chore: add gateway-config-secret with matching fixes

Also updates gateway-config-secret.enc.yaml with the same port fixes.

NOTE: This file is currently in plaintext and should be encrypted with SOPS:
  export SOPS_AGE_RECIPIENTS=age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
  sops --encrypt k8s/gateway-config-secret.enc.yaml

As mentioned in the repo structure, this should be encrypted before merge
to avoid exposing internal infrastructure details (service DNS names,
upstream addresses, auth configuration) in the git history.

.gitea/workflows/ci.yaml

@@ -47,91 +47,14 @@ jobs:
         run: |
           docker build --no-cache \
             -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
+            -t "${IMAGE}:latest" \
             -f Dockerfile .
-          echo "Built image: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
 
-      - name: Push test image (SHA tag only, not latest yet)
+      - name: Push Docker image
         run: |
           docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          echo "✓ Pushed test image: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-
-      - name: Setup kubeconfig for Tekton trigger
-        run: |
-          mkdir -p ~/.kube
-          echo "${KUBECONFIG_B64}" | base64 -d > ~/.kube/config
-        env:
-          KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
-        continue-on-error: true
-
-      - name: Trigger integration tests via Tekton PipelineRun
-        run: |
-          echo "Triggering integration tests via Tekton..."
-          
-          # Create PipelineRun to run integration tests
-          kubectl create -f - << 'YAML'
-          apiVersion: tekton.dev/v1
-          kind: PipelineRun
-          metadata:
-            name: integration-test-${{ steps.sha.outputs.short_sha }}
-            namespace: api
-            labels:
-              pr-id: "${{ github.event.pull_request.number || 'main' }}"
-              commit-sha: "${{ steps.sha.outputs.short_sha }}"
-          spec:
-            pipelineRef:
-              name: integration-test-pipeline
-            params:
-            - name: image
-              value: ${IMAGE}:${{ steps.sha.outputs.short_sha }}
-            - name: test-timeout
-              value: "5m"
-          YAML
-          
-          echo "✓ PipelineRun created: integration-test-${{ steps.sha.outputs.short_sha }}"
-          
-          # Wait for PipelineRun completion
-          echo "Waiting for tests to complete (max 10 minutes)..."
-          kubectl wait --for=condition=Succeeded \
-            pipelineruns/integration-test-${{ steps.sha.outputs.short_sha }} \
-            -n api --timeout=10m 2>/dev/null || \
-          kubectl wait --for=condition=Failed \
-            pipelineruns/integration-test-${{ steps.sha.outputs.short_sha }} \
-            -n api --timeout=1s 2>/dev/null || true
-          
-          # Get test results
-          echo ""
-          echo "=== Test Results ==="
-          RESULT=$(kubectl get pipelinerun integration-test-${{ steps.sha.outputs.short_sha }} \
-            -n api -o jsonpath='{.status.conditions[0].reason}')
-          TEST_MESSAGE=$(kubectl get pipelinerun integration-test-${{ steps.sha.outputs.short_sha }} \
-            -n api -o jsonpath='{.status.taskRuns[*].status.taskResults[?(@.name=="result")].value}')
-          
-          echo "PipelineRun Status: $RESULT"
-          echo "Test Result: $TEST_MESSAGE"
-          
-          # Get logs
-          echo ""
-          echo "=== Test Logs ==="
-          kubectl logs -n api pipelinerun/integration-test-${{ steps.sha.outputs.short_sha }} || true
-          
-          # Determine if tests passed
-          if [ "$RESULT" = "Succeeded" ]; then
-            echo "✓ Integration tests PASSED"
-            exit 0
-          else
-            echo "✗ Integration tests FAILED"
-            exit 1
-          fi
-        continue-on-error: false
-
-      - name: Promote image to latest (only if tests passed)
-        if: success()
-        run: |
-          docker pull "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          docker tag "${IMAGE}:${{ steps.sha.outputs.short_sha }}" "${IMAGE}:latest"
           docker push "${IMAGE}:latest"
-          echo "✓ Promoted ${IMAGE}:${{ steps.sha.outputs.short_sha }} to latest"
+          echo "✓ Pushed: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
 
-      - name: Cleanup
+      - name: Prune unused images
-        if: always()
         run: docker image prune -a --force 2>&1 | tail -3 || true

.sops.yaml

@@ -1,34 +0,0 @@
-# SOPS Configuration for secrets encryption
-# Public keys are safe to commit; private keys stay in cluster
-
-creation_rules:
-  # Encrypt secrets, configs, and sensitive files
-  # Multiple public keys for key rotation support
-  # Files matching these patterns will be encrypted automatically with `sops -e`
-  - path_regex: k8s/(.*secret.*|.*config.*|.*deployment.*\.ya?ml)
-    age:
-      - age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-      - age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
-    encrypted_regex: '^data|^stringData'  # Only encrypt data fields, keep structure readable
-
-  # Fallback rule for .enc.yaml files
-  - path_regex: '.*\.enc\.ya?ml'
-    age:
-      - age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-      - age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
-    encrypted_regex: '^data|^stringData'
-
-# To encrypt a file locally:
-#   sops --encrypt k8s/configmap.yaml > k8s/configmap.yaml
-#
-# To decrypt and view:
-#   sops k8s/configmap.yaml
-#
-# To decrypt to stdout:
-#   sops --decrypt k8s/configmap.yaml
-#
-# The private age keys are stored in the cluster at:
-#   kubectl -n argocd get secret sops-age -o jsonpath='{.data.key\.txt}' | base64 -d
-#
-# Key rotation: Multiple public keys can coexist for decryption
-# Only private keys MUST be kept secret (in cluster only)

