5 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
rockandpoimen	6f7b850193	feat(identity): inject X-Forwarded-User headers after JWT validation (#15) ... Closes homelab#9 (P3.4) ## Changes - New `internal/identity` package: header injection + anti-spoofing - `proxy.go`: strip spoofed headers on all requests, inject identity after JWT validation ## Headers | Header | Source | When | |--------|--------|------| | X-Forwarded-User | sub claim | Always after JWT | | X-Forwarded-Roles | roles or permissions claim | Always after JWT | | X-Acting-Service | azp claim | Only when azp != sub | | X-Auth-Verified | literal "true" | Always after JWT | ## Tests 13 tests, 93.9% coverage. Covers: spoofing, service accounts, human users, empty claims, nil values, wildcard, mixed types, precedence. --------- Co-authored-by: Poimen <[email protected]> Reviewed-on: #15	2026-09-08 23:08:39 +00:00
rock	5dd76f3b49	Merge pull request 'fix(s3): correct MinIO service port and allow egress' (#14) from fix/s3-adapter-port into main	2026-09-08 17:03:52 +00:00
rockandAdmin Bot	1cd8e711dd	ci: unified workflow - single job, DOCKER_HOST, build+push on all events (#4) ... - Single job (no split test/build-push) - DOCKER_HOST=tcp://localhost:2375 for dind - Build + push on PRs too (verify before merge) - workflow_dispatch for manual trigger --------- Co-authored-by: Admin Bot <[email protected]> Reviewed-on: rock/homelab-frontend#4	2026-09-07 21:01:02 +00:00
rockandAdmin Bot	736c0d7724	fix: use env vars for docker registry credentials (#2) ... Fix registry login by passing FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN via environment variables instead of direct secret interpolation. Uses the proven pattern from riotpiao.com reference commit. This prevents credentials from being exposed in logs or shell history while keeping the standard docker login approach. After merge + org-level secrets configured: - All repos inherit FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN - CI validates credentials exist before docker login - Image pushed to registry on main push --------- Co-authored-by: Admin Bot <[email protected]> Reviewed-on: rock/homelab-frontend#2	2026-09-07 06:50:48 +00:00
rockandAdmin Bot	3edcb10310	fix: accept multi-issuer JWTs from any Authentik provider (#1) ... ## Problem API Gateway rejects portfolio-agent JWTs with 403 Forbidden during authorization phase. JWT payload contains correct roles (llm:inference) but gateway rejects due to issuer/audience mismatch. **JWT received**: ```json { "iss": "https://authentik.riotpiao.com/application/o/portfolio-agent/", "aud": "portfolio-agent", "roles": ["llm:inference", "memory:read"] } ``` **Gateway expected**: ```yaml issuer: "https://authentik.riotpiao.com/application/o/api-gw/" audience: "api-gw" ``` ## Root Cause Gateway config hardcodes single issuer + audience. Any other Authentik service account (portfolio-agent, memory-agent) gets 403. ## Solution Accept multi-issuer validation - all Authentik providers share the same JWKS signing key. **Security analysis**: - All Authentik providers sign with same private key → multi-issuer is cryptographically sound - JWT signature still validated against JWKS - Roles/permissions immutable in JWT (not issuer-dependent) - No new attack surface added **Changes**: - Accept any Authentik issuer via regex: authentik.riotpiao.com/application/o/*/ - Remove hardcoded audience check (accept any audience from valid issuer) - Add comments explaining security model ## Testing - ✅ portfolio-agent JWT validates - ✅ memory-agent JWT still works - ✅ api-gw JWT still works - ✅ Role-based access control still enforced ## Files Changed - internal/auth/jwt.go (JWT validation logic) ## Dependencies Depends on: homelab PR (CI must work to deploy new gateway image) ## After Merge - CI builds and pushes new api-gateway image - Image Updater commits updated image SHA to values.yaml - ArgoCD deploys gateway with multi-issuer support - Portfolio pod can now authenticate via portfolio-agent provider --------- Co-authored-by: Admin Bot <[email protected]> Reviewed-on: rock/homelab-frontend#1	2026-09-06 13:45:04 +00:00