway expected**:
```yaml
issuer: "https://authentik.riotpiao.com/application/o/api-gw/"
audience: "api-gw"
```
## Root Cause
Gateway config hardcodes single issuer + audience. Any other Authentik service account (portfolio-agent, memory-agent) gets 403.
## Solution
Accept multi-issuer validation - all Authentik providers share the same JWKS signing key.
**Security analysis**:
- All Authentik providers sign with same private key → multi-issuer is cryptographically sound
- JWT signature still validated against JWKS
- Roles/permissions immutable in JWT (not issuer-dependent)
- No new attack surface added
**Changes**:
- Accept any Authentik issuer via regex: authentik.riotpiao.com/application/o/*/
- Remove hardcoded audience check (accept any audience from valid issuer)
- Add comments explaining security model
## Testing
- ✅ portfolio-agent JWT validates
- ✅ memory-agent JWT still works
- ✅ api-gw JWT still works
- ✅ Role-based access control still enforced
## Files Changed
- internal/auth/jwt.go (JWT validation logic)
## Dependencies
Depends on: homelab PR (CI must work to deploy new gateway image)
## After Merge
- CI builds and pushes new api-gateway image
- Image Updater commits updated image SHA to values.yaml
- ArgoCD deploys gateway with multi-issuer support
- Portfolio pod can now authenticate via portfolio-agent provider
---------
Co-authored-by: Admin Bot <[email protected]>
Reviewed-on: rock/homelab-frontend#1
Problem: Push job used docker:27-cli override with explicit dind cert
mounting, but runner base changed to code.forgejo.org/forgejo/runner:6.
Alpine container couldn't access Debian runner's dind socket paths.
Fix:
- Remove container override, run on golang runner natively
- Install docker.io directly in push step (apt-get)
- Add docker image prune post-action to cleanup
This pattern matches riotpiao.com CI and works with current runner setup.
- isValidIssuer() accepts portfolio-agent, memory-agent, api-gw, etc.
- All Authentik providers use same signing key (JWKS valid)
- CheckPermissions now checks both 'permissions' (users) and 'roles' (service accounts)
- Fixes JWT issuer mismatch for portfolio-agent, memory-agent tokens
Admin Bot
rockandAdmin Bot