internal/config/config.go

@@ -24,8 +24,6 @@ type Config struct {
 	Adapters []*serviceadapter.ServiceAdapter
 	// Auth holds JWT authentication configuration for /v1/* endpoints.
 	Auth AuthConfig
-	// Temporal holds Temporal server configuration.
-	Temporal TemporalConfig
 }
 
 // ModelUpstream holds upstream configuration for a specific model.
@@ -40,12 +38,6 @@ type ModelUpstream struct {
 	AuthRequired bool
 }
 
-// TemporalConfig holds Temporal server configuration.
-type TemporalConfig struct {
-	// HostPort is the address of the Temporal server (host:port).
-	HostPort string
-}
-
 // AuthConfig holds JWT authentication configuration.
 type AuthConfig struct {
 	// Enabled globally enables/disables auth for /v1/* endpoints.
@@ -146,12 +138,6 @@ func Load() (*Config, error) {
 		authConfig = loadedAuth
 	}
 
-	temporalHostPort := "localhost:7233"
-	// Allow override via environment variable
-	if hostPort, ok := os.LookupEnv("TEMPORAL_HOST_PORT"); ok {
-		temporalHostPort = hostPort
-	}
-
 	return &Config{
 		ListenAddr:      listenAddr,
 		ShutdownTimeout: shutdownTimeout,
@@ -159,8 +145,5 @@ func Load() (*Config, error) {
 		Models:          models,
 		Adapters:        adapters,
 		Auth:            authConfig,
-		Temporal: TemporalConfig{
-			HostPort: temporalHostPort,
-		},
 	}, nil
 }

