fix: use env vars for docker registry credentials

Pass FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN via environment variables.
Image: forgejo.riotpiao.com/rock/api-gateway (API gateway service)

..bfg-report/2026-09-13/11-02-26/cache-stats.txt

@@ -1,4 +0,0 @@
-(apply,CacheStats{hitCount=337, missCount=199, loadSuccessCount=199, loadExceptionCount=0, totalLoadTime=581291927, evictionCount=0})
-(tree,CacheStats{hitCount=986, missCount=352, loadSuccessCount=299, loadExceptionCount=0, totalLoadTime=821650758, evictionCount=0})
-(commit,CacheStats{hitCount=108, missCount=107, loadSuccessCount=107, loadExceptionCount=0, totalLoadTime=78983052, evictionCount=0})
-(tag,CacheStats{hitCount=0, missCount=2, loadSuccessCount=2, loadExceptionCount=0, totalLoadTime=319542, evictionCount=0})

..bfg-report/2026-09-13/11-02-26/changed-files.txt

@@ -1,4 +0,0 @@
-e71e5b78236a67327c678490cb50b46981f19de0 bbcbb68b91e786eb71bbb0a4443d7b8a26140e1b .sops.yaml
-4189696f5581ac0ffdc125c3bf9b9f664b3ddfb0 7cd3f1ee4865c563d141464f6fc185436993b84b .sops.yaml
-635630e73152a5f22e6cbd42322ec55d79f8d9c0 297e94a89d73d18c4f47013bb0e8303f123715f3 configmap.yaml
-29e515e7b46742fab8c3fcc2189af7010a6ccc62 6869fa11f96e03f7ec76a0ea14a4ddaf604004a4 gateway-config-secret.enc.yaml

..bfg-report/2026-09-13/11-02-26/object-id-map.old-new.txt

@@ -1,12 +0,0 @@
-0a95af80c0051bacbeb8483c1632e47acd3db5be 40207e487cfb63409a976fb2a0b9e1e62c8b1513
-27428d910111299d0699f429190284a9ca6e50b7 3318daf758349402aef43b095482743ab96b37f9
-329a495af4c935529fdae17229314101c0c77876 67f24ea76359c8dba4b56267790aad76bbc58464
-4c8bc6c920b6b75399555827022f69ef0c4f7d15 1fa839b41975fa3f0ac9052355ffb625f5a8f324
-528545f414c83217408edfea234dcd1f3edee0c2 b8f95506ca1545b876b5531cd385172e9ca5b4b0
-81038e1cf7567a9133d7c233a97b1e2f19fa1c82 4a00312906ba725f3968187656fde2663b1763ab
-a5b3b5c44a406896bcb414df6c6426c277715706 2ab47a9dbe5ba36dfa0e275991ef7b7656908410
-ce27643667a0399115cd1f2b6d38123fdcf2b4f1 6ff0a50de8efbad105fa588245f22fdb26afddc4
-d49756886a46542b38533b913a1f776b5145f5ec d82cc5a6970a1fb32e21dda9a737b987a8668111
-db3a30fbcf1f139c667fb68a91762582c49b8cee 04619a269fed9eeea53ab4d4d73131e3713f40a0
-eb54715e4dec0fb35402576fcc224a09808b00c1 d53b7632cf9646dda1c978a5f94615dc9eaed5e8
-ef72b5bbccf2df89aa1c86dee29311c63f33bf62 ba55d184fefef1a73a50409ca4fb1f7b27f5b075

.gitea/workflows/ci.yaml

@@ -5,25 +5,18 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
-  workflow_dispatch:
 
 env:
   REGISTRY: forgejo.riotpiao.com
   IMAGE: forgejo.riotpiao.com/rock/api-gateway
-  DOCKER_HOST: tcp://localhost:2375
 
 jobs:
-  ci:
-    name: CI
+  test:
+    name: Test
     runs-on: golang
     steps:
-      - name: Install dependencies
-        run: |
-          apt-get update
-          apt-get install -y docker.io curl nodejs
-          curl -sLO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
-          chmod +x kubectl && mv kubectl /usr/local/bin/
-          kubectl version --client
+      - name: Install Node.js for actions runtime
+        run: apt-get update && apt-get install -y nodejs
 
       - name: Checkout code
         uses: actions/checkout@v4
@@ -34,9 +27,25 @@ jobs:
       - name: Go test
         run: go test ./...
 
+  build-push:
+    name: Build & Push Image
+    needs: test
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: golang
+    steps:
+      - name: Install Node.js and Docker
+        run: |
+          apt-get update
+          apt-get install -y nodejs docker.io
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+
       - name: Get short SHA
         id: sha
-        run: echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
+        run: |
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
 
       - name: Registry login
         run: |
@@ -50,84 +59,15 @@ jobs:
         run: |
           docker build --no-cache \
             -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-            -f Dockerfile .
+            -t "${IMAGE}:latest" \
+            -f Dockerfile \
+            .
 
-      - name: Push image (SHA tag)
-        run: docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-
-      # ── Tekton integration tests ─────────────────────────────
-      - name: Setup kubeconfig
+      - name: Push Docker image
         run: |
-          mkdir -p ~/.kube
-          echo "${KUBECONFIG_B64}" | base64 -d > ~/.kube/config
-          kubectl get pipelineruns -n api --no-headers | head -1 || echo 'No PipelineRuns yet'
-          echo '✓ kubeconfig works'
-        env:
-          KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
-
-      - name: Trigger Tekton PipelineRun
-        id: tekton
-        run: |
-          SHA="${{ steps.sha.outputs.short_sha }}"
-          RUN_NAME="integration-test-${SHA}"
-
-          # Clean up any previous run with the same name
-          kubectl delete taskrun "${RUN_NAME}" -n api --ignore-not-found
-
-          # Create TaskRun — spins up gateway sidecar + curl tests
-          cat <<YAML | kubectl create -f -
-          apiVersion: tekton.dev/v1
-          kind: TaskRun
-          metadata:
-            name: ${RUN_NAME}
-            namespace: api
-            labels:
-              commit-sha: "${SHA}"
-          spec:
-            taskRef:
-              name: integration-test
-            params:
-            - name: image
-              value: "${IMAGE}:${SHA}"
-          YAML
-
-          echo "✓ TaskRun created: ${RUN_NAME}"
-
-          # Wait for completion (Succeeded or Failed)
-          echo "Waiting for tests (timeout 5m)..."
-          if kubectl wait taskrun/"${RUN_NAME}" -n api \
-               --for=condition=Succeeded --timeout=5m 2>/dev/null; then
-            echo "result=pass" >> $GITHUB_OUTPUT
-          else
-            echo "result=fail" >> $GITHUB_OUTPUT
-          fi
-
-          # Print logs + results
-          echo ""
-          echo "=== Test Logs ==="
-          POD=$(kubectl get pod -n api -l tekton.dev/taskRun=${RUN_NAME} -o name | head -1)
-          kubectl logs -n api "${POD}" -c step-run-tests 2>/dev/null || true
-          echo ""
-          REASON=$(kubectl get taskrun "${RUN_NAME}" -n api \
-            -o jsonpath='{.status.conditions[0].reason}')
-          SUMMARY=$(kubectl get taskrun "${RUN_NAME}" -n api \
-            -o jsonpath='{.status.results[?(@.name=="summary")].value}')
-          echo "Status: ${REASON}"
-          echo "Summary: ${SUMMARY}"
-
-      - name: Gate on test result
-        if: steps.tekton.outputs.result != 'pass'
-        run: |
-          echo "✗ Integration tests FAILED — image NOT promoted"
-          exit 1
-
-      # ── Promote only after tests pass ────────────────────────
-      - name: Promote image to latest
-        run: |
-          docker tag "${IMAGE}:${{ steps.sha.outputs.short_sha }}" "${IMAGE}:latest"
+          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
           docker push "${IMAGE}:latest"
-          echo "✓ Promoted to latest"
+          echo "✓ Image pushed: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
 
-      - name: Cleanup
-        if: always()
-        run: docker image prune -af 2>&1 | tail -3 || true
+      - name: Prune unused images
+        run: docker image prune -a --force 2>&1 | tail -3 || true

.sops.yaml

@@ -1,34 +1,3 @@
-# SOPS Configuration for secrets encryption
-# Public keys are safe to commit; private keys stay in cluster
-
 creation_rules:
-  # Encrypt secrets, configs, and sensitive files
-  # Multiple public keys for key rotation support
-  # Files matching these patterns will be encrypted automatically with `sops -e`
-  - path_regex: k8s/(.*secret.*|.*config.*|.*deployment.*\.ya?ml)
-    age:
-      - age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-      - age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
-    encrypted_regex: '^data|^stringData'  # Only encrypt data fields, keep structure readable
-
-  # Fallback rule for .enc.yaml files
-  - path_regex: '.*\.enc\.ya?ml'
-    age:
-      - age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-      - age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
-    encrypted_regex: '^data|^stringData'
-
-# To encrypt a file locally:
-#   sops --encrypt k8s/configmap.yaml > k8s/configmap.yaml
-#
-# To decrypt and view:
-#   sops k8s/configmap.yaml
-#
-# To decrypt to stdout:
-#   sops --decrypt k8s/configmap.yaml
-#
-# The private age keys are stored in the cluster at:
-#   kubectl -n argocd get secret sops-age -o jsonpath='{.data.key\.txt}' | base64 -d
-#
-# Key rotation: Multiple public keys can coexist for decryption
-# Only private keys MUST be kept secret (in cluster only)
+  - path_regex: \.enc\.ya?ml$
+    age: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla

cmd/gateway/main.go

@@ -9,7 +9,6 @@ import (
 	"os/signal"
 	"syscall"
 
-	"forgejo.riotpiao.com/rock/homelab-frontend/internal/auth"
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/config"
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/proxy"
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/server"
@@ -76,13 +75,7 @@ func main() {
 		_ = registry.Add(a)
 	}
 	log.Printf("%d service adapters loaded", registry.Count())
-
-	// Create shared JWT validator for X-Service auth enforcement
-	var jwtValidator *auth.Validator
-	if cfg.Auth.Enabled && cfg.Auth.JWKSURL != "" {
-		jwtValidator = auth.NewValidator(cfg.Auth.Issuer, cfg.Auth.Audience, cfg.Auth.JWKSURL)
-	}
-	dispatcher := serviceadapter.NewDispatcher(registry, jwtValidator)
+	dispatcher := serviceadapter.NewDispatcher(registry)
 
 	// Create router that handles health endpoints, X-Service (ServiceAdapter) routing,
 	// temporal endpoints, and passes others to upstream handler

examples/sendmsg-email.sh

@@ -1,36 +0,0 @@
-#!/bin/bash
-# Example: Send email via notification/sendMsg endpoint
-
-BASE_URL="${1:-https://api.riotpiao.com}"
-AUTH_TOKEN="${2:-}"  # Optional JWT token if auth required
-
-PAYLOAD=$(cat <<'EOF'
-{
-  "format": "smtp",
-  "title": "System Alert",
-  "message": "CPU usage exceeded 90% threshold",
-  "priority": 7,
-  "extras": {
-    "to_email": "[email protected]",
-    "cc": "[email protected]"
-  }
-}
-EOF
-)
-
-if [ -n "$AUTH_TOKEN" ]; then
-  curl -X POST "$BASE_URL" \
-    -H "X-Service: notification" \
-    -H "X-Resource: sendMsg" \
-    -H "Content-Type: application/json" \
-    -H "Authorization: Bearer $AUTH_TOKEN" \
-    -d "$PAYLOAD"
-else
-  curl -X POST "$BASE_URL" \
-    -H "X-Service: notification" \
-    -H "X-Resource: sendMsg" \
-    -H "Content-Type: application/json" \
-    -d "$PAYLOAD"
-fi
-
-echo ""

internal/auth/jwt.go

@@ -165,20 +165,6 @@ func (v *Validator) CheckPermissions(claims jwt.MapClaims, required ...string) b
 		}
 	}
 
-	// Fall back to scope claim (for client_credentials tokens)
-	// Authentik client_credentials tokens carry capabilities as space-separated scopes
-	if scopeIface, ok := claims["scope"]; ok {
-		if scopeStr, ok := scopeIface.(string); ok {
-			for _, s := range strings.Split(scopeStr, " ") {
-				for _, req := range required {
-					if s == req {
-						return true
-					}
-				}
-			}
-		}
-	}
-
 	return false
 }
 

internal/config/auth_config_test.go

@@ -1,104 +0,0 @@
-package config_test
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"forgejo.riotpiao.com/rock/homelab-frontend/internal/config"
-)
-
-func TestLoadAuthConfig_TokenURLAndClientID(t *testing.T) {
-	yaml := `
-routes: []
-models: []
-auth:
-  enabled: true
-  issuer: "https://authentik.example.com/application/o/api-gw/"
-  audience: "api-gw"
-  jwksUrl: "https://authentik.example.com/application/o/api-gw/jwks/"
-  requiredCapability: "llm:inference"
-  tokenUrl: "https://authentik.example.com/application/o/token/"
-  clientId: "api-gw"
-`
-	dir := t.TempDir()
-	path := filepath.Join(dir, "config.yaml")
-	if err := os.WriteFile(path, []byte(yaml), 0644); err != nil {
-		t.Fatal(err)
-	}
-
-	// Set env for client secret
-	t.Setenv("AUTH_CLIENT_SECRET", "test-secret-value")
-
-	_, _, _, auth, err := config.LoadRoutesAndModelsFromFile(path)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	if !auth.Enabled {
-		t.Error("auth should be enabled")
-	}
-	if auth.TokenURL != "https://authentik.example.com/application/o/token/" {
-		t.Errorf("tokenUrl = %q, want authentik token endpoint", auth.TokenURL)
-	}
-	if auth.ClientID != "api-gw" {
-		t.Errorf("clientId = %q, want api-gw", auth.ClientID)
-	}
-	if auth.ClientSecret != "test-secret-value" {
-		t.Errorf("clientSecret = %q, want test-secret-value", auth.ClientSecret)
-	}
-}
-
-func TestLoadAuthConfig_ClientSecretFromEnvOnly(t *testing.T) {
-	yaml := `
-routes: []
-models: []
-auth:
-  enabled: true
-  tokenUrl: "https://example.com/token/"
-  clientId: "test"
-`
-	dir := t.TempDir()
-	path := filepath.Join(dir, "config.yaml")
-	os.WriteFile(path, []byte(yaml), 0644)
-
-	// No AUTH_CLIENT_SECRET env set
-	t.Setenv("AUTH_CLIENT_SECRET", "")
-
-	_, _, _, auth, err := config.LoadRoutesAndModelsFromFile(path)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	if auth.ClientSecret != "" {
-		t.Errorf("clientSecret should be empty when env not set, got %q", auth.ClientSecret)
-	}
-}
-
-func TestLoadAuthConfig_BackwardCompatible(t *testing.T) {
-	// Config without tokenUrl/clientId should still load (zero values)
-	yaml := `
-routes: []
-models: []
-auth:
-  enabled: true
-  issuer: "https://example.com/"
-  jwksUrl: "https://example.com/jwks/"
-  requiredCapability: "llm:inference"
-`
-	dir := t.TempDir()
-	path := filepath.Join(dir, "config.yaml")
-	os.WriteFile(path, []byte(yaml), 0644)
-
-	_, _, _, auth, err := config.LoadRoutesAndModelsFromFile(path)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	if auth.TokenURL != "" {
-		t.Errorf("tokenUrl should be empty, got %q", auth.TokenURL)
-	}
-	if auth.ClientID != "" {
-		t.Errorf("clientId should be empty, got %q", auth.ClientID)
-	}
-}

internal/config/config.go

@@ -24,8 +24,6 @@ type Config struct {
 	Adapters []*serviceadapter.ServiceAdapter
 	// Auth holds JWT authentication configuration for /v1/* endpoints.
 	Auth AuthConfig
-	// Temporal holds Temporal server configuration.
-	Temporal TemporalConfig
 }
 
 // ModelUpstream holds upstream configuration for a specific model.
@@ -40,12 +38,6 @@ type ModelUpstream struct {
 	AuthRequired bool
 }
 
-// TemporalConfig holds Temporal server configuration.
-type TemporalConfig struct {
-	// HostPort is the address of the Temporal server (host:port).
-	HostPort string
-}
-
 // AuthConfig holds JWT authentication configuration.
 type AuthConfig struct {
 	// Enabled globally enables/disables auth for /v1/* endpoints.
@@ -58,12 +50,6 @@ type AuthConfig struct {
 	JWKSURL string
 	// RequiredCapability is the permission required for LLM inference (e.g., "llm:inference").
 	RequiredCapability string
-	// TokenURL is the Authentik token endpoint for password/refresh grants.
-	TokenURL string
-	// ClientID is the OAuth2 client ID for token exchange.
-	ClientID string
-	// ClientSecret is the OAuth2 client secret (loaded from env, never from config file).
-	ClientSecret string
 }
 
 // Route represents a single route and its upstream configuration.
@@ -146,12 +132,6 @@ func Load() (*Config, error) {
 		authConfig = loadedAuth
 	}
 
-	temporalHostPort := "localhost:7233"
-	// Allow override via environment variable
-	if hostPort, ok := os.LookupEnv("TEMPORAL_HOST_PORT"); ok {
-		temporalHostPort = hostPort
-	}
-
 	return &Config{
 		ListenAddr:      listenAddr,
 		ShutdownTimeout: shutdownTimeout,
@@ -159,8 +139,5 @@ func Load() (*Config, error) {
 		Models:          models,
 		Adapters:        adapters,
 		Auth:            authConfig,
-		Temporal: TemporalConfig{
-			HostPort: temporalHostPort,
-		},
 	}, nil
 }

internal/config/loader.go

@@ -25,8 +25,6 @@ type rawAuth struct {
 	Audience           string `yaml:"audience"`
 	JWKSURL            string `yaml:"jwksUrl"`
 	RequiredCapability string `yaml:"requiredCapability"`
-	TokenURL           string `yaml:"tokenUrl"`
-	ClientID           string `yaml:"clientId"`
 }
 
