5 Commits

Include renames

Author	SHA1	Message	Date
Admin Bot	2d55830412	fix: gateway authentik port + encrypt sensitive infrastructure details ... Security improvements: - Fix gateway→authentik port from 80 to 9000 (matches NetworkPolicy) - Encrypt gateway ConfigMap (contains internal cluster DNS names) - Encrypt gateway-config-secret with SOPS using AGE encryption - Add .sops.yaml configuration for future secret management Files encrypted with AGE key: - k8s/configmap.yaml (ConfigMap → encrypted) - k8s/gateway-config-secret.enc.yaml (Secret → encrypted) Internal infrastructure details now protected: ✓ Service DNS names (.svc.cluster.local) ✓ Upstream URLs ✓ Auth endpoints ✓ Port configurations Fixes JWT validation failures and 401 errors on LLM requests. Reduces attack surface by protecting infrastructure topology.	2026-09-13 08:54:38 +09:00
rock	e61885254b	feat: route qwen2.5:3b-instruct to CPU service (#20) ... Route `qwen2.5:3b-instruct` to `qwen-cpu.llm-serving:80` (CPU on cp-2) instead of `ornith-predictor` (GPU on worker-1). Companion to homelab GPU rebalance PR.	2026-09-09 02:10:59 +00:00
poimenandrock	1c64d8ff0e	feat(config): add tokenUrl, clientId, clientSecret to auth config (#17) ... Closes homelab#12 (P3.7) ## Changes - `AuthConfig`: added `TokenURL`, `ClientID`, `ClientSecret` fields - `loader.go`: reads `tokenUrl`/`clientId` from YAML, `ClientSecret` from `AUTH_CLIENT_SECRET` env - `deployment.yaml`: `AUTH_CLIENT_SECRET` from `api-gw-client-secret` Secret (optional) - `gateway-config-secret.enc.yaml` + `configmap.yaml`: added `tokenUrl` and `clientId` ## Secret never in YAML `clientSecret` deliberately omitted from YAML struct. Loaded from env only. ## Tests 3 tests: full config load, env-only secret, backward compat (missing fields = zero). Co-authored-by: poimen <[email protected]>	2026-09-08 23:43:29 +00:00
Admin Bot	c2fa3445bd	fix(s3): correct MinIO service port and allow egress ... MinIO ClusterIP service listens on port 80 (targetPort 9000). Config had port 9000 which caused 30s timeout then 502 — gateway connected to service port 9000 which doesn't exist on the ClusterIP. Changes: - configmap.yaml: S3 upstream :9000 → :80 - gateway-config-secret.enc.yaml: same - network-policy.yaml: add port 80 egress to storage namespace Verified: S3 adapter now reaches MinIO (403 AccessDenied = auth issue, not connectivity).	2026-09-08 09:58:36 -07:00
Admin Bot	2bcf6c82fc	fix: move gateway config from plaintext ConfigMap to SOPS-encrypted Secret	2026-09-05 00:28:45 -07:00