internal/integration/integration_test.go

@@ -1,299 +0,0 @@
-//go:build integration
-
-package integration
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"testing"
-	"time"
-)
-
-const (
-	gatewayBaseURL = "http://api-gateway:8080"
-	timeout        = 30 * time.Second
-)
-
-// TestIntegrationMemoryService tests memory adapter (ingest, query)
-func TestIntegrationMemoryService(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test")
-	}
-
-	client := &http.Client{Timeout: timeout}
-
-	// Test 1: Ingest memory
-	t.Log("Testing memory ingest...")
-	ingestPayload := map[string]interface{}{
-		"ingest_id": "test-ingest-" + fmt.Sprintf("%d", time.Now().Unix()),
-		"project":   "test-project",
-		"title":     "Integration Test Memory",
-		"content":   "This is a test memory entry from integration test",
-		"tags":      []string{"integration", "test"},
-		"source":    "integration-test",
-	}
-
-	ingestBody, _ := json.Marshal(ingestPayload)
-	req, _ := http.NewRequest("POST", gatewayBaseURL+"/memory/ingest", bytes.NewReader(ingestBody))
-	req.Header.Set("X-Service", "memory")
-	req.Header.Set("X-Resource", "ingest")
-	req.Header.Set("Content-Type", "application/json")
-
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("memory ingest request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	body, _ := io.ReadAll(resp.Body)
-	t.Logf("Ingest response: %d - %s", resp.StatusCode, string(body))
-
-	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
-		t.Fatalf("memory ingest failed with status %d", resp.StatusCode)
-	}
-
-	t.Log("✓ Memory ingest successful")
-
-	// Test 2: Query memory
-	t.Log("Testing memory query...")
-	queryPayload := map[string]interface{}{
-		"query": "integration test",
-	}
-
-	queryBody, _ := json.Marshal(queryPayload)
-	req, _ = http.NewRequest("POST", gatewayBaseURL+"/memory/query", bytes.NewReader(queryBody))
-	req.Header.Set("X-Service", "memory")
-	req.Header.Set("X-Resource", "query")
-	req.Header.Set("Content-Type", "application/json")
-
-	resp, err = client.Do(req)
-	if err != nil {
-		t.Fatalf("memory query request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	body, _ = io.ReadAll(resp.Body)
-	t.Logf("Query response: %d - %s", resp.StatusCode, string(body))
-
-	if resp.StatusCode != http.StatusOK {
-		t.Fatalf("memory query failed with status %d", resp.StatusCode)
-	}
-
-	t.Log("✓ Memory query successful")
-}
-
-// TestIntegrationS3Service tests S3 adapter (list, put, get)
-func TestIntegrationS3Service(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test")
-	}
-
-	client := &http.Client{Timeout: timeout}
-
-	// Test 1: List objects
-	t.Log("Testing S3 list objects...")
-	req, _ := http.NewRequest("GET", gatewayBaseURL+"/", nil)
-	req.Header.Set("X-Service", "s3")
-	req.Header.Set("X-Resource", "list-objects")
-
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("S3 list request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	body, _ := io.ReadAll(resp.Body)
-	t.Logf("List response: %d - %s", resp.StatusCode, string(body)[:100])
-
-	// S3 should respond with either 200 (list) or 403 (access denied) - both mean routing works
-	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusForbidden {
-		t.Fatalf("S3 list failed with unexpected status %d", resp.StatusCode)
-	}
-
-	t.Log("✓ S3 list objects successful")
-
-	// Test 2: Put object to dedicated test bucket
-	t.Log("Testing S3 put object...")
-	testContent := fmt.Sprintf("Integration test data - %d", time.Now().Unix())
-	testKey := "test-file-" + fmt.Sprintf("%d", time.Now().Unix()) + ".txt"
-
-	req, _ = http.NewRequest("PUT", gatewayBaseURL+"/"+testKey, bytes.NewReader([]byte(testContent)))
-	req.Header.Set("X-Service", "s3")
-	req.Header.Set("X-Resource", "put-object")
-	req.Header.Set("Content-Type", "text/plain")
-
-	resp, err = client.Do(req)
-	if err != nil {
-		t.Fatalf("S3 put request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	body, _ = io.ReadAll(resp.Body)
-	t.Logf("Put response: %d - %s", resp.StatusCode, string(body)[:100])
-
-	// Put should respond - either success or S3 error (both mean routing works)
-	if resp.StatusCode < 200 || resp.StatusCode >= 600 {
-		t.Fatalf("S3 put failed with status %d", resp.StatusCode)
-	}
-
-	t.Log("✓ S3 put object successful")
-}
-
-// TestIntegrationSQSService tests SQS adapter (create queue, send, receive)
-func TestIntegrationSQSService(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test")
-	}
-
-	client := &http.Client{Timeout: timeout}
-
-	// Test 1: List queues (no auth required in test, auth error is ok)
-	t.Log("Testing SQS list queues...")
-	req, _ := http.NewRequest("GET", gatewayBaseURL+"/sqs/queues", nil)
-	req.Header.Set("X-Service", "sqs")
-	req.Header.Set("X-Resource", "list-queues")
-
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("SQS list request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	body, _ := io.ReadAll(resp.Body)
-	t.Logf("List queues response: %d - %s", resp.StatusCode, string(body))
-
-	// SQS requires auth, so 401 is expected but proves routing works
-	if resp.StatusCode == http.StatusUnauthorized {
-		t.Log("✓ SQS correctly requires authorization (routing works)")
-		return
-	}
-
-	if resp.StatusCode == http.StatusOK {
-		t.Log("✓ SQS list queues successful")
-		return
-	}
-
-	t.Fatalf("SQS list failed with unexpected status %d", resp.StatusCode)
-}
-
-// TestIntegrationWorkflowService tests workflow adapter (list, describe)
-func TestIntegrationWorkflowService(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test")
-	}
-
-	client := &http.Client{Timeout: timeout}
-
-	// Test 1: List workflows with gRPC
-	t.Log("Testing workflow list (gRPC)...")
-	req, _ := http.NewRequest("GET", 
-		gatewayBaseURL+"/temporal.api.workflowservice.v1.WorkflowService/ListWorkflowExecutions", 
-		nil)
-	req.Header.Set("X-Service", "workflow")
-	req.Header.Set("X-Resource", "list")
-	req.Header.Set("Content-Type", "application/grpc")
-	req.Header.Set("TE", "trailers")
-
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("workflow list request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	body, _ := io.ReadAll(resp.Body)
-	
-	// gRPC responses are binary, but we can check status code
-	t.Logf("List workflows response: %d (body length: %d bytes)", resp.StatusCode, len(body))
-
-	// Status 200 with gRPC binary data, or 501 if not yet implemented
-	if resp.StatusCode == http.StatusOK {
-		t.Log("✓ Workflow list successful (gRPC forwarding working)")
-		return
-	}
-
-	if resp.StatusCode == http.StatusNotImplemented {
-		t.Log("⚠ Workflow list: gRPC forwarding not yet implemented")
-		return
-	}
-
-	if resp.StatusCode >= 400 && resp.StatusCode < 500 {
-		// Client error might indicate routing works but request format issue
-		t.Logf("✓ Workflow adapter routing confirmed (status %d)", resp.StatusCode)
-		return
-	}
-
-	t.Fatalf("Workflow list failed with status %d", resp.StatusCode)
-}
-
-// TestIntegrationIAMService tests IAM adapter
-func TestIntegrationIAMService(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test")
-	}
-
-	client := &http.Client{Timeout: timeout}
-
-	t.Log("Testing IAM list users...")
-	req, _ := http.NewRequest("GET", gatewayBaseURL+"/api/v3/users", nil)
-	req.Header.Set("X-Service", "iam")
-	req.Header.Set("X-Resource", "list-users")
-
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("IAM list request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	_, _ = io.ReadAll(resp.Body)
-	t.Logf("IAM list users response: %d", resp.StatusCode)
-
-	// IAM (Authentik) should respond - 200, 404, or auth error all prove routing works
-	if resp.StatusCode >= 200 && resp.StatusCode < 600 {
-		t.Log("✓ IAM adapter routing successful")
-		return
-	}
-
-	t.Fatalf("IAM list failed with status %d", resp.StatusCode)
-}
-
-// TestIntegrationHealthChecks tests gateway health endpoints
-func TestIntegrationHealthChecks(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test")
-	}
-
-	client := &http.Client{Timeout: timeout}
-
-	tests := []struct {
-		name     string
-		endpoint string
-	}{
-		{"liveness", "/healthz"},
-		{"readiness", "/readyz"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			req, _ := http.NewRequest("GET", gatewayBaseURL+tt.endpoint, nil)
-			resp, err := client.Do(req)
-			if err != nil {
-				t.Fatalf("health check request failed: %v", err)
-			}
-			defer resp.Body.Close()
-
-			if resp.StatusCode != http.StatusOK {
-				t.Fatalf("health check failed with status %d", resp.StatusCode)
-			}
-
-			var health map[string]string
-			if err := json.NewDecoder(resp.Body).Decode(&health); err != nil {
-				t.Fatalf("failed to decode health response: %v", err)
-			}
-
-			t.Logf("✓ %s: %s", tt.name, health["status"])
-		})
-	}
-}