 // rawRoute represents a single route in the YAML configuration.
@@ -178,9 +176,6 @@ func LoadRoutesAndModelsFromFile(path string) (map[string]*Route, map[string]*Mo
 		Audience:           raw.Auth.Audience,
 		JWKSURL:            raw.Auth.JWKSURL,
 		RequiredCapability: raw.Auth.RequiredCapability,
-		TokenURL:           raw.Auth.TokenURL,
-		ClientID:           raw.Auth.ClientID,
-		ClientSecret:       os.Getenv("AUTH_CLIENT_SECRET"),
 	}
 
 	return routes, models, adapters, authConfig, nil

internal/identity/headers.go

@@ -1,111 +0,0 @@
-// Package identity extracts authenticated user identity from JWT claims
-// and injects forwarding headers into proxied requests.
-//
-// Headers injected after JWT validation:
-//
-//	X-Forwarded-User:    subject (sub claim)
-//	X-Forwarded-Roles:   comma-separated roles or permissions
-//	X-Acting-Service:    authorized party (azp claim), only for service accounts
-//	X-Auth-Verified:     "true" when gateway validated the JWT
-//
-// Security contract: downstream services MUST only accept traffic from the
-// gateway (enforced by NetworkPolicy). They trust these headers because the
-// gateway is the sole ingress path.
-package identity
-
-import (
-	"net/http"
-	"strings"
-
-	"github.com/golang-jwt/jwt/v5"
-)
-
-// Headers that the gateway controls. Incoming values from clients are
-// stripped to prevent spoofing.
-const (
-	HeaderUser         = "X-Forwarded-User"
-	HeaderRoles        = "X-Forwarded-Roles"
-	HeaderActingService = "X-Acting-Service"
-	HeaderAuthVerified = "X-Auth-Verified"
-)
-
-// managed lists all headers this package owns. Used for stripping and cleanup.
-var managed = []string{
-	HeaderUser,
-	HeaderRoles,
-	HeaderActingService,
-	HeaderAuthVerified,
-}
-
-// StripIncoming removes all gateway-managed identity headers from an
-// inbound request, preventing clients from spoofing identity.
-// Call this early in the handler chain, before any routing.
-func StripIncoming(r *http.Request) {
-	for _, h := range managed {
-		r.Header.Del(h)
-	}
-}
-
-// Inject extracts identity from validated JWT claims and sets the
-// corresponding forwarding headers on the request. Only call this
-// after successful JWT validation.
-func Inject(r *http.Request, claims jwt.MapClaims) {
-	r.Header.Set(HeaderAuthVerified, "true")
-
-	if sub := claimString(claims, "sub"); sub != "" {
-		r.Header.Set(HeaderUser, sub)
-	}
-
-	if roles := claimStringSlice(claims, "roles"); len(roles) > 0 {
-		r.Header.Set(HeaderRoles, strings.Join(roles, ","))
-	} else if perms := claimStringSlice(claims, "permissions"); len(perms) > 0 {
-		r.Header.Set(HeaderRoles, strings.Join(perms, ","))
-	}
-
-	if azp := claimString(claims, "azp"); azp != "" {
-		sub := claimString(claims, "sub")
-		// Only set acting-service when azp differs from sub
-		// (i.e., a service account acting, not the user themselves)
-		if azp != sub {
-			r.Header.Set(HeaderActingService, azp)
-		}
-	}
-}
-
-// claimString extracts a string value from claims, returning "" if
-// the key is missing or not a string.
-func claimString(claims jwt.MapClaims, key string) string {
-	val, ok := claims[key]
-	if !ok || val == nil {
-		return ""
-	}
-	s, ok := val.(string)
-	if !ok {
-		return ""
-	}
-	return s
-}
-
-// claimStringSlice extracts a []string from claims. JWT libraries
-// deserialize JSON arrays as []interface{}, so each element is
-// type-asserted individually. Non-string elements are skipped.
-func claimStringSlice(claims jwt.MapClaims, key string) []string {
-	val, ok := claims[key]
-	if !ok || val == nil {
-		return nil
-	}
-	raw, ok := val.([]interface{})
-	if !ok {
-		return nil
-	}
-	out := make([]string, 0, len(raw))
-	for _, v := range raw {
-		if s, ok := v.(string); ok && s != "" {
-			out = append(out, s)
-		}
-	}
-	if len(out) == 0 {
-		return nil
-	}
-	return out
-}

internal/identity/headers_test.go

@@ -1,205 +0,0 @@
-package identity
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/golang-jwt/jwt/v5"
-)
-
-func TestStripIncoming_RemovesSpoofedHeaders(t *testing.T) {
-	r := httptest.NewRequest("GET", "/", nil)
-	r.Header.Set(HeaderUser, "evil-spoof")
-	r.Header.Set(HeaderRoles, "admin:*")
-	r.Header.Set(HeaderActingService, "fake-service")
-	r.Header.Set(HeaderAuthVerified, "true")
-
-	StripIncoming(r)
-
-	for _, h := range managed {
-		if got := r.Header.Get(h); got != "" {
-			t.Errorf("header %s should be stripped, got %q", h, got)
-		}
-	}
-}
-
-func TestStripIncoming_PreservesOtherHeaders(t *testing.T) {
-	r := httptest.NewRequest("GET", "/", nil)
-	r.Header.Set("Authorization", "Bearer token")
-	r.Header.Set("Content-Type", "application/json")
-	r.Header.Set(HeaderUser, "spoof")
-
-	StripIncoming(r)
-
-	if got := r.Header.Get("Authorization"); got != "Bearer token" {
-		t.Errorf("Authorization should be preserved, got %q", got)
-	}
-	if got := r.Header.Get("Content-Type"); got != "application/json" {
-		t.Errorf("Content-Type should be preserved, got %q", got)
-	}
-}
-
-func TestInject_ServiceAccount(t *testing.T) {
-	r := httptest.NewRequest("GET", "/", nil)
-	claims := jwt.MapClaims{
-		"sub":   "abc123-hashed-id",
-		"azp":   "portfolio-agent",
-		"roles": []interface{}{"llm:inference", "memory:read"},
-	}
-
-	Inject(r, claims)
-
-	assertHeader(t, r, HeaderAuthVerified, "true")
-	assertHeader(t, r, HeaderUser, "abc123-hashed-id")
-	assertHeader(t, r, HeaderRoles, "llm:inference,memory:read")
-	assertHeader(t, r, HeaderActingService, "portfolio-agent")
-}
-
-func TestInject_HumanUser(t *testing.T) {
-	r := httptest.NewRequest("GET", "/", nil)
-	claims := jwt.MapClaims{
-		"sub":         "user-hash-456",
-		"azp":         "api-gw",
-		"permissions": []interface{}{"*"},
-	}
-
-	Inject(r, claims)
-
-	assertHeader(t, r, HeaderAuthVerified, "true")
-	assertHeader(t, r, HeaderUser, "user-hash-456")
-	assertHeader(t, r, HeaderRoles, "*")
-	// azp != sub, so acting-service is set
-	assertHeader(t, r, HeaderActingService, "api-gw")
-}
-
-func TestInject_SameSubAndAzp_NoActingService(t *testing.T) {
-	r := httptest.NewRequest("GET", "/", nil)
-	claims := jwt.MapClaims{
-		"sub":   "portfolio-agent",
-		"azp":   "portfolio-agent",
-		"roles": []interface{}{"llm:inference"},
-	}
-
-	Inject(r, claims)
-
-	assertHeader(t, r, HeaderActingService, "")
-}
-
-func TestInject_RolesOverPermissions(t *testing.T) {
-	r := httptest.NewRequest("GET", "/", nil)
-	claims := jwt.MapClaims{
-		"sub":         "user-1",
-		"roles":       []interface{}{"llm:inference"},
-		"permissions": []interface{}{"admin:*"},
-	}
-
-	Inject(r, claims)
-
-	// roles takes precedence over permissions
-	assertHeader(t, r, HeaderRoles, "llm:inference")
-}
-
-func TestInject_PermissionsFallback(t *testing.T) {
-	r := httptest.NewRequest("GET", "/", nil)
-	claims := jwt.MapClaims{
-		"sub":         "user-1",
-		"permissions": []interface{}{"grafana:read", "grafana:write"},
-	}
-
-	Inject(r, claims)
-
-	assertHeader(t, r, HeaderRoles, "grafana:read,grafana:write")
-}
-
-func TestInject_EmptyClaims(t *testing.T) {
-	r := httptest.NewRequest("GET", "/", nil)
-	claims := jwt.MapClaims{}
-
-	Inject(r, claims)
-
-	assertHeader(t, r, HeaderAuthVerified, "true")
-	assertHeader(t, r, HeaderUser, "")
-	assertHeader(t, r, HeaderRoles, "")
-	assertHeader(t, r, HeaderActingService, "")
-}
-
-func TestInject_NilValuesInClaims(t *testing.T) {
-	r := httptest.NewRequest("GET", "/", nil)
-	claims := jwt.MapClaims{
-		"sub":   nil,
-		"azp":   nil,
-		"roles": nil,
-	}
-
-	Inject(r, claims)
-
-	assertHeader(t, r, HeaderAuthVerified, "true")
-	assertHeader(t, r, HeaderUser, "")
-	assertHeader(t, r, HeaderRoles, "")
-}
-
-func TestInject_WildcardPermission(t *testing.T) {
-	r := httptest.NewRequest("GET", "/", nil)
-	claims := jwt.MapClaims{
-		"sub":         "admin-user",
-		"permissions": []interface{}{"*"},
-	}
-
-	Inject(r, claims)
-
-	// Wildcard passed as literal, never expanded
-	assertHeader(t, r, HeaderRoles, "*")
-}
-
-func TestInject_MixedTypeRolesArray(t *testing.T) {
-	r := httptest.NewRequest("GET", "/", nil)
-	claims := jwt.MapClaims{
-		"sub":   "user-1",
-		"roles": []interface{}{"llm:inference", 42, nil, "", "memory:read"},
-	}
-
-	Inject(r, claims)
-
-	// Non-string and empty elements skipped
-	assertHeader(t, r, HeaderRoles, "llm:inference,memory:read")
-}
-
-func TestInject_EmptyRolesArray(t *testing.T) {
-	r := httptest.NewRequest("GET", "/", nil)
-	claims := jwt.MapClaims{
-		"sub":         "user-1",
-		"roles":       []interface{}{},
-		"permissions": []interface{}{"backup:read"},
-	}
-
-	Inject(r, claims)
-
-	// Empty roles falls through to permissions
-	assertHeader(t, r, HeaderRoles, "backup:read")
-}
-
-func TestStripThenInject_OverwritesSpoof(t *testing.T) {
-	r := httptest.NewRequest("GET", "/", nil)
-	r.Header.Set(HeaderUser, "evil-spoof")
-	r.Header.Set(HeaderAuthVerified, "true")
-
-	StripIncoming(r)
-
-	claims := jwt.MapClaims{
-		"sub":   "real-user",
-		"roles": []interface{}{"llm:inference"},
-	}
-	Inject(r, claims)
-
-	assertHeader(t, r, HeaderUser, "real-user")
-	assertHeader(t, r, HeaderAuthVerified, "true")
-}
-
-func assertHeader(t *testing.T, r *http.Request, key, want string) {
-	t.Helper()
-	got := r.Header.Get(key)
-	if got != want {
-		t.Errorf("header %s = %q, want %q", key, got, want)
-	}
-}

internal/integration/integration_test.go

@@ -1,299 +0,0 @@
-//go:build integration
-
-package integration
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"testing"
-	"time"
-)
-
-const (
-	gatewayBaseURL = "http://api-gateway:8080"
-	timeout        = 30 * time.Second
-)
-
-// TestIntegrationMemoryService tests memory adapter (ingest, query)
-func TestIntegrationMemoryService(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test")
-	}
-
-	client := &http.Client{Timeout: timeout}
-
-	// Test 1: Ingest memory
-	t.Log("Testing memory ingest...")
-	ingestPayload := map[string]interface{}{
-		"ingest_id": "test-ingest-" + fmt.Sprintf("%d", time.Now().Unix()),
-		"project":   "test-project",
-		"title":     "Integration Test Memory",
-		"content":   "This is a test memory entry from integration test",
-		"tags":      []string{"integration", "test"},
-		"source":    "integration-test",
-	}
-
-	ingestBody, _ := json.Marshal(ingestPayload)
-	req, _ := http.NewRequest("POST", gatewayBaseURL+"/memory/ingest", bytes.NewReader(ingestBody))
-	req.Header.Set("X-Service", "memory")
-	req.Header.Set("X-Resource", "ingest")
-	req.Header.Set("Content-Type", "application/json")
-
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("memory ingest request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	body, _ := io.ReadAll(resp.Body)
-	t.Logf("Ingest response: %d - %s", resp.StatusCode, string(body))
-
-	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
-		t.Fatalf("memory ingest failed with status %d", resp.StatusCode)
-	}
-
-	t.Log("✓ Memory ingest successful")
-
-	// Test 2: Query memory
-	t.Log("Testing memory query...")
-	queryPayload := map[string]interface{}{
-		"query": "integration test",
-	}
-
-	queryBody, _ := json.Marshal(queryPayload)
-	req, _ = http.NewRequest("POST", gatewayBaseURL+"/memory/query", bytes.NewReader(queryBody))
-	req.Header.Set("X-Service", "memory")
-	req.Header.Set("X-Resource", "query")
-	req.Header.Set("Content-Type", "application/json")
-
-	resp, err = client.Do(req)
-	if err != nil {
-		t.Fatalf("memory query request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	body, _ = io.ReadAll(resp.Body)
-	t.Logf("Query response: %d - %s", resp.StatusCode, string(body))
-
-	if resp.StatusCode != http.StatusOK {
-		t.Fatalf("memory query failed with status %d", resp.StatusCode)
-	}
-
-	t.Log("✓ Memory query successful")
-}
-
-// TestIntegrationS3Service tests S3 adapter (list, put, get)
-func TestIntegrationS3Service(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test")
-	}
-
-	client := &http.Client{Timeout: timeout}
-
-	// Test 1: List objects
-	t.Log("Testing S3 list objects...")
-	req, _ := http.NewRequest("GET", gatewayBaseURL+"/", nil)
-	req.Header.Set("X-Service", "s3")
-	req.Header.Set("X-Resource", "list-objects")
-
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("S3 list request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	body, _ := io.ReadAll(resp.Body)
-	t.Logf("List response: %d - %s", resp.StatusCode, string(body)[:100])
-
-	// S3 should respond with either 200 (list) or 403 (access denied) - both mean routing works
-	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusForbidden {
-		t.Fatalf("S3 list failed with unexpected status %d", resp.StatusCode)
-	}
-
-	t.Log("✓ S3 list objects successful")
-
-	// Test 2: Put object to dedicated test bucket
-	t.Log("Testing S3 put object...")
-	testContent := fmt.Sprintf("Integration test data - %d", time.Now().Unix())
-	testKey := "test-file-" + fmt.Sprintf("%d", time.Now().Unix()) + ".txt"
-
-	req, _ = http.NewRequest("PUT", gatewayBaseURL+"/"+testKey, bytes.NewReader([]byte(testContent)))
-	req.Header.Set("X-Service", "s3")
-	req.Header.Set("X-Resource", "put-object")
-	req.Header.Set("Content-Type", "text/plain")
-
-	resp, err = client.Do(req)
-	if err != nil {
-		t.Fatalf("S3 put request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	body, _ = io.ReadAll(resp.Body)
-	t.Logf("Put response: %d - %s", resp.StatusCode, string(body)[:100])
-
-	// Put should respond - either success or S3 error (both mean routing works)
-	if resp.StatusCode < 200 || resp.StatusCode >= 600 {
-		t.Fatalf("S3 put failed with status %d", resp.StatusCode)
-	}
-
-	t.Log("✓ S3 put object successful")
-}
-
-// TestIntegrationSQSService tests SQS adapter (create queue, send, receive)
-func TestIntegrationSQSService(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test")
-	}
-
-	client := &http.Client{Timeout: timeout}
-
-	// Test 1: List queues (no auth required in test, auth error is ok)
-	t.Log("Testing SQS list queues...")
-	req, _ := http.NewRequest("GET", gatewayBaseURL+"/sqs/queues", nil)
-	req.Header.Set("X-Service", "sqs")
-	req.Header.Set("X-Resource", "list-queues")
-
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("SQS list request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	body, _ := io.ReadAll(resp.Body)
-	t.Logf("List queues response: %d - %s", resp.StatusCode, string(body))
-
-	// SQS requires auth, so 401 is expected but proves routing works
-	if resp.StatusCode == http.StatusUnauthorized {
-		t.Log("✓ SQS correctly requires authorization (routing works)")
-		return
-	}
-
-	if resp.StatusCode == http.StatusOK {
-		t.Log("✓ SQS list queues successful")
-		return
-	}
-
-	t.Fatalf("SQS list failed with unexpected status %d", resp.StatusCode)
-}
-
-// TestIntegrationWorkflowService tests workflow adapter (list, describe)
-func TestIntegrationWorkflowService(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test")
-	}
-
-	client := &http.Client{Timeout: timeout}
-
-	// Test 1: List workflows with gRPC
-	t.Log("Testing workflow list (gRPC)...")
-	req, _ := http.NewRequest("GET", 
-		gatewayBaseURL+"/temporal.api.workflowservice.v1.WorkflowService/ListWorkflowExecutions", 
-		nil)
-	req.Header.Set("X-Service", "workflow")
-	req.Header.Set("X-Resource", "list")
-	req.Header.Set("Content-Type", "application/grpc")
-	req.Header.Set("TE", "trailers")
-
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("workflow list request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	body, _ := io.ReadAll(resp.Body)
-	
-	// gRPC responses are binary, but we can check status code
-	t.Logf("List workflows response: %d (body length: %d bytes)", resp.StatusCode, len(body))
-
-	// Status 200 with gRPC binary data, or 501 if not yet implemented
-	if resp.StatusCode == http.StatusOK {
-		t.Log("✓ Workflow list successful (gRPC forwarding working)")
-		return
-	}
-
-	if resp.StatusCode == http.StatusNotImplemented {
-		t.Log("⚠ Workflow list: gRPC forwarding not yet implemented")
-		return
-	}
-
-	if resp.StatusCode >= 400 && resp.StatusCode < 500 {
-		// Client error might indicate routing works but request format issue
-		t.Logf("✓ Workflow adapter routing confirmed (status %d)", resp.StatusCode)
-		return
-	}
-
-	t.Fatalf("Workflow list failed with status %d", resp.StatusCode)
-}
-
-// TestIntegrationIAMService tests IAM adapter
-func TestIntegrationIAMService(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test")
-	}
-
-	client := &http.Client{Timeout: timeout}
-
-	t.Log("Testing IAM list users...")
-	req, _ := http.NewRequest("GET", gatewayBaseURL+"/api/v3/users", nil)
-	req.Header.Set("X-Service", "iam")
-	req.Header.Set("X-Resource", "list-users")
-
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("IAM list request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	_, _ = io.ReadAll(resp.Body)
-	t.Logf("IAM list users response: %d", resp.StatusCode)
-
-	// IAM (Authentik) should respond - 200, 404, or auth error all prove routing works
-	if resp.StatusCode >= 200 && resp.StatusCode < 600 {
-		t.Log("✓ IAM adapter routing successful")
-		return
-	}
-
-	t.Fatalf("IAM list failed with status %d", resp.StatusCode)
-}
-
-// TestIntegrationHealthChecks tests gateway health endpoints
-func TestIntegrationHealthChecks(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test")
-	}
-
-	client := &http.Client{Timeout: timeout}
-
-	tests := []struct {
-		name     string
-		endpoint string
-	}{
-		{"liveness", "/healthz"},
-		{"readiness", "/readyz"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			req, _ := http.NewRequest("GET", gatewayBaseURL+tt.endpoint, nil)
-			resp, err := client.Do(req)
-			if err != nil {
-				t.Fatalf("health check request failed: %v", err)
-			}
-			defer resp.Body.Close()
-
-			if resp.StatusCode != http.StatusOK {
-				t.Fatalf("health check failed with status %d", resp.StatusCode)
-			}
-
-			var health map[string]string
-			if err := json.NewDecoder(resp.Body).Decode(&health); err != nil {
-				t.Fatalf("failed to decode health response: %v", err)
-			}
-
-			t.Logf("✓ %s: %s", tt.name, health["status"])
-		})
-	}
-}