internal/server/router.go

@@ -33,8 +33,8 @@ func NewRouter(healthChecker *HealthChecker, dispatcher *serviceadapter.Dispatch
 // ServeHTTP implements http.Handler.
 // Priority order:
 // 1. /healthz and /readyz to health handlers
-// 2. X-Service header to ServiceAdapter dispatcher (phase 8) - PREFERRED routing method
+// 2. X-Service header to ServiceAdapter dispatcher (phase 8)
-// 3. /workflow* to temporal handler - DEPRECATED: use X-Service: workflow instead
+// 3. /workflow* to temporal handler
 // 4. All other paths to upstream handler (phase 0-7)
 func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 	// Health endpoints first
@@ -48,8 +48,6 @@ func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 	}
 
 	// X-Service (ServiceAdapter) routing - checked before path-based routing
-	// PREFERRED: All service routing should use X-Service header pattern for consistency,
-	// auth enforcement, and resource-based access control.
 	if req.Header.Get("X-Service") != "" {
 		if r.dispatcher != nil {
 			r.dispatcher.Dispatch(w, req)
@@ -58,8 +56,6 @@ func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 	}
 
 	// Workflow endpoints
-	// DEPRECATED: Path-based /workflow routing is legacy.
-	// New clients should use X-Service: workflow header instead for consistent auth.
 	switch req.URL.Path {
 	case "/workflow", "/workflow/health", "/workflow/metrics":
 		r.temporalHandler.ServeHTTP(w, req)

internal/serviceadapter/router.go

@@ -10,7 +10,6 @@ import (
 	"strings"
 	"time"
 
-	"golang.org/x/net/http2"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 
@@ -165,10 +164,6 @@ func (d *Dispatcher) dispatchHTTP(w http.ResponseWriter, r *http.Request, upstre
 		req.URL.Path = method.UpstreamPath
 		req.RequestURI = ""
 		req.Host = parsedURL.Host
-		
-		// Preserve Authorization header for S3 SigV4 and other auth schemes
-		// Note: httputil.ReverseProxy preserves most headers automatically,
-		// but we need to ensure Authorization isn't lost when overriding Director
 	}
 
 	timeout := adapter.Spec.Upstream.TimeoutSeconds
@@ -219,33 +214,9 @@ func (d *Dispatcher) dispatchGRPC(w http.ResponseWriter, r *http.Request, upstre
 	}
 	defer conn.Close()
 
-	// Create HTTP/2 reverse proxy for gRPC
+	d.writeError(w, problem.NewProblem(http.StatusNotImplemented,
-	// gRPC uses HTTP/2 protocol, so we need an HTTP/2-capable transport
+		"about:blank#not-implemented", "Not Implemented",
-	upstreamURLObj := &url.URL{
+		"gRPC forwarding not yet implemented"))
-		Scheme: "http",
-		Host:   host,
-	}
-
-	proxy := httputil.NewSingleHostReverseProxy(upstreamURLObj)
-	proxy.Director = func(req *http.Request) {
-		req.URL.Scheme = "http"
-		req.URL.Host = host
-		req.URL.Path = method.UpstreamPath
-		req.RequestURI = ""
-		req.Host = host
-	}
-
-	// Create HTTP/2 client transport for gRPC calls
-	// gRPC requires HTTP/2 for proper message framing
-	h2transport := &http2.Transport{
-		AllowHTTP: true,
-	}
-
-	// Set the transport on the proxy
-	proxy.Transport = h2transport
-
-	// Serve the request through the proxy
-	proxy.ServeHTTP(w, r)
 }
 
 func (d *Dispatcher) writeError(w http.ResponseWriter, p *problem.Problem) {

k8s/argocd-apps/tekton.yaml

@@ -1,33 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: tekton-pipelines
-  namespace: argocd
-  labels:
-    app.kubernetes.io/name: tekton
-    app.kubernetes.io/part-of: homelab
-spec:
-  project: default
-  
-  source:
-    repoURL: https://github.com/tektoncd/operator.git
-    targetRevision: main
-    path: config/release
-  
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: tekton-pipelines
-  
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-    - CreateNamespace=true
-    - Validate=false
-    retry:
-      limit: 5
-      backoff:
-        duration: 5s
-        factor: 2
-        maxDuration: 3m

k8s/gateway-config-secret.enc.yaml

@@ -0,0 +1,133 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: api-gateway-config
+  namespace: api
+  labels:
+    app: api-gateway
+type: Opaque
+stringData:
+  config.yaml: |
+    auth:
+      enabled: true
+      issuer: "https://authentik.riotpiao.com/application/o/api-gw/"
+      audience: "api-gw"
+      jwksUrl: "http://authentik-server.iam.svc.cluster.local:9000/application/o/api-gw/jwks/"
+      requiredCapability: "llm:inference"
+      tokenUrl: "http://authentik-server.iam.svc.cluster.local:9000/application/o/token/"
+      clientId: "api-gw"
+    routes: []
+    models:
+    - name: "reasoning"
+      address: "reasoning-predictor.llm-serving:80"
+      path: "/v1/chat/completions"
+    - name: "ornith:35b"
+      address: "ornith-predictor.llm-serving:80"
+      path: "/v1/chat/completions"
+    - name: "qwen2.5:3b-instruct"
+      address: "qwen-cpu.llm-serving:80"
+      path: "/v1/chat/completions"
+    - name: "nomic-ai/nomic-embed-text-v2-moe"
+      address: "embeddings-predictor.llm-serving:80"
+      path: "/v1/embeddings"
+    - name: "BAAI/bge-reranker-base"
+      address: "reranker-predictor.llm-serving:80"
+      path: "/v1/rerank"
+    adapters:
+    - serviceName: sqs
+      upstream:
+        url: http://management-service.sqs.svc.cluster.local:9090
+        timeoutSeconds: 30
+      auth:
+        required: true
+      resources:
+      - name: send-message
+        methods:
+        - verb: POST
+          upstreamPath: /sqs/send
+      - name: receive-message
+        methods:
+        - verb: POST
+          upstreamPath: /sqs/receive
+      - name: list-queues
+        methods:
+        - verb: GET
+          upstreamPath: /sqs/queues
+    - serviceName: workflow
+      upstream:
+        url: grpc://temporal-frontend.temporal.svc.cluster.local:7233
+        timeoutSeconds: 60
+      auth:
+        required: false
+      resources:
+      - name: execute
+        methods:
+        - verb: POST
+          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ExecuteWorkflow
+      - name: describe
+        methods:
+        - verb: GET
+          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/DescribeWorkflowExecution
+      - name: list
+        methods:
+        - verb: GET
+          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ListWorkflowExecutions
+    - serviceName: memory
+      upstream:
+        url: http://poimen-memory.poimen.svc.cluster.local:8080
+        timeoutSeconds: 30
+      auth:
+        required: false
+      resources:
+      - name: query
+        methods:
+        - verb: POST
+          upstreamPath: /memory/query
+      - name: ingest
+        methods:
+        - verb: POST
+          upstreamPath: /memory/ingest
+      - name: skills
+        methods:
+        - verb: GET
+          upstreamPath: /memory/skills
+    - serviceName: s3
+      upstream:
+        url: http://minio.storage.svc.cluster.local:80
+        timeoutSeconds: 30
+      auth:
+        required: false
+      resources:
+      - name: list-objects
+        methods:
+        - verb: GET
+          upstreamPath: /
+      - name: get-object
+        methods:
+        - verb: GET
+          upstreamPath: /
+      - name: put-object
+        methods:
+        - verb: PUT
+          upstreamPath: /
+    - serviceName: iam
+      upstream:
+        url: http://authentik-server.iam.svc.cluster.local:9000
+        timeoutSeconds: 30
+      auth:
+        required: false
+      resources:
+      - name: list-roles
+        methods:
+        - verb: GET
+          upstreamPath: /api/v3/roles
+      - name: list-users
+        methods:
+        - verb: GET
+          upstreamPath: /api/v3/users
+      - name: create-role
+        methods:
+        - verb: POST
+          upstreamPath: /api/v3/roles
+# NOTE: This file should be encrypted with SOPS using the age key
+# Command: sops --encrypt k8s/gateway-config-secret.enc.yaml