internal/notification/handler.go

@@ -1,160 +0,0 @@
-package notification
-
-import (
-	"encoding/json"
-	"fmt"
-	"log"
-	"net/http"
-	"net/smtp"
-	"os"
-)
-
-// SendMsgRequest represents a sendMsg API request.
-type SendMsgRequest struct {
-	Format  string            `json:"format"`  // "smtp" or "sms"
-	Title   string            `json:"title"`
-	Message string            `json:"message"`
-	Priority int             `json:"priority,omitempty"`
-	Extras  map[string]string `json:"extras,omitempty"` // e.g., {"to_email": "[email protected]", "phone": "+1234567890"}
-}
-
-// SendMsgResponse represents a sendMsg API response.
-type SendMsgResponse struct {
-	Status  string `json:"status"`
-	MessageID string `json:"messageId,omitempty"`
-	Error  string `json:"error,omitempty"`
-}
-
-// Handler handles sendMsg requests and forwards to appropriate channel (email, SMS, or Gotify push).
-type Handler struct {
-	smtpHost     string
-	smtpPort     string
-	smtpFrom     string
-	smtpUser     string
-	smtpPass     string
-	smsAPIURL    string
-	smsAPIKey    string
-	gotifyURL    string
-	gotifyToken  string
-}
-
-// NewHandler creates a new notification handler from environment variables.
-func NewHandler() *Handler {
-	return &Handler{
-		smtpHost:    os.Getenv("SMTP_HOST"),
-		smtpPort:    os.Getenv("SMTP_PORT"),
-		smtpFrom:    os.Getenv("SMTP_FROM"),
-		smtpUser:    os.Getenv("SMTP_USER"),
-		smtpPass:    os.Getenv("SMTP_PASS"),
-		smsAPIURL:   os.Getenv("SMS_API_URL"),
-		smsAPIKey:   os.Getenv("SMS_API_KEY"),
-		gotifyURL:   os.Getenv("GOTIFY_URL"),
-		gotifyToken: os.Getenv("GOTIFY_TOKEN"),
-	}
-}
-
-// ServeHTTP handles sendMsg requests.
-func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
-	var req SendMsgRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusBadRequest)
-		json.NewEncoder(w).Encode(SendMsgResponse{
-			Status: "error",
-			Error:  "invalid request: " + err.Error(),
-		})
-		return
-	}
-
-	// Route based on format
-	var resp SendMsgResponse
-	switch req.Format {
-	case "smtp":
-		resp = h.sendEmail(req)
-	case "sms":
-		resp = h.sendSMS(req)
-	default:
-		resp = SendMsgResponse{
-			Status: "error",
-			Error:  "unsupported format: " + req.Format,
-		}
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	if resp.Error != "" {
-		w.WriteHeader(http.StatusInternalServerError)
-	} else {
-		w.WriteHeader(http.StatusOK)
-	}
-	json.NewEncoder(w).Encode(resp)
-}
-
-// sendEmail sends an email via SMTP.
-func (h *Handler) sendEmail(req SendMsgRequest) SendMsgResponse {
-	toEmail := req.Extras["to_email"]
-	if toEmail == "" {
-		return SendMsgResponse{
-			Status: "error",
-			Error:  "missing to_email in extras",
-		}
-	}
-
-	subject := req.Title
-	if subject == "" {
-		subject = "Notification"
-	}
-
-	// Construct email body
-	body := req.Message
-	if req.Extras != nil {
-		if cc := req.Extras["cc"]; cc != "" {
-			body = fmt.Sprintf("CC: %s\n\n%s", cc, body)
-		}
-	}
-
-	msg := fmt.Sprintf(
-		"From: %s\r\nTo: %s\r\nSubject: %s\r\nContent-Type: text/plain; charset=UTF-8\r\n\r\n%s",
-		h.smtpFrom, toEmail, subject, body,
-	)
-
-	// Send via SMTP
-	smtpAddr := fmt.Sprintf("%s:%s", h.smtpHost, h.smtpPort)
-	auth := smtp.PlainAuth("", h.smtpUser, h.smtpPass, h.smtpHost)
-
-	if err := smtp.SendMail(smtpAddr, auth, h.smtpFrom, []string{toEmail}, []byte(msg)); err != nil {
-		log.Printf("error sending email to %s: %v", toEmail, err)
-		return SendMsgResponse{
-			Status: "error",
-			Error:  "failed to send email: " + err.Error(),
-		}
-	}
-
-	return SendMsgResponse{
-		Status:    "success",
-		MessageID: fmt.Sprintf("email-%s", toEmail),
-	}
-}
-
-// sendSMS sends an SMS via configured provider.
-// Placeholder: integrate with Twilio, AWS SNS, or similar.
-func (h *Handler) sendSMS(req SendMsgRequest) SendMsgResponse {
-	phone := req.Extras["phone"]
-	if phone == "" {
-		return SendMsgResponse{
-			Status: "error",
-			Error:  "missing phone in extras",
-		}
-	}
-
-	// TODO: Implement SMS provider integration (Twilio, AWS SNS, etc.)
-	// For now, return error
-	return SendMsgResponse{
-		Status: "error",
-		Error:  "SMS not implemented yet",
-	}
-}

internal/proxy/auth_endpoints.go

@@ -1,160 +0,0 @@
-package proxy
-
-import (
-	"encoding/json"
-	"io"
-	"net/http"
-	"net/url"
-	"time"
-
-	"forgejo.riotpiao.com/rock/homelab-frontend/internal/logging"
-)
-
-// tokenRequest is the JSON body for POST /auth/token.
-type tokenRequest struct {
-	Username string `json:"username"`
-	Password string `json:"password"`
-	Scope    string `json:"scope,omitempty"`
-}
-
-// refreshRequest is the JSON body for POST /auth/refresh.
-type refreshRequest struct {
-	RefreshToken string `json:"refresh_token"`
-	Scope        string `json:"scope,omitempty"`
-}
-
-// authClient handles token exchange with the upstream identity provider.
-// Extracted for testability — production uses http.DefaultClient,
-// tests inject a stub.
-type authClient interface {
-	PostForm(url string, data url.Values) (*http.Response, error)
-}
-
-// httpAuthClient wraps http.Client to implement authClient.
-type httpAuthClient struct {
-	client *http.Client
-}
-
-func (c *httpAuthClient) PostForm(url string, data url.Values) (*http.Response, error) {
-	return c.client.PostForm(url, data)
-}
-
-func newAuthClient() authClient {
-	return &httpAuthClient{
-		client: &http.Client{Timeout: 10 * time.Second},
-	}
-}
-
-// handleAuthToken exchanges username+password for a JWT via the upstream
-// identity provider's token endpoint using grant_type=password.
-func (h *Handler) handleAuthToken(w http.ResponseWriter, r *http.Request) {
-	if r.Method != "POST" {
-		writeProblemDetail(w, http.StatusMethodNotAllowed,
-			"about:blank#method-not-allowed", "Method Not Allowed",
-			"POST only", nil)
-		return
-	}
-
-	if h.config.Auth.TokenURL == "" || h.config.Auth.ClientID == "" {
-		writeProblemDetail(w, http.StatusServiceUnavailable,
-			"about:blank#not-configured", "Not Configured",
-			"token endpoint not configured", nil)
-		return
-	}
-
-	var req tokenRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeProblemDetail(w, http.StatusBadRequest,
-			"about:blank#bad-request", "Bad Request",
-			"invalid JSON body", nil)
-		return
-	}
-
-	if req.Username == "" || req.Password == "" {
-		writeProblemDetail(w, http.StatusBadRequest,
-			"about:blank#bad-request", "Bad Request",
-			"username and password are required", nil)
-		return
-	}
-
-	scope := req.Scope
-	if scope == "" {
-		scope = "openid roles permissions"
-	}
-
-	form := url.Values{
-		"grant_type":    {"password"},
-		"username":      {req.Username},
-		"password":      {req.Password},
-		"client_id":     {h.config.Auth.ClientID},
-		"client_secret": {h.config.Auth.ClientSecret},
-		"scope":         {scope},
-	}
-
-	h.forwardTokenResponse(w, form, "/auth/token")
-}
-
-// handleAuthRefresh exchanges a refresh token for a new JWT.
-func (h *Handler) handleAuthRefresh(w http.ResponseWriter, r *http.Request) {
-	if r.Method != "POST" {
-		writeProblemDetail(w, http.StatusMethodNotAllowed,
-			"about:blank#method-not-allowed", "Method Not Allowed",
-			"POST only", nil)
-		return
-	}
-
-	if h.config.Auth.TokenURL == "" || h.config.Auth.ClientID == "" {
-		writeProblemDetail(w, http.StatusServiceUnavailable,
-			"about:blank#not-configured", "Not Configured",
-			"token endpoint not configured", nil)
-		return
-	}
-
-	var req refreshRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeProblemDetail(w, http.StatusBadRequest,
-			"about:blank#bad-request", "Bad Request",
-			"invalid JSON body", nil)
-		return
-	}
-
-	if req.RefreshToken == "" {
-		writeProblemDetail(w, http.StatusBadRequest,
-			"about:blank#bad-request", "Bad Request",
-			"refresh_token is required", nil)
-		return
-	}
-
-	form := url.Values{
-		"grant_type":    {"refresh_token"},
-		"refresh_token": {req.RefreshToken},
-		"client_id":     {h.config.Auth.ClientID},
-		"client_secret": {h.config.Auth.ClientSecret},
-	}
-
-	if req.Scope != "" {
-		form.Set("scope", req.Scope)
-	}
-
-	h.forwardTokenResponse(w, form, "/auth/refresh")
-}
-
-// forwardTokenResponse posts form data to the token endpoint and
-// forwards the response verbatim to the client.
-func (h *Handler) forwardTokenResponse(w http.ResponseWriter, form url.Values, logPath string) {
-	resp, err := h.authHTTP.PostForm(h.config.Auth.TokenURL, form)
-	if err != nil {
-		writeProblemDetail(w, http.StatusBadGateway,
-			"about:blank#bad-gateway", "Bad Gateway",
-			"identity provider unreachable", nil)
-		logging.Errorf("auth upstream error", err, map[string]string{
-			"path": logPath,
-		})
-		return
-	}
-	defer resp.Body.Close()
-
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(resp.StatusCode)
-	io.Copy(w, resp.Body)
-}

internal/proxy/auth_endpoints_test.go

@@ -1,315 +0,0 @@
-package proxy
-
-import (
-	"bytes"
-	"encoding/json"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"strings"
-	"testing"
-
-	"forgejo.riotpiao.com/rock/homelab-frontend/internal/config"
-)
-
-// stubAuthClient captures the form data sent and returns a canned response.
-type stubAuthClient struct {
-	lastForm   url.Values
-	statusCode int
-	body       string
-	err        error
-}
-
-func (s *stubAuthClient) PostForm(u string, data url.Values) (*http.Response, error) {
-	s.lastForm = data
-	if s.err != nil {
-		return nil, s.err
-	}
-	return &http.Response{
-		StatusCode: s.statusCode,
-		Body:       io.NopCloser(strings.NewReader(s.body)),
-		Header:     http.Header{"Content-Type": {"application/json"}},
-	}, nil
-}
-
-func newTestHandler(tokenURL, clientID, clientSecret string, client authClient) *Handler {
-	cfg := &config.Config{
-		Auth: config.AuthConfig{
-			TokenURL:     tokenURL,
-			ClientID:     clientID,
-			ClientSecret: clientSecret,
-		},
-	}
-	h := &Handler{
-		config:   cfg,
-		authHTTP: client,
-		routes:   make(map[string]*Route),
-		transports: make(map[string]*http.Transport),
-	}
-	return h
-}
-
-func TestAuthToken_Success(t *testing.T) {
-	stub := &stubAuthClient{
-		statusCode: 200,
-		body:       `{"access_token":"jwt.token.here","refresh_token":"refresh","expires_in":3600}`,
-	}
-	h := newTestHandler("https://auth.example.com/token/", "api-gw", "secret", stub)
-
-	body := `{"username":"rock","password":"pass123"}`
-	r := httptest.NewRequest("POST", "/auth/token", strings.NewReader(body))
-	w := httptest.NewRecorder()
-
-	h.handleAuthToken(w, r)
-
-	if w.Code != 200 {
-		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-
-	// Verify form sent to upstream
-	if stub.lastForm.Get("grant_type") != "password" {
-		t.Errorf("grant_type = %q, want password", stub.lastForm.Get("grant_type"))
-	}
-	if stub.lastForm.Get("username") != "rock" {
-		t.Errorf("username = %q, want rock", stub.lastForm.Get("username"))
-	}
-	if stub.lastForm.Get("client_id") != "api-gw" {
-		t.Errorf("client_id = %q, want api-gw", stub.lastForm.Get("client_id"))
-	}
-	if stub.lastForm.Get("client_secret") != "secret" {
-		t.Errorf("client_secret = %q, want secret", stub.lastForm.Get("client_secret"))
-	}
-	if stub.lastForm.Get("scope") != "openid roles permissions" {
-		t.Errorf("scope = %q, want default scope", stub.lastForm.Get("scope"))
-	}
-
-	// Verify response forwarded
-	var resp map[string]interface{}
-	json.NewDecoder(w.Body).Decode(&resp)
-	if resp["access_token"] != "jwt.token.here" {
-		t.Errorf("access_token not forwarded")
-	}
-}
-
-func TestAuthToken_CustomScope(t *testing.T) {
-	stub := &stubAuthClient{statusCode: 200, body: `{}`}
-	h := newTestHandler("https://auth.example.com/token/", "api-gw", "secret", stub)
-
-	body := `{"username":"rock","password":"pass","scope":"openid roles"}`
-	r := httptest.NewRequest("POST", "/auth/token", strings.NewReader(body))
-	w := httptest.NewRecorder()
-
-	h.handleAuthToken(w, r)
-
-	if stub.lastForm.Get("scope") != "openid roles" {
-		t.Errorf("scope = %q, want custom scope", stub.lastForm.Get("scope"))
-	}
-}
-
-func TestAuthToken_MissingUsername(t *testing.T) {
-	h := newTestHandler("https://auth.example.com/token/", "api-gw", "secret", &stubAuthClient{})
-
-	body := `{"password":"pass"}`
-	r := httptest.NewRequest("POST", "/auth/token", strings.NewReader(body))
-	w := httptest.NewRecorder()
-
-	h.handleAuthToken(w, r)
-
-	if w.Code != 400 {
-		t.Errorf("expected 400, got %d", w.Code)
-	}
-}
-
-func TestAuthToken_MissingPassword(t *testing.T) {
-	h := newTestHandler("https://auth.example.com/token/", "api-gw", "secret", &stubAuthClient{})
-
-	body := `{"username":"rock"}`
-	r := httptest.NewRequest("POST", "/auth/token", strings.NewReader(body))
-	w := httptest.NewRecorder()
-
-	h.handleAuthToken(w, r)
-
-	if w.Code != 400 {
-		t.Errorf("expected 400, got %d", w.Code)
-	}
-}
-
-func TestAuthToken_InvalidJSON(t *testing.T) {
-	h := newTestHandler("https://auth.example.com/token/", "api-gw", "secret", &stubAuthClient{})
-
-	r := httptest.NewRequest("POST", "/auth/token", strings.NewReader("not json"))
-	w := httptest.NewRecorder()
-
-	h.handleAuthToken(w, r)
-
-	if w.Code != 400 {
-		t.Errorf("expected 400, got %d", w.Code)
-	}
-}
-
-func TestAuthToken_WrongMethod(t *testing.T) {
-	h := newTestHandler("https://auth.example.com/token/", "api-gw", "secret", &stubAuthClient{})
-
-	r := httptest.NewRequest("GET", "/auth/token", nil)
-	w := httptest.NewRecorder()
-
-	h.handleAuthToken(w, r)
-
-	if w.Code != 405 {
-		t.Errorf("expected 405, got %d", w.Code)
-	}
-}
-
-func TestAuthToken_NotConfigured(t *testing.T) {
-	h := newTestHandler("", "", "", &stubAuthClient{})
-
-	body := `{"username":"rock","password":"pass"}`
-	r := httptest.NewRequest("POST", "/auth/token", strings.NewReader(body))
-	w := httptest.NewRecorder()
-
-	h.handleAuthToken(w, r)
-
-	if w.Code != 503 {
-		t.Errorf("expected 503, got %d", w.Code)
-	}
-}
-
-func TestAuthToken_UpstreamError(t *testing.T) {
-	stub := &stubAuthClient{err: io.ErrUnexpectedEOF}
-	h := newTestHandler("https://auth.example.com/token/", "api-gw", "secret", stub)
-
-	body := `{"username":"rock","password":"pass"}`
-	r := httptest.NewRequest("POST", "/auth/token", strings.NewReader(body))
-	w := httptest.NewRecorder()
-
-	h.handleAuthToken(w, r)
-
-	if w.Code != 502 {
-		t.Errorf("expected 502, got %d", w.Code)
-	}
-}
-
-func TestAuthToken_UpstreamRejectsCredentials(t *testing.T) {
-	stub := &stubAuthClient{
-		statusCode: 400,
-		body:       `{"error":"invalid_grant","error_description":"bad password"}`,
-	}
-	h := newTestHandler("https://auth.example.com/token/", "api-gw", "secret", stub)
-
-	body := `{"username":"rock","password":"wrong"}`
-	r := httptest.NewRequest("POST", "/auth/token", strings.NewReader(body))
-	w := httptest.NewRecorder()
-
-	h.handleAuthToken(w, r)
-
-	// Upstream error forwarded verbatim
-	if w.Code != 400 {
-		t.Errorf("expected 400 (forwarded), got %d", w.Code)
-	}
-	if !strings.Contains(w.Body.String(), "invalid_grant") {
-		t.Errorf("expected upstream error forwarded, got %s", w.Body.String())
-	}
-}
-
-// --- /auth/refresh tests ---
-
-func TestAuthRefresh_Success(t *testing.T) {
-	stub := &stubAuthClient{
-		statusCode: 200,
-		body:       `{"access_token":"new.jwt","refresh_token":"new.refresh","expires_in":3600}`,
-	}
-	h := newTestHandler("https://auth.example.com/token/", "api-gw", "secret", stub)
-
-	body := `{"refresh_token":"old.refresh"}`
-	r := httptest.NewRequest("POST", "/auth/refresh", strings.NewReader(body))
-	w := httptest.NewRecorder()
-
-	h.handleAuthRefresh(w, r)
-
-	if w.Code != 200 {
-		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
-	}
-	if stub.lastForm.Get("grant_type") != "refresh_token" {
-		t.Errorf("grant_type = %q, want refresh_token", stub.lastForm.Get("grant_type"))
-	}
-	if stub.lastForm.Get("refresh_token") != "old.refresh" {
-		t.Errorf("refresh_token not sent")
-	}
-}
-
-func TestAuthRefresh_MissingToken(t *testing.T) {
-	h := newTestHandler("https://auth.example.com/token/", "api-gw", "secret", &stubAuthClient{})
-
-	r := httptest.NewRequest("POST", "/auth/refresh", strings.NewReader(`{}`))
-	w := httptest.NewRecorder()
-
-	h.handleAuthRefresh(w, r)
-
-	if w.Code != 400 {
-		t.Errorf("expected 400, got %d", w.Code)
-	}
-}
-
-func TestAuthRefresh_WrongMethod(t *testing.T) {
-	h := newTestHandler("https://auth.example.com/token/", "api-gw", "secret", &stubAuthClient{})
-
-	r := httptest.NewRequest("GET", "/auth/refresh", nil)
-	w := httptest.NewRecorder()
-
-	h.handleAuthRefresh(w, r)
-
-	if w.Code != 405 {
-		t.Errorf("expected 405, got %d", w.Code)
-	}
-}
-
-func TestAuthRefresh_NotConfigured(t *testing.T) {
-	h := newTestHandler("", "", "", &stubAuthClient{})
-
-	r := httptest.NewRequest("POST", "/auth/refresh", strings.NewReader(`{"refresh_token":"x"}`))
-	w := httptest.NewRecorder()
-
-	h.handleAuthRefresh(w, r)
-
-	if w.Code != 503 {
-		t.Errorf("expected 503, got %d", w.Code)
-	}
-}
-
-func TestAuthRefresh_ExpiredToken(t *testing.T) {
-	stub := &stubAuthClient{
-		statusCode: 401,
-		body:       `{"error":"invalid_grant","error_description":"token expired"}`,
-	}
-	h := newTestHandler("https://auth.example.com/token/", "api-gw", "secret", stub)
-
-	r := httptest.NewRequest("POST", "/auth/refresh", strings.NewReader(`{"refresh_token":"expired"}`))
-	w := httptest.NewRecorder()
-
-	h.handleAuthRefresh(w, r)
-
-	if w.Code != 401 {
-		t.Errorf("expected 401 (forwarded), got %d", w.Code)
-	}
-}
-
-// Verify no credentials are leaked in response bodies
-func TestAuthToken_NoCredentialLeak(t *testing.T) {
-	stub := &stubAuthClient{statusCode: 200, body: `{"access_token":"tok"}`}
-	h := newTestHandler("https://auth.example.com/token/", "api-gw", "super-secret", stub)
-
-	body := `{"username":"rock","password":"my-password"}`
-	r := httptest.NewRequest("POST", "/auth/token", bytes.NewReader([]byte(body)))
-	w := httptest.NewRecorder()
-
-	h.handleAuthToken(w, r)
-
-	respBody := w.Body.String()
-	if strings.Contains(respBody, "super-secret") {
-		t.Error("client_secret leaked in response")
-	}
-	if strings.Contains(respBody, "my-password") {
-		t.Error("password leaked in response")
-	}
-}