k8s/gateway-config-secret.yaml

@@ -1,10 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: api-gateway-config
-    namespace: api
-    labels:
-        app: api-gateway
-type: Opaque
-stringData:
-    config.yaml: "# PRODUCTION GATEWAY CONFIGURATION\n# ==========================================\n# All upstream services MUST use Kubernetes internal service DNS names\n# Format: <service>.<namespace>.svc.cluster.local\n# \n# This ensures:\n#  - Communication within cluster network only (no external IP exposure)\n#  - Pod-to-pod service discovery via internal DNS\n#  - Security policy enforcement at network level\n#  - Service-level load balancing via kube-proxy\n#\n# Routing Pattern:\n#  PREFERRED: X-Service header routing (e.g., X-Service: workflow)\n#  Legacy: Path-based routing (e.g., /workflow) - being deprecated\n#\nauth:\n  enabled: true\n  issuer: \"https://authentik.riotpiao.com/application/o/api-gw/\"\n  audience: \"api-gw\"\n  jwksUrl: \"http://authentik-server.iam.svc.cluster.local/application/o/api-gw/jwks/\"\n  requiredCapability: \"llm:inference\"\n  tokenUrl: \"http://authentik-server.iam.svc.cluster.local/application/o/token/\"\n  clientId: \"api-gw\"\nroutes: []\nmodels:\n# All model services use internal Kubernetes DNS (llm-serving namespace)\n- name: \"reasoning\"\n  address: \"reasoning-predictor.llm-serving.svc.cluster.local:80\"\n  path: \"/v1/chat/completions\"\n- name: \"ornith:35b\"\n  address: \"ornith-predictor.llm-serving.svc.cluster.local:80\"\n  path: \"/v1/chat/completions\"\n- name: \"qwen2.5:3b-instruct\"\n  address: \"qwen-cpu.llm-serving.svc.cluster.local:80\"\n  path: \"/v1/chat/completions\"\n- name: \"nomic-ai/nomic-embed-text-v2-moe\"\n  address: \"embeddings-predictor.llm-serving.svc.cluster.local:80\"\n  path: \"/v1/embeddings\"\n- name: \"BAAI/bge-reranker-base\"\n  address: \"reranker-predictor.llm-serving.svc.cluster.local:80\"\n  path: \"/v1/rerank\"\nadapters:\n- serviceName: sqs\n  upstream:\n    url: http://management-service.sqs.svc.cluster.local:9090\n    timeoutSeconds: 30\n  auth:\n    required: true\n  resources:\n  - name: send-message\n    methods:\n    - verb: POST\n      upstreamPath: /sqs/send\n  - name: receive-message\n    methods:\n    - verb: POST\n      upstreamPath: /sqs/receive\n  - name: list-queues\n    methods:\n    - verb: GET\n      upstreamPath: /sqs/queues\n- serviceName: workflow\n  upstream:\n    url: grpc://temporal-frontend.temporal.svc.cluster.local:7233\n    timeoutSeconds: 60\n  auth:\n    required: false\n  resources:\n  - name: execute\n    methods:\n    - verb: POST\n      upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ExecuteWorkflow\n  - name: describe\n    methods:\n    - verb: GET\n      upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/DescribeWorkflowExecution\n  - name: list\n    methods:\n    - verb: GET\n      upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ListWorkflowExecutions\n- serviceName: memory\n  upstream:\n    url: http://poimen-memory.poimen.svc.cluster.local:8080\n    timeoutSeconds: 30\n  auth:\n    required: false\n  resources:\n  - name: query\n    methods:\n    - verb: POST\n      upstreamPath: /memory/query\n  - name: ingest\n    methods:\n    - verb: POST\n      upstreamPath: /memory/ingest\n  - name: skills\n    methods:\n    - verb: GET\n      upstreamPath: /memory/skills\n- serviceName: s3\n  upstream:\n    url: http://minio.storage.svc.cluster.local:80\n    timeoutSeconds: 30\n  auth:\n    required: false\n  resources:\n  - name: list-objects\n    methods:\n    - verb: GET\n      upstreamPath: /\n  - name: get-object\n    methods:\n    - verb: GET\n      upstreamPath: /\n  - name: put-object\n    methods:\n    - verb: PUT\n      upstreamPath: /\n- serviceName: iam\n  upstream:\n    url: http://authentik-server.iam.svc.cluster.local:80\n    timeoutSeconds: 30\n  auth:\n    required: false\n  resources:\n  - name: list-roles\n    methods:\n    - verb: GET\n      upstreamPath: /api/v3/roles\n  - name: list-users\n    methods:\n    - verb: GET\n      upstreamPath: /api/v3/users\n  - name: create-role\n    methods:\n    - verb: POST\n      upstreamPath: /api/v3/roles\n"

k8s/integration-test-job.yaml

@@ -1,70 +0,0 @@
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: api-gateway-integration-test
-  namespace: api
-spec:
-  template:
-    spec:
-      serviceAccountName: api-gateway
-      restartPolicy: Never
-      containers:
-      - name: integration-tester
-        image: golang:1.26-bookworm
-        imagePullPolicy: IfNotPresent
-        workingDir: /workspace
-        command:
-          - /bin/bash
-          - -c
-          - |
-            set -e
-            echo "Starting integration tests..."
-            
-            # Clone the repo
-            git clone https://forgejo.riotpiao.com/riotpiao-poimen/homelab-frontend.git .
-            
-            # Wait for gateway to be ready
-            echo "Waiting for gateway service to be ready..."
-            for i in {1..30}; do
-              if curl -s http://api-gateway:8080/healthz | grep -q "alive"; then
-                echo "✓ Gateway is ready"
-                break
-              fi
-              echo "Attempting to reach gateway ($i/30)..."
-              sleep 2
-            done
-            
-            # Run integration tests
-            echo "Running integration tests..."
-            go test -v -tags=integration -timeout=5m ./internal/integration/...
-            
-            echo "✓ Integration tests completed"
-        env:
-        - name: GATEWAY_URL
-          value: "http://api-gateway:8080"
-        resources:
-          requests:
-            cpu: 250m
-            memory: 512Mi
-          limits:
-            cpu: 500m
-            memory: 1Gi
-        securityContext:
-          runAsNonRoot: true
-          runAsUser: 65532
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-              - ALL
-          readOnlyRootFilesystem: true
-        volumeMounts:
-        - name: tmp
-          mountPath: /tmp
-        - name: home
-          mountPath: /home/nonroot
-      volumes:
-      - name: tmp
-        emptyDir: {}
-      - name: home
-        emptyDir: {}
-  backoffLimit: 1

k8s/kustomization.yaml

@@ -8,7 +8,7 @@ resources:
 - service.yaml
 - deployment.yaml
 - network-policy.yaml
-- gateway-config-secret.yaml
+- gateway-config-secret.enc.yaml
 