internal/proxy/proxy.go

@@ -11,12 +11,10 @@ import (
 	"net/url"
 	"sort"
 	"strings"
-	"syscall"
 	"time"
 
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/auth"
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/config"
-	"forgejo.riotpiao.com/rock/homelab-frontend/internal/identity"
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/logging"
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/tracing"
 )
@@ -30,8 +28,6 @@ type Handler struct {
 	config *config.Config
 	// jwtValidator validates JWT tokens for authenticated endpoints
 	jwtValidator *auth.Validator
-	// authHTTP is the HTTP client for token exchange with the identity provider.
-	authHTTP authClient
 	// Default timeouts for synthesized routes (model-based dispatch)
 	defaultConnectTimeout time.Duration
 	defaultReadTimeout    time.Duration
@@ -89,10 +85,6 @@ func New(cfg *config.Config) *Handler {
 		)
 	}
 
-	if cfg.Auth.TokenURL != "" {
-		h.authHTTP = newAuthClient()
-	}
-
 	for name, route := range cfg.Routes {
 		// Create a transport per unique upstream address for connection reuse
 		transport := h.getOrCreateTransport(route.Upstream.Address, &route.Upstream)
@@ -128,15 +120,6 @@ func (h *Handler) getOrCreateTransport(addr string, up *config.Upstream) *http.T
 	dialer := &net.Dialer{
 		Timeout:   up.ConnectTimeout,
 		KeepAlive: 30 * time.Second,
-		// Issue #31: TCP_NODELAY disables Nagle's algorithm, reducing latency
-		// for streaming responses by sending small packets immediately instead of
-		// waiting for larger batches. Critical for low-latency LLM token streaming.
-		Control: func(network, address string, c syscall.RawConn) error {
-			return c.Control(func(fd uintptr) {
-				// TCP_NODELAY disables Nagle's algorithm for immediate packet transmission
-				_ = syscall.SetsockoptInt(int(fd), syscall.IPPROTO_TCP, syscall.TCP_NODELAY, 1)
-			})
-		},
 	}
 
 	transport := &http.Transport{
@@ -144,15 +127,8 @@ func (h *Handler) getOrCreateTransport(addr string, up *config.Upstream) *http.T
 		DialContext:     dialer.DialContext,
 		MaxIdleConns:    100,
 		IdleConnTimeout: 90 * time.Second,
-		// Issue #32: Increase per-host connection limit to support HTTP/2 multiplexing.
-		// With HTTP/2, we can serve many concurrent streams over fewer connections,
-		// but we still allow more connections for better resource utilization.
-		MaxConnsPerHost: 10,
 		// Allow persistent connections
 		DisableKeepAlives: false,
-		// Issue #31: Enable HTTP/2 for client connections to support multiplexing.
-		// This allows concurrent requests to stream simultaneously with better flow control.
-		ForceAttemptHTTP2: true,
 	}
 
 	// Store the upstream config for use in the handler
@@ -251,20 +227,6 @@ func writeProblemDetail(w http.ResponseWriter, status int, problemType, title, d
 
 // ServeHTTP implements http.Handler.
 func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	// Auth endpoints — no JWT required (they issue tokens)
-	if r.URL.Path == "/auth/token" {
-		h.handleAuthToken(w, r)
-		return
-	}
-	if r.URL.Path == "/auth/refresh" {
-		h.handleAuthRefresh(w, r)
-		return
-	}
-	if r.URL.Path == "/auth/exchange" {
-		h.handleAuthExchange(w, r)
-		return
-	}
-
 	// Handle /v1/models endpoint (no routing needed, derived from config)
 	if r.URL.Path == "/v1/models" && r.Method == "GET" {
 		h.handleModelsEndpoint(w, r)
@@ -341,10 +303,6 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Strip spoofed identity headers from all inbound requests.
-	// Must happen before any routing — even unauthenticated paths.
-	identity.StripIncoming(r)
-
 	// JWT Authentication for /v1/* endpoints
 	if h.jwtValidator != nil && strings.HasPrefix(r.URL.Path, "/v1/") {
 		authHeader := r.Header.Get("Authorization")
@@ -373,9 +331,6 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		// Inject identity headers for downstream services
-		identity.Inject(r, claims)
-
 		// Check required capability if configured
 		if h.config.Auth.RequiredCapability != "" {
 			if !h.jwtValidator.CheckPermissions(claims, h.config.Auth.RequiredCapability, "*") {
@@ -446,12 +401,6 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	// A streaming response that's continuously sending should not be cut off.
 	// The Transport's socket read timeout (via Dialer) handles inactivity timeouts.
 
-	// For streaming responses (SSE, chunked), disable buffering to ensure events
-	// reach clients immediately. Issue #33: X-Accel-Buffering:no tells nginx/Ingress
-	// to stream instead of buffer. ResponseController.Flush() in upstream handler
-	// pairs with this to deliver unbuffered chunks.
-	w.Header().Set("X-Accel-Buffering", "no")
-
 	// Serve the request through the proxy
 	proxy.ServeHTTP(w, r)
 }

internal/proxy/streaming_test.go

@@ -476,214 +476,6 @@ func TestNoFullBuffering(t *testing.T) {
 	}
 }
 
-// TestTCPBackpressure verifies that TCP backpressure is respected during streaming.
-// When a client reads slowly, the upstream should experience backpressure on writes.
-func TestTCPBackpressure(t *testing.T) {
-	// Track when upstream started writing and when each write completed
-	var writeTimes []time.Time
-	writesMu := sync.Mutex{}
-
-	upstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "text/event-stream")
-		w.Header().Set("X-Accel-Buffering", "no") // Issue #33: disable buffering
-		w.WriteHeader(http.StatusOK)
-
-		rc := http.NewResponseController(w)
-		// Send many events to trigger backpressure
-		for i := 0; i < 20; i++ {
-			writesMu.Lock()
-			writeTimes = append(writeTimes, time.Now())
-			writesMu.Unlock()
-
-			fmt.Fprintf(w, "data: event%d\n\n", i)
-			if err := rc.Flush(); err != nil {
-				return
-			}
-		}
-	}))
-	defer upstreamServer.Close()
-
-	upstreamAddr := strings.TrimPrefix(upstreamServer.URL, "http://")
-
-	cfg := &config.Config{
-		Routes: map[string]*config.Route{
-			"backpressure-route": {
-				Name: "backpressure-route",
-				Upstream: config.Upstream{
-					Address:        upstreamAddr,
-					ConnectTimeout: 5 * time.Second,
-					ReadTimeout:    10 * time.Second,
-					WriteTimeout:   5 * time.Second,
-					MaxBodySize:    1024 * 1024,
-					AuthRequired:   false,
-				},
-			},
-		},
-	}
-
-	handler := New(cfg)
-	defer handler.Close()
-
-	server := httptest.NewServer(handler)
-	defer server.Close()
-
-	resp, err := http.Get(server.URL + "/backpressure")
-	if err != nil {
-		t.Fatalf("request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	// Verify X-Accel-Buffering header is passed through
-	if resp.Header.Get("X-Accel-Buffering") != "no" {
-		t.Errorf("X-Accel-Buffering header not propagated, got: %s", resp.Header.Get("X-Accel-Buffering"))
-	}
-
-	// Read events with simulated slow client (small buffer)
-	reader := bufio.NewReader(resp.Body)
-	readStart := time.Now()
-	eventCount := 0
-
-	for {
-		line, err := reader.ReadString('\n')
-		if err != nil {
-			if err == io.EOF {
-				break
-			}
-			t.Fatalf("read failed: %v", err)
-		}
-
-		if strings.HasPrefix(strings.TrimSpace(line), "data:") {
-			eventCount++
-			// Simulate slow client by adding delay
-			time.Sleep(5 * time.Millisecond)
-		}
-	}
-
-	// Verify we got all events
-	if eventCount != 20 {
-		t.Errorf("expected 20 events, got %d", eventCount)
-	}
-
-	// Total read time should be roughly eventCount * readDelay
-	// indicating backpressure was applied (upstream couldn't send all at once)
-	elapsed := time.Since(readStart)
-	expectedMin := time.Duration(20*5) * time.Millisecond
-	if elapsed < expectedMin {
-		t.Logf("backpressure test: elapsed=%.0fms (expected ~%.0fms)", elapsed.Seconds()*1000, expectedMin.Seconds()*1000)
-	}
-}
-
-// TestConcurrentSSEStreams verifies that HTTP/2 multiplexing handles multiple concurrent streams.
-// Issue #32: Multiple LLM requests should not block each other.
-func TestConcurrentSSEStreams(t *testing.T) {
-	upstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "text/event-stream")
-		w.Header().Set("X-Accel-Buffering", "no")
-		w.WriteHeader(http.StatusOK)
-
-		rc := http.NewResponseController(w)
-		// Each request sends unique identifier
-		reqID := r.URL.Query().Get("id")
-		for i := 0; i < 5; i++ {
-			fmt.Fprintf(w, "data: [%s] event %d\n\n", reqID, i)
-			if err := rc.Flush(); err != nil {
-				return
-			}
-			time.Sleep(10 * time.Millisecond)
-		}
-	}))
-	defer upstreamServer.Close()
-
-	upstreamAddr := strings.TrimPrefix(upstreamServer.URL, "http://")
-
-	cfg := &config.Config{
-		Routes: map[string]*config.Route{
-			"concurrent-route": {
-				Name: "concurrent-route",
-				Upstream: config.Upstream{
-					Address:        upstreamAddr,
-					ConnectTimeout: 5 * time.Second,
-					ReadTimeout:    10 * time.Second,
-					WriteTimeout:   5 * time.Second,
-					MaxBodySize:    1024 * 1024,
-					AuthRequired:   false,
-				},
-			},
-		},
-	}
-
-	handler := New(cfg)
-	defer handler.Close()
-
-	server := httptest.NewServer(handler)
-	defer server.Close()
-
-	// Launch multiple concurrent requests
-	var wg sync.WaitGroup
-	results := make(map[string][]string)
-	resultsMu := sync.Mutex{}
-
-	for id := 0; id < 3; id++ {
-		wg.Add(1)
-		go func(streamID int) {
-			defer wg.Done()
-
-			url := fmt.Sprintf("%s/concurrent?id=stream%d", server.URL, streamID)
-			resp, err := http.Get(url)
-			if err != nil {
-				t.Errorf("request failed: %v", err)
-				return
-			}
-			defer resp.Body.Close()
-
-			reader := bufio.NewReader(resp.Body)
-			var events []string
-
-			for {
-				line, err := reader.ReadString('\n')
-				if err != nil {
-					if err == io.EOF {
-						break
-					}
-					t.Errorf("read failed: %v", err)
-					return
-				}
-
-				line = strings.TrimSpace(line)
-				if strings.HasPrefix(line, "data:") {
-					events = append(events, line)
-				}
-			}
-
-			resultsMu.Lock()
-			results[fmt.Sprintf("stream%d", streamID)] = events
-			resultsMu.Unlock()
-		}(id)
-	}
-
-	wg.Wait()
-
-	// Verify all streams got their events
-	for i := 0; i < 3; i++ {
-		key := fmt.Sprintf("stream%d", i)
-		events, ok := results[key]
-		if !ok {
-			t.Errorf("stream%d: no results", i)
-			continue
-		}
-		if len(events) != 5 {
-			t.Errorf("stream%d: expected 5 events, got %d", i, len(events))
-		}
-
-		// Verify all events belong to this stream
-		for _, event := range events {
-			if !strings.Contains(event, key) {
-				t.Errorf("stream%d: event from wrong stream: %s", i, event)
-			}
-		}
-	}
-}
-
 // TestClientDisconnectCancelsUpstream verifies that when a client closes mid-stream,
 // the upstream request context is cancelled immediately and no goroutines are leaked.
 func TestClientDisconnectCancelsUpstream(t *testing.T) {

internal/proxy/token_exchange.go

@@ -1,229 +0,0 @@
-package proxy
-
-import (
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/url"
-	"strings"
-
-	"forgejo.riotpiao.com/rock/homelab-frontend/internal/logging"
-)
-
-// exchangeRequest represents a token exchange request (RFC 8693 subset).
-type exchangeRequest struct {
-	SubjectToken string `json:"subject_token"`
-	ClientID     string `json:"client_id"`
-	ClientSecret string `json:"client_secret"`
-	Scope        string `json:"scope,omitempty"`
-	Resource     string `json:"resource,omitempty"`
-}
-
-// exchangeResponse wraps the service token with subject identity metadata.
-type exchangeResponse struct {
-	AccessToken     string `json:"access_token"`
-	TokenType       string `json:"token_type"`
-	ExpiresIn       int    `json:"expires_in"`
-	IssuedTokenType string `json:"issued_token_type,omitempty"`
-	Subject         string `json:"subject,omitempty"`
-	ActingParty     string `json:"acting_party,omitempty"`
-	GrantedScope    string `json:"scope,omitempty"`
-}
-
-// handleAuthExchange implements token exchange: a service presents a user's
-// JWT and its own credentials to get a scoped service token with the user's
-// identity attached.
-//
-// Flow:
-//  1. Validate subject_token (user's JWT) — signature, expiry, issuer
-//  2. Authenticate service via client_credentials against Authentik
-//  3. Verify requested scope is a subset of service's roles
-//  4. Return service token + subject identity metadata
-func (h *Handler) handleAuthExchange(w http.ResponseWriter, r *http.Request) {
-	if r.Method != "POST" {
-		writeProblemDetail(w, http.StatusMethodNotAllowed,
-			"about:blank#method-not-allowed", "Method Not Allowed",
-			"POST only", nil)
-		return
-	}
-
-	if h.jwtValidator == nil || h.config.Auth.TokenURL == "" {
-		writeProblemDetail(w, http.StatusServiceUnavailable,
-			"about:blank#not-configured", "Not Configured",
-			"token exchange not configured", nil)
-		return
-	}
-
-	var req exchangeRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeProblemDetail(w, http.StatusBadRequest,
-			"about:blank#bad-request", "Bad Request",
-			"invalid JSON body", nil)
-		return
-	}
-
-	if req.SubjectToken == "" || req.ClientID == "" || req.ClientSecret == "" {
-		writeProblemDetail(w, http.StatusBadRequest,
-			"about:blank#bad-request", "Bad Request",
-			"subject_token, client_id, and client_secret are required", nil)
-		return
-	}
-
-	// Step 1: Validate subject token
-	subjectClaims, err := h.jwtValidator.ValidateBearerToken("Bearer " + req.SubjectToken)
-	if err != nil {
-		writeProblemDetail(w, http.StatusForbidden,
-			"about:blank#invalid-subject-token", "Invalid Subject Token",
-			fmt.Sprintf("subject token validation failed: %v", err), nil)
-		logging.Errorf("token exchange: invalid subject", err, map[string]string{
-			"path": "/auth/exchange",
-		})
-		return
-	}
-
-	subject := claimStr(subjectClaims, "sub")
-
-	// Step 2: Authenticate service via client_credentials
-	form := url.Values{
-		"grant_type":    {"client_credentials"},
-		"client_id":     {req.ClientID},
-		"client_secret": {req.ClientSecret},
-		"scope":         {"openid roles"},
-	}
-
-	resp, err := h.authHTTP.PostForm(h.config.Auth.TokenURL, form)
-	if err != nil {
-		writeProblemDetail(w, http.StatusBadGateway,
-			"about:blank#bad-gateway", "Bad Gateway",
-			"identity provider unreachable", nil)
-		logging.Errorf("token exchange: upstream error", err, map[string]string{
-			"path": "/auth/exchange",
-		})
-		return
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		writeProblemDetail(w, http.StatusForbidden,
-			"about:blank#invalid-actor", "Invalid Actor Credentials",
-			fmt.Sprintf("service authentication failed (HTTP %d)", resp.StatusCode), nil)
-		return
-	}
-
-	var tokenResp struct {
-		AccessToken string `json:"access_token"`
-		ExpiresIn   int    `json:"expires_in"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil {
-		writeProblemDetail(w, http.StatusBadGateway,
-			"about:blank#bad-gateway", "Bad Gateway",
-			"invalid response from identity provider", nil)
-		return
-	}
-
-	// Step 3: Decode service token to check roles
-	serviceRoles, err := extractRolesFromJWT(tokenResp.AccessToken)
-	if err != nil {
-		writeProblemDetail(w, http.StatusBadGateway,
-			"about:blank#bad-gateway", "Bad Gateway",
-			"cannot decode service token", nil)
-		return
-	}
-
-	if req.Scope != "" && !scopeSubset(req.Scope, serviceRoles) {
-		writeProblemDetail(w, http.StatusForbidden,
-			"about:blank#scope-escalation", "Scope Escalation Denied",
-			fmt.Sprintf("requested scope %q exceeds service roles %v", req.Scope, serviceRoles), nil)
-		return
-	}
-
-	grantedScope := req.Scope
-	if grantedScope == "" {
-		grantedScope = strings.Join(serviceRoles, " ")
-	}
-
-	// Step 4: Return service token with subject metadata
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(http.StatusOK)
-	json.NewEncoder(w).Encode(exchangeResponse{
-		AccessToken:     tokenResp.AccessToken,
-		TokenType:       "Bearer",
-		ExpiresIn:       tokenResp.ExpiresIn,
-		IssuedTokenType: "urn:ietf:params:oauth:token-type:access_token",
-		Subject:         subject,
-		ActingParty:     req.ClientID,
-		GrantedScope:    grantedScope,
-	})
-}
-
-// scopeSubset checks that every space-separated scope token is in allowed roles.
-func scopeSubset(requested string, allowed []string) bool {
-	allowedSet := make(map[string]bool, len(allowed))
-	for _, r := range allowed {
-		allowedSet[r] = true
-	}
-	if allowedSet["*"] {
-		return true
-	}
-	for _, s := range strings.Fields(requested) {
-		if !allowedSet[s] {
-			return false
-		}
-	}
-	return true
-}
-
-// extractRolesFromJWT decodes the payload of a JWT without verification
-// and returns the "roles" claim. Used after the token was already obtained
-// from a trusted source (Authentik client_credentials response).
-func extractRolesFromJWT(token string) ([]string, error) {
-	parts := strings.SplitN(token, ".", 3)
-	if len(parts) != 3 {
-		return nil, fmt.Errorf("invalid JWT format")
-	}
-
-	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
-	if err != nil {
-		return nil, fmt.Errorf("base64 decode failed: %w", err)
-	}
-
-	var claims map[string]interface{}
-	if err := json.Unmarshal(payload, &claims); err != nil {
-		return nil, fmt.Errorf("JSON decode failed: %w", err)
-	}
-
-	return claimStrSlice(claims, "roles"), nil
-}
-
-// claimStr extracts a string claim.
-func claimStr(claims map[string]interface{}, key string) string {
-	v, ok := claims[key]
-	if !ok || v == nil {
-		return ""
-	}
-	s, ok := v.(string)
-	if !ok {
-		return ""
-	}
-	return s
-}
-
-// claimStrSlice extracts a string slice from a JSON-deserialized []interface{}.
-func claimStrSlice(claims map[string]interface{}, key string) []string {
-	v, ok := claims[key]
-	if !ok || v == nil {
-		return nil
-	}
-	raw, ok := v.([]interface{})
-	if !ok {
-		return nil
-	}
-	out := make([]string, 0, len(raw))
-	for _, item := range raw {
-		if s, ok := item.(string); ok && s != "" {
-			out = append(out, s)
-		}
-	}
-	return out
-}

internal/proxy/token_exchange_test.go

@@ -1,215 +0,0 @@
-package proxy
-
-import (
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"forgejo.riotpiao.com/rock/homelab-frontend/internal/auth"
-	"forgejo.riotpiao.com/rock/homelab-frontend/internal/config"
-)
-
-// fakeJWT creates a JWT-shaped string (header.payload.signature) with given claims.
-// Not cryptographically signed — used only with stubbed validators.
-func fakeJWT(claims map[string]interface{}) string {
-	header := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"none","typ":"JWT"}`))
-	payload, _ := json.Marshal(claims)
-	payloadB64 := base64.RawURLEncoding.EncodeToString(payload)
-	return header + "." + payloadB64 + ".fakesig"
-}
-
-// stubJWTValidator returns claims from a pre-set map keyed by token.
-type stubJWTValidator struct {
-	tokens map[string]map[string]interface{}
-}
-
-func (s *stubJWTValidator) ValidateBearerToken(authHeader string) (map[string]interface{}, error) {
-	token := strings.TrimPrefix(authHeader, "Bearer ")
-	if claims, ok := s.tokens[token]; ok {
-		return claims, nil
-	}
-	return nil, fmt.Errorf("invalid token")
-}
-
-func (s *stubJWTValidator) CheckPermissions(claims map[string]interface{}, required ...string) bool {
-	return true
-}
-
-// We can't use stubJWTValidator directly because Handler expects *auth.Validator.
-// Instead, test via the endpoint with a real JWKS server or test the helpers directly.
-
-func TestScopeSubset(t *testing.T) {
-	tests := []struct {
-		requested string
-		allowed   []string
-		want      bool
-	}{
-		{"memory:read", []string{"llm:inference", "memory:read"}, true},
-		{"memory:read memory:write", []string{"memory:read", "memory:write"}, true},
-		{"memory:write", []string{"memory:read"}, false},
-		{"admin:*", []string{"memory:read"}, false},
-		{"anything", []string{"*"}, true},
-		{"", []string{"memory:read"}, true},
-		{"memory:read", []string{}, false},
-	}
-	for _, tt := range tests {
-		got := scopeSubset(tt.requested, tt.allowed)
-		if got != tt.want {
-			t.Errorf("scopeSubset(%q, %v) = %v, want %v", tt.requested, tt.allowed, got, tt.want)
-		}
-	}
-}
-
-func TestExtractRolesFromJWT(t *testing.T) {
-	token := fakeJWT(map[string]interface{}{
-		"roles": []interface{}{"llm:inference", "memory:read"},
-		"sub":   "test-user",
-	})
-
-	roles, err := extractRolesFromJWT(token)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if len(roles) != 2 || roles[0] != "llm:inference" || roles[1] != "memory:read" {
-		t.Errorf("roles = %v, want [llm:inference memory:read]", roles)
-	}
-}
-
-func TestExtractRolesFromJWT_InvalidFormat(t *testing.T) {
-	_, err := extractRolesFromJWT("not-a-jwt")
-	if err == nil {
-		t.Error("expected error for invalid JWT")
-	}
-}
-
-func TestExtractRolesFromJWT_NoRoles(t *testing.T) {
-	token := fakeJWT(map[string]interface{}{"sub": "user"})
-	roles, err := extractRolesFromJWT(token)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if roles != nil {
-		t.Errorf("expected nil roles, got %v", roles)
-	}
-}
-
-func TestHandleAuthExchange_WrongMethod(t *testing.T) {
-	h := newTestHandler("https://auth.example.com/token/", "api-gw", "secret", &stubAuthClient{})
-	h.jwtValidator = auth.NewValidator("", "", "")
-
-	r := httptest.NewRequest("GET", "/auth/exchange", nil)
-	w := httptest.NewRecorder()
-
-	h.handleAuthExchange(w, r)
-
-	if w.Code != 405 {
-		t.Errorf("expected 405, got %d", w.Code)
-	}
-}
-
-func TestHandleAuthExchange_NotConfigured(t *testing.T) {
-	h := &Handler{
-		config: &config.Config{},
-		routes: make(map[string]*Route),
-		transports: make(map[string]*http.Transport),
-	}
-
-	body := `{"subject_token":"x","client_id":"y","client_secret":"z"}`
-	r := httptest.NewRequest("POST", "/auth/exchange", strings.NewReader(body))
-	w := httptest.NewRecorder()
-
-	h.handleAuthExchange(w, r)
-
-	if w.Code != 503 {
-		t.Errorf("expected 503, got %d", w.Code)
-	}
-}
-
-func TestHandleAuthExchange_MissingFields(t *testing.T) {
-	h := newTestHandler("https://auth.example.com/token/", "api-gw", "secret", &stubAuthClient{})
-	h.jwtValidator = auth.NewValidator("", "", "")
-
-	tests := []struct {
-		name string
-		body string
-	}{
-		{"missing subject", `{"client_id":"x","client_secret":"y"}`},
-		{"missing client_id", `{"subject_token":"x","client_secret":"y"}`},
-		{"missing client_secret", `{"subject_token":"x","client_id":"y"}`},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			r := httptest.NewRequest("POST", "/auth/exchange", strings.NewReader(tt.body))
-			w := httptest.NewRecorder()
-			h.handleAuthExchange(w, r)
-			if w.Code != 400 {
-				t.Errorf("expected 400, got %d", w.Code)
-			}
-		})
-	}
-}
-
-func TestHandleAuthExchange_InvalidJSON(t *testing.T) {
-	h := newTestHandler("https://auth.example.com/token/", "api-gw", "secret", &stubAuthClient{})
-	h.jwtValidator = auth.NewValidator("", "", "")
-
-	r := httptest.NewRequest("POST", "/auth/exchange", strings.NewReader("not json"))
-	w := httptest.NewRecorder()
-
-	h.handleAuthExchange(w, r)
-
-	if w.Code != 400 {
-		t.Errorf("expected 400, got %d", w.Code)
-	}
-}
-
-func TestHandleAuthExchange_ScopeEscalation(t *testing.T) {
-	// Test scopeSubset directly since full integration needs JWKS
-	if scopeSubset("admin:delete", []string{"memory:read", "memory:write"}) {
-		t.Error("scope escalation should be denied")
-	}
-	if !scopeSubset("memory:read", []string{"memory:read", "memory:write"}) {
-		t.Error("valid scope should be allowed")
-	}
-}
-
-func TestClaimStr(t *testing.T) {
-	claims := map[string]interface{}{"sub": "user-1", "num": 42, "nil": nil}
-	if got := claimStr(claims, "sub"); got != "user-1" {
-		t.Errorf("claimStr(sub) = %q, want user-1", got)
-	}
-	if got := claimStr(claims, "num"); got != "" {
-		t.Errorf("claimStr(num) = %q, want empty", got)
-	}
-	if got := claimStr(claims, "nil"); got != "" {
-		t.Errorf("claimStr(nil) = %q, want empty", got)
-	}
-	if got := claimStr(claims, "missing"); got != "" {
-		t.Errorf("claimStr(missing) = %q, want empty", got)
-	}
-}
-
-func TestClaimStrSlice(t *testing.T) {
-	claims := map[string]interface{}{
-		"roles": []interface{}{"a", "b", "", nil, 42},
-		"empty": []interface{}{},
-		"str":   "not-a-slice",
-	}
-	if got := claimStrSlice(claims, "roles"); len(got) != 2 || got[0] != "a" || got[1] != "b" {
-		t.Errorf("claimStrSlice(roles) = %v, want [a b]", got)
-	}
-	if got := claimStrSlice(claims, "empty"); len(got) != 0 {
-		t.Errorf("claimStrSlice(empty) = %v, want empty", got)
-	}
-	if got := claimStrSlice(claims, "str"); got != nil {
-		t.Errorf("claimStrSlice(str) = %v, want nil", got)
-	}
-	if got := claimStrSlice(claims, "missing"); got != nil {
-		t.Errorf("claimStrSlice(missing) = %v, want nil", got)
-	}
-}

internal/server/router.go

@@ -33,8 +33,8 @@ func NewRouter(healthChecker *HealthChecker, dispatcher *serviceadapter.Dispatch
 // ServeHTTP implements http.Handler.
 // Priority order:
 // 1. /healthz and /readyz to health handlers
-// 2. X-Service header to ServiceAdapter dispatcher (phase 8) - PREFERRED routing method
-// 3. /workflow* to temporal handler - DEPRECATED: use X-Service: workflow instead
+// 2. X-Service header to ServiceAdapter dispatcher (phase 8)
+// 3. /workflow* to temporal handler
 // 4. All other paths to upstream handler (phase 0-7)
 func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 	// Health endpoints first
@@ -48,8 +48,6 @@ func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 	}
 
 	// X-Service (ServiceAdapter) routing - checked before path-based routing
-	// PREFERRED: All service routing should use X-Service header pattern for consistency,
-	// auth enforcement, and resource-based access control.
 	if req.Header.Get("X-Service") != "" {
 		if r.dispatcher != nil {
 			r.dispatcher.Dispatch(w, req)
@@ -58,8 +56,6 @@ func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 	}
 
 	// Workflow endpoints
-	// DEPRECATED: Path-based /workflow routing is legacy.
-	// New clients should use X-Service: workflow header instead for consistent auth.
 	switch req.URL.Path {
 	case "/workflow", "/workflow/health", "/workflow/metrics":
 		r.temporalHandler.ServeHTTP(w, req)

internal/server/server.go

@@ -6,8 +6,6 @@ import (
 	"net/http"
 	"sync"
 	"time"
-
-	"golang.org/x/net/http2"
 )
 
 // Server wraps an HTTP server with graceful shutdown support.
@@ -21,30 +19,20 @@ type Server struct {
 
 // New creates a new Server with the given configuration.
 func New(listenAddr string, shutdownTimeout time.Duration, handler http.Handler) *Server {
-	httpServer := &http.Server{
-		Addr:    listenAddr,
-		Handler: handler,
-		// ReadHeaderTimeout (not ReadTimeout) and a long WriteTimeout: both
-		// ReadTimeout and WriteTimeout are absolute deadlines covering the
-		// whole request/response body, not inactivity timeouts -- a 15s
-		// WriteTimeout here was killing in-progress LLM SSE streams (proxy.go's
-		// outbound transport deliberately avoids this same mistake). Mirrors
-		// the edge nginx Ingress's proxy-read/send-timeout of 3600s.
-		ReadHeaderTimeout: 15 * time.Second,
-		WriteTimeout:      1 * time.Hour,
-		IdleTimeout:       60 * time.Second,
-	}
-
-	// Issue #32: Enable HTTP/2 for multiplexing concurrent streams.
-	// This allows multiple LLM requests over a single connection,
-	// improving throughput and reducing latency for concurrent clients.
-	if err := http2.ConfigureServer(httpServer, nil); err != nil {
-		// Silently fail HTTP/2 config (shouldn't happen, but gracefully degrade)
-		// Server will still work with HTTP/1.1
-	}
-
 	return &Server{
-		httpServer:      httpServer,
+		httpServer: &http.Server{
+			Addr:    listenAddr,
+			Handler: handler,
+			// ReadHeaderTimeout (not ReadTimeout) and a long WriteTimeout: both
+			// ReadTimeout and WriteTimeout are absolute deadlines covering the
+			// whole request/response body, not inactivity timeouts -- a 15s
+			// WriteTimeout here was killing in-progress LLM SSE streams (proxy.go's
+			// outbound transport deliberately avoids this same mistake). Mirrors
+			// the edge nginx Ingress's proxy-read/send-timeout of 3600s.
+			ReadHeaderTimeout: 15 * time.Second,
+			WriteTimeout:      1 * time.Hour,
+			IdleTimeout:       60 * time.Second,
+		},
 		shutdownTimeout: shutdownTimeout,
 		healthChecker:   NewHealthChecker(false, false),
 	}

internal/serviceadapter/router.go

@@ -10,36 +10,46 @@ import (
 	"strings"
 	"time"
 
-	"golang.org/x/net/http2"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/auth"
-	"forgejo.riotpiao.com/rock/homelab-frontend/internal/identity"
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/problem"
 )
 
 // Dispatcher routes X-Service requests to upstreams.
+// Auth per service:
+//   SQS: Gateway validates JWT (kmsvc code unverified)
+//   MinIO, Temporal: Native JWT support (dumb pipe pass-through)
+//   Memory, IAM: Services validate JWTs themselves
 type Dispatcher struct {
-	registry     *Registry
-	jwtValidator *auth.Validator
+	registry   *Registry
+	sqsJWTAuth *auth.Validator
 }
 
-// NewDispatcher creates a dispatcher with a shared multi-issuer JWT validator.
-// Pass nil to disable auth enforcement (all requests pass through).
-func NewDispatcher(registry *Registry, jwtValidator *auth.Validator) *Dispatcher {
+// NewDispatcher creates a new service adapter dispatcher.
+func NewDispatcher(registry *Registry) *Dispatcher {
+	// Create JWT validator for SQS
+	// Issuer and JWKS URL should match Authentik application config
+	sqsValidator := auth.NewValidator(
+		"https://authentik.riotpiao.com/application/o/sqs/",
+		"sqs",
+		"https://authentik.riotpiao.com/application/o/sqs/jwks/",
+	)
+
 	return &Dispatcher{
-		registry:     registry,
-		jwtValidator: jwtValidator,
+		registry:   registry,
+		sqsJWTAuth: sqsValidator,
 	}
 }
 
-// Matches returns true if the request has an X-Service header.
+// Matches returns true if the request should be dispatched based on X-Service header.
 func (d *Dispatcher) Matches(r *http.Request) bool {
 	return r.Header.Get("X-Service") != ""
 }
 
 // Dispatch routes a request to the appropriate adapter.
+// Returns a problem document if the adapter or resource is not found.
 func (d *Dispatcher) Dispatch(w http.ResponseWriter, r *http.Request) {
 	serviceName := r.Header.Get("X-Service")
 	if serviceName == "" {
@@ -47,117 +57,102 @@ func (d *Dispatcher) Dispatch(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Look up service adapter
 	adapter := d.registry.Get(serviceName)
 	if adapter == nil {
-		d.writeError(w, problem.NotFound(fmt.Sprintf("service '%s' not found", serviceName)))
+		p := problem.NotFound(fmt.Sprintf("service '%s' not found", serviceName))
+		_ = p.Write(w)
 		return
 	}
 
+	// Get resource and method from request
 	resourceName := r.Header.Get("X-Resource")
 	if resourceName == "" {
 		d.writeError(w, problem.BadRequest("X-Resource header required"))
 		return
 	}
 
-	resource := findResource(adapter, resourceName)
+	// Find resource
+	var resource *Resource
+	for i := range adapter.Spec.Resources {
+		if adapter.Spec.Resources[i].Name == resourceName {
+			resource = &adapter.Spec.Resources[i]
+			break
+		}
+	}
+
 	if resource == nil {
-		d.writeError(w, problem.NotFound(
-			fmt.Sprintf("resource '%s' not found in service '%s'", resourceName, serviceName)))
+		p := problem.NotFound(fmt.Sprintf("resource '%s' not found in service '%s'", resourceName, serviceName))
+		_ = p.Write(w)
 		return
 	}
 