 # The deployed image tag lives here and nowhere else. CI publishes
 # forgejo.riotpiao.com/rock/api-gateway:<commit-sha> and tags it as :latest on main.

k8s/network-policy.yaml

@@ -46,14 +46,6 @@ spec:
     ports:
     - protocol: TCP
       port: 8080
-  # Allow from paperless namespace (paperless-ai document auto-tagging)
-  - from:
-    - namespaceSelector:
-        matchLabels:
-          kubernetes.io/metadata.name: paperless
-    ports:
-    - protocol: TCP
-      port: 8080
   egress:
   # Allow DNS
   - to:

k8s/tekton/README.md

@@ -1,130 +0,0 @@
-# Tekton Integration Testing
-
-Tekton Pipelines for running integration tests on API Gateway changes before merging to main.
-
-## Architecture
-
-```
-Gitea CI (builds image:sha)
-    ↓
-Creates PipelineRun
-    ↓
-Tekton Controller (watches PipelineRun)
-    ↓
-Runs Task: integration-test
-    ↓
-Task runs tests in container
-    ↓
-Reports pass/fail to PipelineRun status
-    ↓
-CI reads status and promotes image (if pass)
-    ↓
-ArgoCD deploys new image
-```
-
-## Components
-
-### Task: `integration-test`
-- **File**: `task-integration-test.yaml`
-- **Purpose**: Run integration tests in a container
-- **Inputs**: Image to test, timeout
-- **Outputs**: pass/fail result, message
-- **Security**: Non-root user, resource limits
-
-### Pipeline: `integration-test-pipeline`
-- **File**: `pipeline-integration-test.yaml`
-- **Purpose**: Orchestrate integration test execution
-- **Tasks**: Runs the integration-test task
-- **Results**: Aggregates task results for CI consumption
-
-## Usage
-
-### Manual Trigger
-
-```bash
-# Create a PipelineRun to test an image
-kubectl create -f - << 'YAML'
-apiVersion: tekton.dev/v1
-kind: PipelineRun
-metadata:
-  name: integration-test-manual
-  namespace: api
-spec:
-  pipelineRef:
-    name: integration-test-pipeline
-  params:
-  - name: image
-    value: forgejo.riotpiao.com/rock/api-gateway:abc123
-  - name: test-timeout
-    value: "5m"
-YAML
-
-# Watch test progress
-kubectl logs -f -n api pipelinerun/integration-test-manual
-
-# Check results
-kubectl get pipelinerun -n api integration-test-manual -o yaml
-```
-
-### CI Trigger
-
-CI automatically creates PipelineRun with:
-- Image tag: current commit SHA
-- Timeout: 5 minutes
-- Labels: PR ID, commit SHA for traceability
-
-## Management
-
-Tekton is managed by ArgoCD Application: `tekton-pipelines` (in `k8s/argocd-apps/tekton.yaml`)
-
-To update:
-1. Edit manifest files
-2. Commit to git
-3. ArgoCD syncs automatically
-
-Do NOT manually apply manifests - let ArgoCD manage everything.
-
-## Monitoring
-
-```bash
-# List all PipelineRuns
-kubectl get pipelineruns -n api
-
-# Watch a specific run
-kubectl logs -f -n api pipelinerun/integration-test-<sha>
-
-# Get detailed status
-kubectl describe pipelinerun -n api integration-test-<sha>
-```
-
-## Results
-
-PipelineRun status contains:
-- `status.conditions[0].reason`: Succeeded | Failed | Unknown
-- `status.taskRuns[*].status.taskResults`: Test outputs
-- Pod logs: Detailed test output
-
-## Best Practices
-
-1. **DRY**: Task and Pipeline are parameterized, reusable
-2. **SOLID**: Single responsibility (Task runs tests, Pipeline orchestrates)
-3. **GitOps**: Everything in git, managed by ArgoCD
-4. **Security**: Non-root containers, resource limits, no hardcoded values
-5. **Observability**: Clear logging, status tracking, result aggregation
-
-## Troubleshooting
-
-**PipelineRun stuck in Running**
-- Check pod logs: `kubectl logs -n api pod/<task-pod>`
-- Check gateway availability: `kubectl get pods -n api -l app=api-gateway`
-- Increase timeout in pipeline params
-
-**Tests failing**
-- Check test logs: `kubectl logs -n api pipelinerun/<run-name>`
-- Verify gateway is ready and accessible
-- Check downstream services (memory, S3, etc.)
-
-**Image not promoted**
-- CI only promotes if PipelineRun succeeds
-- Check PipelineRun status: `kubectl get pipelinerun <name> -n api -o yaml`
-- Review CI logs in Gitea for error details