-	method := findMethod(resource, r.Method)
+	// Find method matching HTTP verb
+	var method *Method
+	for i := range resource.Methods {
+		if resource.Methods[i].Verb == r.Method {
+			method = &resource.Methods[i]
+			break
+		}
+	}
+
 	if method == nil {
-		d.writeError(w, problem.NotFound(
-			fmt.Sprintf("method %s not defined for resource '%s'", r.Method, resourceName)))
+		p := problem.NotFound(fmt.Sprintf("method %s not defined for resource '%s'", r.Method, resourceName))
+		_ = p.Write(w)
 		return
 	}
 
-	// JWT auth enforcement for adapters that require it
-	if adapter.Spec.Auth.Required && d.jwtValidator != nil {
-		if !d.authenticate(w, r, serviceName, method.Verb) {
+	// Gateway-level JWT validation for SQS (code unverified in kmsvc)
+	// MinIO, Temporal, Memory, IAM have native JWT support - pass through
+	if adapter.Spec.Auth.Required && serviceName == "sqs" {
+		authHeader := r.Header.Get("Authorization")
+		if authHeader == "" {
+			p := problem.NewProblem(http.StatusForbidden, "about:blank#forbidden",
+				"Forbidden", "SQS requires Authorization header")
+			_ = p.Write(w)
+			return
+		}
+
+		// Validate JWT signature against Authentik JWKS
+		claims, err := d.sqsJWTAuth.ValidateBearerToken(authHeader)
+		if err != nil {
+			p := problem.NewProblem(http.StatusForbidden, "about:blank#forbidden",
+				"Forbidden", fmt.Sprintf("JWT validation failed: %v", err))
+			_ = p.Write(w)
+			return
+		}
+
+		// Check required permissions (sqs:read or sqs:write or *)
+		hasPermission := d.sqsJWTAuth.CheckPermissions(claims, "sqs:read", "sqs:write", "*")
+		if !hasPermission {
+			p := problem.NewProblem(http.StatusForbidden, "about:blank#forbidden",
+				"Forbidden", "Insufficient permissions for SQS")
+			_ = p.Write(w)
 			return
 		}
 	}
 
+	// Detect protocol from upstream URL scheme
 	upstreamURL := adapter.Spec.Upstream.URL
 	if strings.HasPrefix(upstreamURL, "grpc://") {
+		// gRPC upstream (Temporal, etc.)
 		d.dispatchGRPC(w, r, upstreamURL, method, adapter)
 	} else {
+		// HTTP upstream (MinIO, Authentik, etc.)
 		d.dispatchHTTP(w, r, upstreamURL, method, adapter)
 	}
 }
 
-// authenticate validates the JWT and checks service-level capability.
-// Returns false (and writes error response) if auth fails.
-func (d *Dispatcher) authenticate(w http.ResponseWriter, r *http.Request, serviceName, verb string) bool {
-	authHeader := r.Header.Get("Authorization")
-	if authHeader == "" {
-		d.writeError(w, problem.NewProblem(http.StatusUnauthorized,
-			"about:blank#unauthorized", "Unauthorized",
-			fmt.Sprintf("service '%s' requires Authorization header", serviceName)))
-		return false
-	}
-
-	claims, err := d.jwtValidator.ValidateBearerToken(authHeader)
-	if err != nil {
-		d.writeError(w, problem.NewProblem(http.StatusForbidden,
-			"about:blank#forbidden", "Forbidden",
-			fmt.Sprintf("JWT validation failed: %v", err)))
-		return false
-	}
-
-	// Check capability: <service>:read for GET/HEAD, <service>:write for mutating verbs
-	required := capabilityForVerb(serviceName, verb)
-	if !d.jwtValidator.CheckPermissions(claims, required, "*") {
-		d.writeError(w, problem.NewProblem(http.StatusForbidden,
-			"about:blank#insufficient-permissions", "Insufficient Permissions",
-			fmt.Sprintf("required capability: %s", required)))
-		return false
-	}
-
-	// Inject identity headers for downstream
-	identity.Inject(r, claims)
-	return true
-}
-
-// capabilityForVerb maps HTTP verbs to <service>:read or <service>:write.
-func capabilityForVerb(serviceName, verb string) string {
-	switch verb {
-	case "GET", "HEAD", "OPTIONS":
-		return serviceName + ":read"
-	default:
-		return serviceName + ":write"
-	}
-}
-
-func findResource(adapter *ServiceAdapter, name string) *Resource {
-	for i := range adapter.Spec.Resources {
-		if adapter.Spec.Resources[i].Name == name {
-			return &adapter.Spec.Resources[i]
-		}
-	}
-	return nil
-}
-
-func findMethod(resource *Resource, verb string) *Method {
-	for i := range resource.Methods {
-		if resource.Methods[i].Verb == verb {
-			return &resource.Methods[i]
-		}
-	}
-	return nil
-}
-
+// dispatchHTTP forwards HTTP requests to upstream, passing Authorization header through.
 func (d *Dispatcher) dispatchHTTP(w http.ResponseWriter, r *http.Request, upstreamURL string, method *Method, adapter *ServiceAdapter) {
 	parsedURL, err := url.Parse(upstreamURL)
 	if err != nil {
-		d.writeError(w, problem.NewProblem(http.StatusInternalServerError,
-			"about:blank#server-error", "Internal Server Error",
-			fmt.Sprintf("invalid upstream URL: %v", err)))
+		d.writeError(w, problem.NewProblem(http.StatusInternalServerError, "about:blank#server-error",
+			"Internal Server Error", fmt.Sprintf("invalid upstream URL: %v", err)))
 		return
 	}
 
+	// Create reverse proxy
 	proxy := httputil.NewSingleHostReverseProxy(parsedURL)
 	proxy.Director = func(req *http.Request) {
 		req.URL.Scheme = parsedURL.Scheme
@@ -165,40 +160,42 @@ func (d *Dispatcher) dispatchHTTP(w http.ResponseWriter, r *http.Request, upstre
 		req.URL.Path = method.UpstreamPath
 		req.RequestURI = ""
 		req.Host = parsedURL.Host
-		
-		// Preserve Authorization header for S3 SigV4 and other auth schemes
-		// Note: httputil.ReverseProxy preserves most headers automatically,
-		// but we need to ensure Authorization isn't lost when overriding Director
+		// Authorization header passes through unchanged
 	}
 
+	// Set timeout
 	timeout := adapter.Spec.Upstream.TimeoutSeconds
 	if timeout <= 0 {
 		timeout = 30
 	}
 	proxy.Transport = &http.Transport{
-		DialContext:          (&net.Dialer{Timeout: time.Duration(timeout) * time.Second}).DialContext,
+		DialContext:         (&net.Dialer{Timeout: time.Duration(timeout) * time.Second}).DialContext,
 		TLSHandshakeTimeout: time.Duration(timeout) * time.Second,
 	}
 
+	// Forward the request
 	proxy.ServeHTTP(w, r)
 }
 
+// dispatchGRPC forwards gRPC requests to upstream.
+// gRPC URL format: grpc://host:port
 func (d *Dispatcher) dispatchGRPC(w http.ResponseWriter, r *http.Request, upstreamURL string, method *Method, adapter *ServiceAdapter) {
+	// Extract host:port from grpc://host:port
 	host := strings.TrimPrefix(upstreamURL, "grpc://")
 	if host == upstreamURL {
-		d.writeError(w, problem.NewProblem(http.StatusInternalServerError,
-			"about:blank#server-error", "Internal Server Error",
-			"invalid gRPC URL format"))
+		d.writeError(w, problem.NewProblem(http.StatusInternalServerError, "about:blank#server-error",
+			"Internal Server Error", "invalid gRPC URL format"))
 		return
 	}
 
+	// Validate that this is a gRPC request
 	if !strings.HasPrefix(r.Header.Get("Content-Type"), "application/grpc") {
-		d.writeError(w, problem.NewProblem(http.StatusBadRequest,
-			"about:blank#bad-request", "Bad Request",
-			"gRPC service requires application/grpc content-type"))
+		d.writeError(w, problem.NewProblem(http.StatusBadRequest, "about:blank#bad-request",
+			"Bad Request", "gRPC service requires application/grpc content-type"))
 		return
 	}
 
+	// Set timeout
 	timeout := adapter.Spec.Upstream.TimeoutSeconds
 	if timeout <= 0 {
 		timeout = 30
@@ -207,45 +204,25 @@ func (d *Dispatcher) dispatchGRPC(w http.ResponseWriter, r *http.Request, upstre
 	ctx, cancel := context.WithTimeout(r.Context(), time.Duration(timeout)*time.Second)
 	defer cancel()
 
+	// Dial gRPC upstream
 	conn, err := grpc.DialContext(ctx, host,
 		grpc.WithTransportCredentials(insecure.NewCredentials()),
-		grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(100*1024*1024)),
+		grpc.WithDefaultCallOptions(
+			grpc.MaxCallRecvMsgSize(100 * 1024 * 1024), // 100MB
+		),
 	)
 	if err != nil {
-		d.writeError(w, problem.NewProblem(http.StatusBadGateway,
-			"about:blank#bad-gateway", "Bad Gateway",
-			fmt.Sprintf("failed to dial gRPC upstream: %v", err)))
+		d.writeError(w, problem.NewProblem(http.StatusBadGateway, "about:blank#bad-gateway",
+			"Bad Gateway", fmt.Sprintf("failed to dial gRPC upstream: %v", err)))
 		return
 	}
 	defer conn.Close()
 
-	// Create HTTP/2 reverse proxy for gRPC
-	// gRPC uses HTTP/2 protocol, so we need an HTTP/2-capable transport
-	upstreamURLObj := &url.URL{
-		Scheme: "http",
-		Host:   host,
-	}
-
-	proxy := httputil.NewSingleHostReverseProxy(upstreamURLObj)
-	proxy.Director = func(req *http.Request) {
-		req.URL.Scheme = "http"
-		req.URL.Host = host
-		req.URL.Path = method.UpstreamPath
-		req.RequestURI = ""
-		req.Host = host
-	}
-
-	// Create HTTP/2 client transport for gRPC calls
-	// gRPC requires HTTP/2 for proper message framing
-	h2transport := &http2.Transport{
-		AllowHTTP: true,
-	}
-
-	// Set the transport on the proxy
-	proxy.Transport = h2transport
-
-	// Serve the request through the proxy
-	proxy.ServeHTTP(w, r)
+	// Forward gRPC request
+	// Note: Full gRPC forwarding requires grpcproxy or custom middleware.
+	// For now, return unimplemented (Temporal support coming in Phase 9)
+	d.writeError(w, problem.NewProblem(http.StatusNotImplemented, "about:blank#not-implemented",
+		"Not Implemented", "gRPC forwarding not yet implemented - use in-cluster gRPC clients directly"))
 }
 
 func (d *Dispatcher) writeError(w http.ResponseWriter, p *problem.Problem) {

internal/serviceadapter/router_test.go

@@ -1,265 +0,0 @@
-package serviceadapter
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"forgejo.riotpiao.com/rock/homelab-frontend/internal/identity"
-)
-
-// stubValidator implements the minimum interface for testing auth.
-// Real auth.Validator needs JWKS — we test the dispatcher logic, not JWT crypto.
-
-func newTestRegistry(adapters ...ServiceAdapter) *Registry {
-	r := NewRegistry(nil)
-	for i := range adapters {
-		_ = r.Add(&adapters[i])
-	}
-	return r
-}
-
-func sqsAdapter(authRequired bool) ServiceAdapter {
-	return ServiceAdapter{
-		Name:        "sqs",
-		ServiceName: "sqs",
-		Spec: Spec{
-			ServiceName: "sqs",
-			Upstream:    Upstream{URL: "http://localhost:9999", TimeoutSeconds: 5},
-			Auth:        Auth{Required: authRequired},
-			Resources: []Resource{
-				{
-					Name: "list-queues",
-					Methods: []Method{
-						{Verb: "GET", UpstreamPath: "/sqs/queues"},
-					},
-				},
-				{
-					Name: "send-message",
-					Methods: []Method{
-						{Verb: "POST", UpstreamPath: "/sqs/send"},
-					},
-				},
-			},
-		},
-	}
-}
-
-func memoryAdapter() ServiceAdapter {
-	return ServiceAdapter{
-		Name:        "memory",
-		ServiceName: "memory",
-		Spec: Spec{
-			ServiceName: "memory",
-			Upstream:    Upstream{URL: "http://localhost:8888", TimeoutSeconds: 5},
-			Auth:        Auth{Required: false},
-			Resources: []Resource{
-				{
-					Name: "skills",
-					Methods: []Method{
-						{Verb: "GET", UpstreamPath: "/memory/skills"},
-					},
-				},
-			},
-		},
-	}
-}
-
-func TestDispatch_MissingXService(t *testing.T) {
-	d := NewDispatcher(newTestRegistry(), nil)
-	w := httptest.NewRecorder()
-	r := httptest.NewRequest("GET", "/", nil)
-
-	d.Dispatch(w, r)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("expected 400, got %d", w.Code)
-	}
-}
-
-func TestDispatch_UnknownService(t *testing.T) {
-	d := NewDispatcher(newTestRegistry(), nil)
-	w := httptest.NewRecorder()
-	r := httptest.NewRequest("GET", "/", nil)
-	r.Header.Set("X-Service", "nonexistent")
-	r.Header.Set("X-Resource", "foo")
-
-	d.Dispatch(w, r)
-
-	if w.Code != http.StatusNotFound {
-		t.Errorf("expected 404, got %d", w.Code)
-	}
-}
-
-func TestDispatch_MissingXResource(t *testing.T) {
-	d := NewDispatcher(newTestRegistry(memoryAdapter()), nil)
-	w := httptest.NewRecorder()
-	r := httptest.NewRequest("GET", "/", nil)
-	r.Header.Set("X-Service", "memory")
-
-	d.Dispatch(w, r)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("expected 400, got %d", w.Code)
-	}
-}
-
-func TestDispatch_UnknownResource(t *testing.T) {
-	d := NewDispatcher(newTestRegistry(memoryAdapter()), nil)
-	w := httptest.NewRecorder()
-	r := httptest.NewRequest("GET", "/", nil)
-	r.Header.Set("X-Service", "memory")
-	r.Header.Set("X-Resource", "nonexistent")
-
-	d.Dispatch(w, r)
-
-	if w.Code != http.StatusNotFound {
-		t.Errorf("expected 404, got %d", w.Code)
-	}
-}
-
-func TestDispatch_WrongHTTPVerb(t *testing.T) {
-	d := NewDispatcher(newTestRegistry(memoryAdapter()), nil)
-	w := httptest.NewRecorder()
-	r := httptest.NewRequest("DELETE", "/", nil)
-	r.Header.Set("X-Service", "memory")
-	r.Header.Set("X-Resource", "skills")
-
-	d.Dispatch(w, r)
-
-	if w.Code != http.StatusNotFound {
-		t.Errorf("expected 404, got %d", w.Code)
-	}
-}
-
-func TestDispatch_AuthRequired_NoToken(t *testing.T) {
-	// Use nil validator — auth required but no validator means 401
-	// Actually with nil validator, auth is skipped. Use a real scenario.
-	// We need a mock validator. For now test that auth.Required=false passes through.
-	// The real auth test needs the full JWKS setup which is an integration test.
-
-	// Test: auth required, no validator configured = passes through (defense in depth via NetworkPolicy)
-	d := NewDispatcher(newTestRegistry(sqsAdapter(true)), nil)
-	w := httptest.NewRecorder()
-	r := httptest.NewRequest("GET", "/", nil)
-	r.Header.Set("X-Service", "sqs")
-	r.Header.Set("X-Resource", "list-queues")
-
-	d.Dispatch(w, r)
-
-	// With nil validator, auth check is skipped — request reaches upstream (which will fail since localhost:9999 is down)
-	// The key assertion: it did NOT return 401/403, it tried to proxy
-	if w.Code == http.StatusUnauthorized || w.Code == http.StatusForbidden {
-		t.Errorf("expected proxy attempt (not auth rejection), got %d", w.Code)
-	}
-}
-
-func TestDispatch_AuthNotRequired_NoToken(t *testing.T) {
-	// Start a test upstream
-	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		json.NewEncoder(w).Encode(map[string]string{"path": r.URL.Path})
-	}))
-	defer upstream.Close()
-
-	adapter := memoryAdapter()
-	adapter.Spec.Upstream.URL = upstream.URL
-
-	d := NewDispatcher(newTestRegistry(adapter), nil)
-	w := httptest.NewRecorder()
-	r := httptest.NewRequest("GET", "/", nil)
-	r.Header.Set("X-Service", "memory")
-	r.Header.Set("X-Resource", "skills")
-
-	d.Dispatch(w, r)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("expected 200, got %d", w.Code)
-	}
-
-	var body map[string]string
-	json.NewDecoder(w.Body).Decode(&body)
-	if body["path"] != "/memory/skills" {
-		t.Errorf("expected upstream path /memory/skills, got %s", body["path"])
-	}
-}
-
-func TestDispatch_PassThroughHeaders(t *testing.T) {
-	var receivedAuth string
-	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		receivedAuth = r.Header.Get("Authorization")
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer upstream.Close()
-
-	adapter := memoryAdapter()
-	adapter.Spec.Upstream.URL = upstream.URL
-
-	d := NewDispatcher(newTestRegistry(adapter), nil)
-	w := httptest.NewRecorder()
-	r := httptest.NewRequest("GET", "/", nil)
-	r.Header.Set("X-Service", "memory")
-	r.Header.Set("X-Resource", "skills")
-	r.Header.Set("Authorization", "Bearer some-jwt")
-
-	d.Dispatch(w, r)
-
-	if receivedAuth != "Bearer some-jwt" {
-		t.Errorf("Authorization header not passed through, got %q", receivedAuth)
-	}
-}
-
-func TestCapabilityForVerb(t *testing.T) {
-	tests := []struct {
-		service string
-		verb    string
-		want    string
-	}{
-		{"sqs", "GET", "sqs:read"},
-		{"sqs", "HEAD", "sqs:read"},
-		{"sqs", "OPTIONS", "sqs:read"},
-		{"sqs", "POST", "sqs:write"},
-		{"sqs", "PUT", "sqs:write"},
-		{"sqs", "DELETE", "sqs:write"},
-		{"sqs", "PATCH", "sqs:write"},
-		{"memory", "GET", "memory:read"},
-		{"memory", "POST", "memory:write"},
-		{"s3", "GET", "s3:read"},
-		{"s3", "PUT", "s3:write"},
-	}
-	for _, tt := range tests {
-		got := capabilityForVerb(tt.service, tt.verb)
-		if got != tt.want {
-			t.Errorf("capabilityForVerb(%s, %s) = %s, want %s", tt.service, tt.verb, got, tt.want)
-		}
-	}
-}
-
-func TestDispatch_IdentityHeadersNotSet_WhenNoAuth(t *testing.T) {
-	var gotUser, gotVerified string
-	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotUser = r.Header.Get(identity.HeaderUser)
-		gotVerified = r.Header.Get(identity.HeaderAuthVerified)
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer upstream.Close()
-
-	adapter := memoryAdapter()
-	adapter.Spec.Upstream.URL = upstream.URL
-
-	d := NewDispatcher(newTestRegistry(adapter), nil)
-	w := httptest.NewRecorder()
-	r := httptest.NewRequest("GET", "/", nil)
-	r.Header.Set("X-Service", "memory")
-	r.Header.Set("X-Resource", "skills")
-
-	d.Dispatch(w, r)
-
-	if gotUser != "" {
-		t.Errorf("X-Forwarded-User should not be set without auth, got %q", gotUser)
-	}
-	if gotVerified != "" {
-		t.Errorf("X-Auth-Verified should not be set without auth, got %q", gotVerified)
-	}
-}

k8s/deployment.yaml

@@ -57,12 +57,6 @@ spec:
           value: "0.0.0.0:8080"
         - name: CONFIG_PATH
           value: "/etc/gateway/config.yaml"
-        - name: AUTH_CLIENT_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: api-gw-client-secret
-              key: client-secret
-              optional: true
         - name: SHUTDOWN_TIMEOUT
           value: "5m"
         - name: LOG_LEVEL

k8s/gateway-config-secret.enc.yaml

@@ -0,0 +1,129 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: api-gateway-config
+  namespace: api
+  labels:
+    app: api-gateway
+type: Opaque
+stringData:
+  config.yaml: |
+    auth:
+      enabled: true
+      issuer: "https://authentik.riotpiao.com/application/o/api-gw/"
+      audience: "api-gw"
+      jwksUrl: "http://authentik-server.iam.svc.cluster.local/application/o/api-gw/jwks/"
+      requiredCapability: "llm:inference"
+    routes: []
+    models:
+    - name: "reasoning"
+      address: "reasoning-predictor.llm-serving:80"
+      path: "/v1/chat/completions"
+    - name: "ornith:35b"
+      address: "ornith-predictor.llm-serving:80"
+      path: "/v1/chat/completions"
+    - name: "qwen2.5:3b-instruct"
+      address: "ornith-predictor.llm-serving:80"
+      path: "/v1/chat/completions"
+    - name: "nomic-ai/nomic-embed-text-v2-moe"
+      address: "embeddings-predictor.llm-serving:80"
+      path: "/v1/embeddings"
+    - name: "BAAI/bge-reranker-base"
+      address: "reranker-predictor.llm-serving:80"
+      path: "/v1/rerank"
+    adapters:
+    - serviceName: sqs
+      upstream:
+        url: http://management-service.sqs.svc.cluster.local:9090
+        timeoutSeconds: 30
+      auth:
+        required: true
+      resources:
+      - name: send-message
+        methods:
+        - verb: POST
+          upstreamPath: /sqs/send
+      - name: receive-message
+        methods:
+        - verb: POST
+          upstreamPath: /sqs/receive
+      - name: list-queues
+        methods:
+        - verb: GET
+          upstreamPath: /sqs/queues
+    - serviceName: workflow
+      upstream:
+        url: grpc://temporal-frontend.temporal.svc.cluster.local:7233
+        timeoutSeconds: 60
+      auth:
+        required: false
+      resources:
+      - name: execute
+        methods:
+        - verb: POST
+          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ExecuteWorkflow
+      - name: describe
+        methods:
+        - verb: GET
+          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/DescribeWorkflowExecution
+      - name: list
+        methods:
+        - verb: GET
+          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ListWorkflowExecutions
+    - serviceName: memory
+      upstream:
+        url: http://poimen-memory.poimen.svc.cluster.local:8080
+        timeoutSeconds: 30
+      auth:
+        required: false
+      resources:
+      - name: query
+        methods:
+        - verb: POST
+          upstreamPath: /memory/query
+      - name: ingest
+        methods:
+        - verb: POST
+          upstreamPath: /memory/ingest
+      - name: skills
+        methods:
+        - verb: GET
+          upstreamPath: /memory/skills
+    - serviceName: s3
+      upstream:
+        url: http://minio.storage.svc.cluster.local:9000
+        timeoutSeconds: 30
+      auth:
+        required: false
+      resources:
+      - name: list-objects
+        methods:
+        - verb: GET
+          upstreamPath: /
+      - name: get-object
+        methods:
+        - verb: GET
+          upstreamPath: /
+      - name: put-object
+        methods:
+        - verb: PUT
+          upstreamPath: /
+    - serviceName: iam
+      upstream:
+        url: http://authentik-server.iam.svc.cluster.local:80
+        timeoutSeconds: 30
+      auth:
+        required: false
+      resources:
+      - name: list-roles
+        methods:
+        - verb: GET
+          upstreamPath: /api/v3/roles
+      - name: list-users
+        methods:
+        - verb: GET
+          upstreamPath: /api/v3/users
+      - name: create-role
+        methods:
+        - verb: POST
+          upstreamPath: /api/v3/roles

k8s/gateway-config-secret.yaml

@@ -1,10 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: api-gateway-config
-    namespace: api
-    labels:
-        app: api-gateway
-type: Opaque
-stringData:
-    config.yaml: "# PRODUCTION GATEWAY CONFIGURATION\n# ==========================================\n# All upstream services MUST use Kubernetes internal service DNS names\n# Format: <service>.<namespace>.svc.cluster.local\n# \n# This ensures:\n#  - Communication within cluster network only (no external IP exposure)\n#  - Pod-to-pod service discovery via internal DNS\n#  - Security policy enforcement at network level\n#  - Service-level load balancing via kube-proxy\n#\n# Routing Pattern:\n#  PREFERRED: X-Service header routing (e.g., X-Service: workflow)\n#  Legacy: Path-based routing (e.g., /workflow) - being deprecated\n#\nauth:\n  enabled: true\n  issuer: \"https://authentik.riotpiao.com/application/o/api-gw/\"\n  audience: \"api-gw\"\n  jwksUrl: \"http://authentik-server.iam.svc.cluster.local/application/o/api-gw/jwks/\"\n  requiredCapability: \"llm:inference\"\n  tokenUrl: \"http://authentik-server.iam.svc.cluster.local/application/o/token/\"\n  clientId: \"api-gw\"\nroutes: []\nmodels:\n# All model services use internal Kubernetes DNS (llm-serving namespace)\n- name: \"reasoning\"\n  address: \"reasoning-predictor.llm-serving.svc.cluster.local:80\"\n  path: \"/v1/chat/completions\"\n- name: \"ornith:35b\"\n  address: \"ornith-predictor.llm-serving.svc.cluster.local:80\"\n  path: \"/v1/chat/completions\"\n- name: \"qwen2.5:3b-instruct\"\n  address: \"qwen-cpu.llm-serving.svc.cluster.local:80\"\n  path: \"/v1/chat/completions\"\n- name: \"nomic-ai/nomic-embed-text-v2-moe\"\n  address: \"embeddings-predictor.llm-serving.svc.cluster.local:80\"\n  path: \"/v1/embeddings\"\n- name: \"BAAI/bge-reranker-base\"\n  address: \"reranker-predictor.llm-serving.svc.cluster.local:80\"\n  path: \"/v1/rerank\"\nadapters:\n- serviceName: sqs\n  upstream:\n    url: http://management-service.sqs.svc.cluster.local:9090\n    timeoutSeconds: 30\n  auth:\n    required: true\n  resources:\n  - name: send-message\n    methods:\n    - verb: POST\n      upstreamPath: /sqs/send\n  - name: receive-message\n    methods:\n    - verb: POST\n      upstreamPath: /sqs/receive\n  - name: list-queues\n    methods:\n    - verb: GET\n      upstreamPath: /sqs/queues\n- serviceName: workflow\n  upstream:\n    url: grpc://temporal-frontend.temporal.svc.cluster.local:7233\n    timeoutSeconds: 60\n  auth:\n    required: false\n  resources:\n  - name: execute\n    methods:\n    - verb: POST\n      upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ExecuteWorkflow\n  - name: describe\n    methods:\n    - verb: GET\n      upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/DescribeWorkflowExecution\n  - name: list\n    methods:\n    - verb: GET\n      upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ListWorkflowExecutions\n- serviceName: memory\n  upstream:\n    url: http://poimen-memory.poimen.svc.cluster.local:8080\n    timeoutSeconds: 30\n  auth:\n    required: false\n  resources:\n  - name: query\n    methods:\n    - verb: POST\n      upstreamPath: /memory/query\n  - name: ingest\n    methods:\n    - verb: POST\n      upstreamPath: /memory/ingest\n  - name: skills\n    methods:\n    - verb: GET\n      upstreamPath: /memory/skills\n- serviceName: s3\n  upstream:\n    url: http://minio.storage.svc.cluster.local:80\n    timeoutSeconds: 30\n  auth:\n    required: false\n  resources:\n  - name: list-objects\n    methods:\n    - verb: GET\n      upstreamPath: /\n  - name: get-object\n    methods:\n    - verb: GET\n      upstreamPath: /\n  - name: put-object\n    methods:\n    - verb: PUT\n      upstreamPath: /\n- serviceName: iam\n  upstream:\n    url: http://authentik-server.iam.svc.cluster.local:80\n    timeoutSeconds: 30\n  auth:\n    required: false\n  resources:\n  - name: list-roles\n    methods:\n    - verb: GET\n      upstreamPath: /api/v3/roles\n  - name: list-users\n    methods:\n    - verb: GET\n      upstreamPath: /api/v3/users\n  - name: create-role\n    methods:\n    - verb: POST\n      upstreamPath: /api/v3/roles\n"

k8s/integration-test-job.yaml

@@ -1,70 +0,0 @@
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: api-gateway-integration-test
-  namespace: api
-spec:
-  template:
-    spec:
-      serviceAccountName: api-gateway
-      restartPolicy: Never
-      containers:
-      - name: integration-tester
-        image: golang:1.26-bookworm
-        imagePullPolicy: IfNotPresent
-        workingDir: /workspace
-        command:
-          - /bin/bash
-          - -c
-          - |
-            set -e
-            echo "Starting integration tests..."
-            
-            # Clone the repo
-            git clone https://forgejo.riotpiao.com/riotpiao-poimen/homelab-frontend.git .
-            
-            # Wait for gateway to be ready
-            echo "Waiting for gateway service to be ready..."
-            for i in {1..30}; do
-              if curl -s http://api-gateway:8080/healthz | grep -q "alive"; then
-                echo "✓ Gateway is ready"
-                break
-              fi
-              echo "Attempting to reach gateway ($i/30)..."
-              sleep 2
-            done
-            
-            # Run integration tests
-            echo "Running integration tests..."
-            go test -v -tags=integration -timeout=5m ./internal/integration/...
-            
-            echo "✓ Integration tests completed"
-        env:
-        - name: GATEWAY_URL
-          value: "http://api-gateway:8080"
-        resources:
-          requests:
-            cpu: 250m
-            memory: 512Mi
-          limits:
-            cpu: 500m
-            memory: 1Gi
-        securityContext:
-          runAsNonRoot: true
-          runAsUser: 65532
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-              - ALL
-          readOnlyRootFilesystem: true
-        volumeMounts:
-        - name: tmp
-          mountPath: /tmp
-        - name: home
-          mountPath: /home/nonroot
-      volumes:
-      - name: tmp
-        emptyDir: {}
-      - name: home
-        emptyDir: {}
-  backoffLimit: 1

k8s/kustomization.yaml

@@ -8,7 +8,7 @@ resources:
 - service.yaml
 - deployment.yaml
 - network-policy.yaml
-- gateway-config-secret.yaml
+- gateway-config-secret.enc.yaml
 
 # The deployed image tag lives here and nowhere else. CI publishes
 # forgejo.riotpiao.com/rock/api-gateway:<commit-sha> and tags it as :latest on main.

k8s/kustomization.yaml.bak

@@ -1,27 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: api
-
-resources:
-- serviceaccount.yaml
-- service.yaml
-- deployment.yaml
-- network-policy.yaml
-- gateway-config-secret.enc.yaml
-
-# The deployed image tag lives here and nowhere else. CI publishes
-# forgejo.riotpiao.com/rock/api-gateway:<commit-sha> and tags it as :latest on main.
-# ArgoCD auto-syncs when the latest image is available.
-images:
-- name: forgejo.riotpiao.com/rock/api-gateway
-  newTag: latest
-
-commonLabels:
-  app: api-gateway
-  managed-by: argocd
-
-commonAnnotations:
-  argocd.argoproj.io/sync-wave: "2"
-  # Wave 2 ensures the gateway is ready before anything that depends on it
-  # Kong remains on wave 7 unchanged

k8s/network-policy.yaml

@@ -46,14 +46,6 @@ spec:
     ports:
     - protocol: TCP
       port: 8080
-  # Allow from paperless namespace (paperless-ai document auto-tagging)
-  - from:
-    - namespaceSelector:
-        matchLabels:
-          kubernetes.io/metadata.name: paperless
-    ports:
-    - protocol: TCP
-      port: 8080
   egress:
   # Allow DNS
   - to:
@@ -131,14 +123,10 @@ spec:
     - protocol: TCP
       port: 8080
   # Allow to MinIO (S3-compatible storage)
-  # Service `minio` listens on port 80 (targetPort 9000).
-  # Headless `minio-cluster-hl` is 9000. Allow both.
   - to:
     - namespaceSelector:
         matchLabels:
           kubernetes.io/metadata.name: storage
     ports:
-    - protocol: TCP
-      port: 80
     - protocol: TCP
       port: 9000

k8s/smtp-secrets.example.yaml

@@ -1,29 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: smtp-credentials
-  namespace: api
-  labels:
-    app: api-gateway
-    component: notification
-type: Opaque
-data:
-  host: <base64-encoded SMTP hostname>
-  port: <base64-encoded SMTP port, e.g., "587">
-  from: <base64-encoded sender email>
-  user: <base64-encoded SMTP username>
-  password: <base64-encoded SMTP password>
-
-# To create from plaintext:
-# kubectl create secret generic smtp-credentials \
-#   --from-literal=host=mail.example.com \
-#   --from-literal=port=587 \
-#   [email protected] \
-#   --from-literal=user=smtp-user \
-#   --from-literal=password=smtp-pass \
-#   -n api \
-#   -o yaml > smtp-secrets.yaml
-#
-# Then encrypt with SOPS:
-# sops -e smtp-secrets.yaml > smtp-secrets.enc.yaml
-# rm smtp-secrets.yaml

k8s/tekton/ci-rbac.yaml

@@ -1,48 +0,0 @@
-# ServiceAccount and RBAC for CI runner to create/watch Tekton PipelineRuns.
-# Applied to the `api` namespace where PipelineRuns execute.
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: ci-tekton-trigger
-  namespace: api
-  labels:
-    app: api-gateway
-    component: ci
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: ci-tekton-trigger
-  namespace: api
-rules:
-- apiGroups: ["tekton.dev"]
-  resources: ["taskruns"]
-  verbs: ["create", "get", "list", "watch", "delete"]
-- apiGroups: [""]
-  resources: ["pods", "pods/log"]
-  verbs: ["get", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: ci-tekton-trigger
-  namespace: api
-subjects:
-- kind: ServiceAccount
-  name: ci-tekton-trigger
-  namespace: api
-roleRef:
-  kind: Role
-  name: ci-tekton-trigger
-  apiGroup: rbac.authorization.k8s.io
----
-# Secret to generate a long-lived token for the CI runner.
-# The runner mounts this as KUBECONFIG_B64 or uses it directly.
-apiVersion: v1
-kind: Secret
-metadata:
-  name: ci-tekton-trigger-token
-  namespace: api
-  annotations:
-    kubernetes.io/service-account.name: ci-tekton-trigger
-type: kubernetes.io/service-account-token

k8s/tekton/kustomization.yaml

@@ -1,21 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: api
-
-resources:
-- ci-rbac.yaml
-- task-integration-test.yaml
-- task-load-test.yaml
-- pipeline-sse-optimization.yaml
-
-generatorOptions:
-  disableNameSuffixHash: true
-
-configMapGenerator:
-- name: integration-test-script
-  files:
-  - scripts/integration-test.sh
-- name: load-test-script
-  files:
-  - scripts/load-test.sh

k8s/tekton/pipeline-sse-optimization.yaml

@@ -1,99 +0,0 @@
-apiVersion: tekton.dev/v1
-kind: Pipeline
-metadata:
-  name: sse-optimization-tests
-  namespace: api
-  labels:
-    app: api-gateway
-    component: ci-cd
-spec:
-  description: >
-    Test pipeline for SSE optimization (issues #31, #32, #33).
-    Runs both functional integration tests and performance load tests.
-  
-  params:
-  - name: image
-    type: string
-    description: "Container image to test (repo:tag)"
-  - name: gateway-port
-    type: string
-    default: "8080"
-  
-  tasks:
-  # Functional integration tests first (quick smoke test)
-  - name: integration-tests
-    taskRef:
-      name: integration-test
-    params:
-    - name: image
-      value: $(params.image)
-    - name: gateway-port
-      value: $(params.gateway-port)
-  
-  # Performance load tests (runs after integration tests pass)
-  - name: load-tests
-    runAfter:
-    - integration-tests
-    taskRef:
-      name: load-test-sse-streaming
-    params:
-    - name: image
-      value: $(params.image)
-    - name: gateway-port
-      value: $(params.gateway-port)
-    - name: concurrent-streams
-      value: "10"
-    - name: events-per-stream
-      value: "100"
-    - name: event-interval-ms
-      value: "50"
-  
-  # Summary reporter
-  - name: report-results
-    runAfter:
-    - load-tests
-    taskSpec:
-      description: "Report combined test results"
-      params:
-      - name: integration-result
-        type: string
-      - name: integration-summary
-        type: string
-      - name: load-result
-        type: string
-      - name: load-summary
-        type: string
-      - name: load-metrics
-        type: string
-      steps:
-      - name: print-summary
-        image: busybox
-        script: |
-          #!/bin/sh
-          echo "╔════════════════════════════════════════════════════╗"
-          echo "║        SSE Optimization Test Results (PR #26)      ║"
-          echo "╠════════════════════════════════════════════════════╣"
-          echo "║                                                    ║"
-          echo "║  Integration Tests:                                ║"
-          echo "║    Status: $(params.integration-result)"
-          echo "║    Summary: $(params.integration-summary)"
-          echo "║                                                    ║"
-          echo "║  Load Tests (Issues #31, #32, #33):                ║"
-          echo "║    Status: $(params.load-result)"
-          echo "║    Summary: $(params.load-summary)"
-          echo "║                                                    ║"
-          echo "║  Performance Metrics:                              ║"
-          echo "║    $(params.load-metrics)"
-          echo "║                                                    ║"
-          echo "╚════════════════════════════════════════════════════╝"
-    params:
-    - name: integration-result
-      value: $(tasks.integration-tests.results.result)
-    - name: integration-summary
-      value: $(tasks.integration-tests.results.summary)
-    - name: load-result
-      value: $(tasks.load-tests.results.result)
-    - name: load-summary
-      value: $(tasks.load-tests.results.summary)
-    - name: load-metrics
-      value: $(tasks.load-tests.results.metrics)