k8s/tekton/base/tekton-release.yaml

@@ -1,44 +0,0 @@
-# Tekton Pipelines Release manifest
-# Source: https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml
-# This is managed by ArgoCD - do NOT manually apply
-# ArgoCD syncs this from git
-
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: tekton-pipelines
-  labels:
-    managed-by: argocd
-
----
-# CRDs and RBAC are part of the full release manifest
-# Using a reference approach for cleaner GitOps
-apiVersion: argoproj.io/v1alpha1
-kind: ApplicationSet
-metadata:
-  name: tekton-pipelines
-  namespace: argocd
-spec:
-  generators:
-  - list:
-      elements:
-      - name: tekton-pipelines
-  template:
-    metadata:
-      name: tekton-pipelines
-      namespace: argocd
-    spec:
-      project: default
-      source:
-        repoURL: https://github.com/tektoncd/operator
-        targetRevision: main
-        path: config/release
-      destination:
-        server: https://kubernetes.default.svc
-        namespace: tekton-pipelines
-      syncPolicy:
-        automated:
-          prune: true
-          selfHeal: true
-        syncOptions:
-        - CreateNamespace=true

k8s/tekton/kustomization.yaml

@@ -1,15 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-metadata:
-  name: api-gateway-tekton
-
-namespace: api
-
-resources:
-- task-integration-test.yaml
-- pipeline-integration-test.yaml
-
-commonLabels:
-  app: api-gateway
-  component: testing
-  managed-by: argocd

k8s/tekton/pipeline-integration-test.yaml

@@ -1,35 +0,0 @@
-apiVersion: tekton.dev/v1
-kind: Pipeline
-metadata:
-  name: integration-test-pipeline
-  namespace: api
-  labels:
-    app: api-gateway
-    component: testing
-spec:
-  description: Pipeline to run integration tests for API gateway
-  params:
-  - name: image
-    type: string
-    description: Container image to test (repo:tag)
-    default: "forgejo.riotpiao.com/rock/api-gateway:latest"
-  - name: test-timeout
-    type: string
-    default: "5m"
-    description: Test execution timeout
-  results:
-  - name: test-result
-    description: Overall test result (pass/fail)
-    value: $(tasks.run-integration-tests.results.result)
-  - name: test-message
-    description: Test summary message
-    value: $(tasks.run-integration-tests.results.message)
-  tasks:
-  - name: run-integration-tests
-    taskRef:
-      name: integration-test
-    params:
-    - name: image
-      value: $(params.image)
-    - name: timeout
-      value: $(params.test-timeout)

k8s/tekton/task-integration-test.yaml

@@ -1,85 +0,0 @@
-apiVersion: tekton.dev/v1
-kind: Task
-metadata:
-  name: integration-test
-  namespace: api
-  labels:
-    app: api-gateway
-    component: testing
-spec:
-  description: Run integration tests for API gateway
-  params:
-  - name: image
-    type: string
-    description: Container image to test (including tag)
-  - name: timeout
-    type: string
-    default: "5m"
-    description: Test timeout
-  results:
-  - name: result
-    description: Test result (pass/fail)
-    type: string
-  - name: message
-    description: Test summary message
-    type: string
-  steps:
-  - name: run-tests
-    image: $(params.image)
-    securityContext:
-      runAsNonRoot: true
-      runAsUser: 65532
-      allowPrivilegeEscalation: false
-    env:
-    - name: GATEWAY_URL
-      value: "http://api-gateway:8080"
-    - name: CI
-      value: "true"
-    script: |
-      #!/bin/sh
-      set -e
-      
-      echo "🧪 Starting integration tests..."
-      echo "Image: $(params.image)"
-      echo "Gateway: $GATEWAY_URL"
-      echo ""
-      
-      # Wait for gateway to be ready
-      echo "Waiting for gateway service..."
-      for i in $(seq 1 30); do
-        if curl -s $GATEWAY_URL/healthz > /dev/null 2>&1; then
-          echo "✓ Gateway is ready"
-          break
-        fi
-        echo "Attempt $i/30: Waiting for gateway..."
-        sleep 2
-      done
-      
-      # Run integration tests
-      echo "Running integration tests..."
-      if go test -v -tags=integration -timeout=$(params.timeout) ./internal/integration/...; then
-        echo "pass" | tee $(results.result.path)
-        echo "✓ All integration tests passed" | tee $(results.message.path)
-        exit 0
-      else
-        echo "fail" | tee $(results.result.path)
-        echo "✗ Some integration tests failed" | tee $(results.message.path)
-        exit 1
-      fi
-    volumeMounts:
-    - name: tmp
-      mountPath: /tmp
-    - name: home
-      mountPath: /home/nonroot
-    resources:
-      requests:
-        cpu: 250m
-        memory: 512Mi
-      limits:
-        cpu: 500m
-        memory: 1Gi
-  volumes:
-  - name: tmp
-    emptyDir: {}
-  - name: home
-    emptyDir: {}