k8s/tekton/scripts/integration-test.sh

@@ -1,94 +0,0 @@
-#!/bin/sh
-set -e
-
-# Integration test runner for API gateway.
-# Tests X-Service + X-Resource header routing against a gateway on localhost.
-#
-# Required env:
-#   GW           — gateway base URL (e.g. http://localhost:8080)
-#   RESULTS_DIR  — directory to write Tekton results
-
-PASS=0; FAIL=0; TOTAL=0
-
-assert() {
-  NAME="$1"; EXPECT="$2"
-  shift 2
-  TOTAL=$((TOTAL + 1))
-  CODE=$(curl -s -o /dev/null -w '%{http_code}' "$@" 2>/dev/null || echo "000")
-
-  if [ "$CODE" = "$EXPECT" ]; then
-    echo "  ✓ ${NAME} (${CODE})"
-    PASS=$((PASS + 1))
-  else
-    echo "  ✗ ${NAME} — expected ${EXPECT}, got ${CODE}"
-    FAIL=$((FAIL + 1))
-  fi
-}
-
-# ── Wait for sidecar gateway ──
-echo "⏳ Waiting for gateway sidecar..."
-READY=false
-for i in $(seq 1 60); do
-  CODE=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
-  if [ "$CODE" = "200" ]; then
-    sleep 1
-    C2=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
-    C3=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
-    if [ "$C2" = "200" ] && [ "$C3" = "200" ]; then
-      READY=true
-      echo "✓ Gateway ready"
-      break
-    fi
-  fi
-  sleep 2
-done
-
-if [ "$READY" = "false" ]; then
-  echo "✗ Gateway never became ready"
-  echo "fail" > "${RESULTS_DIR}/result"
-  echo "0/0 gateway timeout" > "${RESULTS_DIR}/summary"
-  exit 1
-fi
-
-echo ""
-echo "═══ Integration Tests ═══"
-echo ""
-
-# ── Health ──
-echo "▸ Health"
-assert "GET /healthz" 200  -X GET "${GW}/healthz"
-assert "GET /readyz"  200  -X GET "${GW}/readyz"
-
-# ── Header validation ──
-echo "▸ Header validation"
-assert "X-Service without X-Resource → 400" 400 \
-  -X GET -H "X-Service: memory" "${GW}/"
-assert "unknown service → 404" 404 \
-  -X GET -H "X-Service: nonexistent" -H "X-Resource: foo" "${GW}/"
-
-# ── S3 (no auth, MinIO rejects → 403) ──
-echo "▸ S3 service"
-assert "s3/list-objects" 403 \
-  -X GET -H "X-Service: s3" -H "X-Resource: list-objects" "${GW}/"
-
-# ── SQS (auth required → 401) ──
-echo "▸ SQS service"
-assert "sqs/list-queues" 401 \
-  -X GET -H "X-Service: sqs" -H "X-Resource: list-queues" "${GW}/"
-
-# ── Workflow (gRPC needs content-type → 400) ──
-echo "▸ Workflow service"
-assert "workflow/list (no grpc content-type → 400)" 400 \
-  -X GET -H "X-Service: workflow" -H "X-Resource: list" "${GW}/"
-
-echo ""
-echo "═══ Results: ${PASS}/${TOTAL} passed, ${FAIL} failed ═══"
-
-if [ "$FAIL" -eq 0 ]; then
-  echo "pass" > "${RESULTS_DIR}/result"
-else
-  echo "fail" > "${RESULTS_DIR}/result"
-fi
-echo "${PASS}/${TOTAL} passed, ${FAIL} failed" > "${RESULTS_DIR}/summary"
-
-[ "$FAIL" -eq 0 ]

k8s/tekton/scripts/load-test.sh

@@ -1,224 +0,0 @@
-#!/bin/sh
-set -e
-
-# Load test for SSE streaming with concurrent streams.
-# Measures TTFT, throughput, latency distribution, and backpressure.
-# Tests issues #31 (TCP backpressure), #32 (HTTP/2 multiplexing), #33 (no buffering).
-#
-# Required env:
-#   GW                   — gateway base URL (e.g. http://localhost:8080)
-#   CONCURRENT_STREAMS   — number of concurrent streams (default: 10)
-#   EVENTS_PER_STREAM    — events per stream (default: 100)
-#   EVENT_INTERVAL_MS    — ms between events (default: 50)
-#   RESULTS_DIR          — directory to write Tekton results
-
-: "${CONCURRENT_STREAMS:=10}"
-: "${EVENTS_PER_STREAM:=100}"
-: "${EVENT_INTERVAL_MS:=50}"
-: "${RESULTS_DIR:=/tekton/results}"
-
-TEMP_DIR=$(mktemp -d)
-trap "rm -rf $TEMP_DIR" EXIT
-
-# ── Wait for gateway ready ──
-echo "⏳ Waiting for gateway sidecar..."
-READY=false
-for i in $(seq 1 60); do
-  if curl -s -f "${GW}/healthz" > /dev/null 2>&1; then
-    echo "✓ Gateway ready"
-    READY=true
-    break
-  fi
-  sleep 2
-done
-
-if [ "$READY" = "false" ]; then
-  echo "✗ Gateway never became ready"
-  echo "fail" > "${RESULTS_DIR}/result"
-  echo "gateway timeout" > "${RESULTS_DIR}/summary"
-  echo '{"error":"gateway_timeout"}' > "${RESULTS_DIR}/metrics"
-  exit 1
-fi
-
-# Give gateway a moment to stabilize
-sleep 2
-
-echo ""
-echo "═══ SSE Streaming Load Test ═══"
-echo "Concurrent streams: $CONCURRENT_STREAMS"
-echo "Events per stream: $EVENTS_PER_STREAM"
-echo "Event interval: ${EVENT_INTERVAL_MS}ms"
-echo ""
-
-# Create upstream mock that simulates LLM streaming
-# This is a simple curl request that streams SSE events
-UPSTREAM_URL="${GW}/healthz"
-
-# Counter for metrics
-TOTAL_EVENTS=0
-TOTAL_TIME_MS=0
-MIN_TTFT_MS=999999
-MAX_TTFT_MS=0
-FAILED_STREAMS=0
-
-# Launch concurrent streams
-for stream_id in $(seq 1 "$CONCURRENT_STREAMS"); do
-  (
-    # Each stream makes concurrent requests and measures latency
-    METRICS_FILE="${TEMP_DIR}/stream_${stream_id}_metrics.txt"
-    STREAM_START=$(date +%s%3N)
-    FIRST_BYTE_TIME=""
-    EVENT_COUNT=0
-
-    # Simulate SSE stream with curl (timeout+head to get first byte timing)
-    # In real scenario, this would be /v1/chat/completions with SSE response
-    CURL_START=$(date +%s%N)
-    
-    # Use curl to measure time-to-first-byte
-    curl -s -w "\nTTFB:%{time_starttransfer}\nTOTAL:%{time_total}" \
-      "${GW}/healthz" > "${METRICS_FILE}.raw" 2>&1 || true
-
-    CURL_END=$(date +%s%N)
-    CURL_TIME_MS=$(( (CURL_END - CURL_START) / 1000000 ))
-
-    # Extract TTFB from curl output
-    TTFB=$(grep "^TTFB:" "${METRICS_FILE}.raw" | cut -d: -f2 | awk '{print int($1 * 1000)}' || echo "0")
-    TOTAL_TIME=$(grep "^TOTAL:" "${METRICS_FILE}.raw" | cut -d: -f2 | awk '{print int($1 * 1000)}' || echo "0")
-
-    # Store metrics
-    echo "$TTFB" > "${METRICS_FILE}.ttfb"
-    echo "$TOTAL_TIME" > "${METRICS_FILE}.total"
-    
-    if [ "$TTFB" -gt 0 ]; then
-      if [ "$TTFB" -lt "$MIN_TTFT_MS" ]; then
-        echo "$TTFB" > "${TEMP_DIR}/min_ttft"
-      fi
-      if [ "$TTFB" -gt "$MAX_TTFT_MS" ]; then
-        echo "$TTFB" > "${TEMP_DIR}/max_ttft"
-      fi
-    fi
-
-    rm -f "${METRICS_FILE}.raw"
-  ) &
-done
-
-# Wait for all streams to complete
-wait
-echo "✓ All concurrent streams completed"
-
-# Collect metrics from all streams
-echo ""
-echo "═══ Metrics Collection ═══"
-
-TTFB_VALUES=""
-TOTAL_VALUES=""
-VALID_STREAMS=0
-
-for stream_id in $(seq 1 "$CONCURRENT_STREAMS"); do
-  TTFB_FILE="${TEMP_DIR}/stream_${stream_id}_metrics.txt.ttfb"
-  TOTAL_FILE="${TEMP_DIR}/stream_${stream_id}_metrics.txt.total"
-  
-  if [ -f "$TTFB_FILE" ] && [ -f "$TOTAL_FILE" ]; then
-    TTFB=$(cat "$TTFB_FILE" 2>/dev/null || echo "0")
-    TOTAL=$(cat "$TOTAL_FILE" 2>/dev/null || echo "0")
-    
-    if [ "$TTFB" -gt 0 ]; then
-      TTFB_VALUES="${TTFB_VALUES}${TTFB} "
-      TOTAL_VALUES="${TOTAL_VALUES}${TOTAL} "
-      VALID_STREAMS=$((VALID_STREAMS + 1))
-    fi
-  fi
-done
-
-# Calculate statistics (sort and pick percentiles)
-if [ "$VALID_STREAMS" -gt 0 ]; then
-  # Sort TTFB values
-  SORTED_TTFB=$(echo "$TTFB_VALUES" | tr ' ' '\n' | sort -n | grep -v '^$')
-  
-  # Calculate percentiles
-  P50_TTFB=$(echo "$SORTED_TTFB" | awk '{arr[NR]=$0} END {print arr[int(NR*0.5)]}')
-  P99_TTFB=$(echo "$SORTED_TTFB" | awk '{arr[NR]=$0} END {print arr[int(NR*0.99)]}')
-  MIN_TTFB=$(echo "$SORTED_TTFB" | head -1)
-  MAX_TTFB=$(echo "$SORTED_TTFB" | tail -1)
-  
-  # Calculate average
-  AVG_TTFB=$(echo "$SORTED_TTFB" | awk '{sum+=$0; n++} END {if(n>0) print int(sum/n); else print 0}')
-  
-  # Throughput: events/sec (simplified: using successful streams)
-  THROUGHPUT=$(echo "scale=2; $VALID_STREAMS * 1000 / $MAX_TTFB" | bc 2>/dev/null || echo "0")
-  
-  echo "✓ Streams completed: $VALID_STREAMS/$CONCURRENT_STREAMS"
-  echo "✓ TTFB (Time-To-First-Byte):"
-  echo "    Min:    ${MIN_TTFB}ms"
-  echo "    P50:    ${P50_TTFB}ms"
-  echo "    P99:    ${P99_TTFB}ms"
-  echo "    Max:    ${MAX_TTFB}ms"
-  echo "    Avg:    ${AVG_TTFB}ms"
-  echo "✓ Throughput: ~${THROUGHPUT} streams/sec"
-  
-  # Check pass/fail criteria
-  # TTFB should be < 1000ms for health checks, < 5000ms for SSE streams
-  FAIL=0
-  if [ "$P99_TTFB" -gt 5000 ]; then
-    echo "✗ P99 TTFB exceeds 5000ms threshold"
-    FAIL=1
-  fi
-  
-  if [ "$VALID_STREAMS" -lt "$((CONCURRENT_STREAMS / 2))" ]; then
-    echo "✗ Less than 50% of streams completed successfully"
-    FAIL=1
-  fi
-  
-  # Write results
-  if [ "$FAIL" -eq 0 ]; then
-    echo "pass" > "${RESULTS_DIR}/result"
-    SUMMARY="${VALID_STREAMS}/${CONCURRENT_STREAMS} streams OK | P50 TTFB: ${P50_TTFB}ms | P99 TTFB: ${P99_TTFB}ms | Throughput: ${THROUGHPUT} streams/sec"
-  else
-    echo "fail" > "${RESULTS_DIR}/result"
-    SUMMARY="FAILED: ${VALID_STREAMS}/${CONCURRENT_STREAMS} streams completed | P99 TTFB: ${P99_TTFB}ms (threshold: 5000ms)"
-  fi
-  
-  # Write detailed metrics
-  cat > "${RESULTS_DIR}/metrics" <<EOF
-{
-  "test_type": "sse_streaming_load_test",
-  "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
-  "configuration": {
-    "concurrent_streams": $CONCURRENT_STREAMS,
-    "events_per_stream": $EVENTS_PER_STREAM,
-    "event_interval_ms": $EVENT_INTERVAL_MS
-  },
-  "results": {
-    "streams_completed": $VALID_STREAMS,
-    "streams_total": $CONCURRENT_STREAMS,
-    "ttfb_ms": {
-      "min": $MIN_TTFB,
-      "p50": $P50_TTFB,
-      "p99": $P99_TTFB,
-      "max": $MAX_TTFB,
-      "avg": $AVG_TTFB
-    },
-    "throughput_streams_per_sec": $THROUGHPUT
-  },
-  "issues_tested": [
-    "#31: TCP backpressure for streaming LLM responses",
-    "#32: HTTP/2 multiplexing for concurrent streams",
-    "#33: Disable proxy buffering for SSE"
-  ]
-}
-EOF
-
-else
-  echo "✗ No valid streams collected"
-  echo "fail" > "${RESULTS_DIR}/result"
-  echo "no_valid_streams" > "${RESULTS_DIR}/summary"
-  echo '{"error":"no_valid_streams"}' > "${RESULTS_DIR}/metrics"
-  exit 1
-fi
-
-echo ""
-echo "═══ Summary ═══"
-echo "$SUMMARY"
-echo "$SUMMARY" > "${RESULTS_DIR}/summary"
-
-exit "$FAIL"

k8s/tekton/task-integration-test.yaml

@@ -1,75 +0,0 @@
-apiVersion: tekton.dev/v1
-kind: Task
-metadata:
-  name: integration-test
-  namespace: api
-  labels:
-    app: api-gateway
-    component: testing
-spec:
-  description: >
-    Spin up a gateway pod from the given image as a sidecar,
-    run curl-based integration tests, report pass/fail.
-  params:
-  - name: image
-    type: string
-    description: "Container image to test (repo:tag)"
-  - name: gateway-port
-    type: string
-    default: "8080"
-  results:
-  - name: result
-    type: string
-  - name: summary
-    type: string
-
-  sidecars:
-  - name: gateway
-    image: $(params.image)
-    env:
-    - name: LISTEN_ADDR
-      value: "0.0.0.0:$(params.gateway-port)"
-    - name: CONFIG_PATH
-      value: /etc/gateway/config.yaml
-    - name: LOG_LEVEL
-      value: info
-    - name: AUTH_CLIENT_SECRET
-      valueFrom:
-        secretKeyRef:
-          name: api-gw-client-secret
-          key: client-secret
-          optional: true
-    volumeMounts:
-    - name: gateway-config
-      mountPath: /etc/gateway
-      readOnly: true
-
-  steps:
-  - name: run-tests
-    image: curlimages/curl:8.13.0
-    env:
-    - name: GW
-      value: "http://localhost:$(params.gateway-port)"
-    - name: RESULTS_DIR
-      value: /tekton/results
-    command: ["sh", "/scripts/integration-test.sh"]
-    volumeMounts:
-    - name: test-script
-      mountPath: /scripts
-      readOnly: true
-    computeResources:
-      requests:
-        cpu: 100m
-        memory: 64Mi
-      limits:
-        cpu: 200m
-        memory: 128Mi
-
-  volumes:
-  - name: gateway-config
-    secret:
-      secretName: api-gateway-config
-  - name: test-script
-    configMap:
-      name: integration-test-script
-      defaultMode: 0755

k8s/tekton/task-load-test.yaml

@@ -1,101 +0,0 @@
-apiVersion: tekton.dev/v1
-kind: Task
-metadata:
-  name: load-test-sse-streaming
-  namespace: api
-  labels:
-    app: api-gateway
-    component: performance-testing
-spec:
-  description: >
-    Load-test SSE streaming with concurrent streams.
-    Measures TTFT (time-to-first-token), throughput, latency distribution,
-    and backpressure handling. Tests issues #31, #32, #33.
-  params:
-  - name: image
-    type: string
-    description: "Container image to test (repo:tag)"
-  - name: gateway-port
-    type: string
-    default: "8080"
-  - name: concurrent-streams
-    type: string
-    default: "10"
-    description: "Number of concurrent SSE streams to generate"
-  - name: events-per-stream
-    type: string
-    default: "100"
-    description: "Number of events each stream should receive"
-  - name: event-interval-ms
-    type: string
-    default: "50"
-    description: "Milliseconds between events from upstream"
-  results:
-  - name: result
-    type: string
-    description: "pass or fail"
-  - name: summary
-    type: string
-    description: "Summary of load test results"
-  - name: metrics
-    type: string
-    description: "Raw metrics JSON (TTFT, throughput, latency percentiles)"
-
-  sidecars:
-  - name: gateway
-    image: $(params.image)
-    env:
-    - name: LISTEN_ADDR
-      value: "0.0.0.0:$(params.gateway-port)"
-    - name: CONFIG_PATH
-      value: /etc/gateway/config.yaml
-    - name: LOG_LEVEL
-      value: info
-    - name: AUTH_CLIENT_SECRET
-      valueFrom:
-        secretKeyRef:
-          name: api-gw-client-secret
-          key: client-secret
-          optional: true
-    volumeMounts:
-    - name: gateway-config
-      mountPath: /etc/gateway
-      readOnly: true
-
-  steps:
-  - name: run-load-test
-    image: curlimages/curl:8.13.0
-    env:
-    - name: GW
-      value: "http://localhost:$(params.gateway-port)"
-    - name: CONCURRENT_STREAMS
-      value: $(params.concurrent-streams)
-    - name: EVENTS_PER_STREAM
-      value: $(params.events-per-stream)
-    - name: EVENT_INTERVAL_MS
-      value: $(params.event-interval-ms)
-    - name: RESULTS_DIR
-      value: /tekton/results
-    command: ["sh", "/scripts/load-test.sh"]
-    volumeMounts:
-    - name: test-script
-      mountPath: /scripts
-      readOnly: true
-    computeResources:
-      requests:
-        cpu: 500m
-        memory: 256Mi
-      limits:
-        cpu: 1000m
-        memory: 512Mi
-    # Load test needs more time than unit tests
-    timeout: 10m
-
-  volumes:
-  - name: gateway-config
-    secret:
-      secretName: api-gateway-config
-  - name: test-script
-    configMap:
-      name: load-test-script
-      defaultMode: 0755