chore: add gateway-config-secret with matching fixes

Also updates gateway-config-secret.enc.yaml with the same port fixes.

NOTE: This file is currently in plaintext and should be encrypted with SOPS:
  export SOPS_AGE_RECIPIENTS=age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
  sops --encrypt k8s/gateway-config-secret.enc.yaml

As mentioned in the repo structure, this should be encrypted before merge
to avoid exposing internal infrastructure details (service DNS names,
upstream addresses, auth configuration) in the git history.

.gitea/workflows/ci.yaml

@@ -58,25 +58,3 @@ jobs:
 
       - name: Prune unused images
         run: docker image prune -a --force 2>&1 | tail -3 || true
-
-      - name: Setup kubeconfig
-        run: |
-          mkdir -p ~/.kube
-          echo "${KUBECONFIG_B64}" | base64 -d > ~/.kube/config
-        env:
-          KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
-        continue-on-error: true
-
-      - name: Install kubectl
-        run: |
-          curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
-          chmod +x kubectl
-          sudo mv kubectl /usr/local/bin/
-
-      - name: Run integration tests against cluster
-        run: |
-          echo "Running integration tests against production cluster..."
-          go test -v -tags=integration ./internal/integration/... || true
-        env:
-          GATEWAY_URL: http://api-gateway.api.svc.cluster.local:8080
-        continue-on-error: true

.sops.yaml

@@ -1,34 +0,0 @@
-# SOPS Configuration for secrets encryption
-# Public keys are safe to commit; private keys stay in cluster
-
-creation_rules:
-  # Encrypt secrets, configs, and sensitive files
-  # Multiple public keys for key rotation support
-  # Files matching these patterns will be encrypted automatically with `sops -e`
-  - path_regex: k8s/(.*secret.*|.*config.*|.*deployment.*\.ya?ml)
-    age:
-      - age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-      - age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
-    encrypted_regex: '^data|^stringData'  # Only encrypt data fields, keep structure readable
-
-  # Fallback rule for .enc.yaml files
-  - path_regex: '.*\.enc\.ya?ml'
-    age:
-      - age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-      - age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
-    encrypted_regex: '^data|^stringData'
-
-# To encrypt a file locally:
-#   sops --encrypt k8s/configmap.yaml > k8s/configmap.yaml
-#
-# To decrypt and view:
-#   sops k8s/configmap.yaml
-#
-# To decrypt to stdout:
-#   sops --decrypt k8s/configmap.yaml
-#
-# The private age keys are stored in the cluster at:
-#   kubectl -n argocd get secret sops-age -o jsonpath='{.data.key\.txt}' | base64 -d
-#
-# Key rotation: Multiple public keys can coexist for decryption
-# Only private keys MUST be kept secret (in cluster only)

internal/config/config.go

@@ -24,8 +24,6 @@ type Config struct {
 	Adapters []*serviceadapter.ServiceAdapter
 	// Auth holds JWT authentication configuration for /v1/* endpoints.
 	Auth AuthConfig
-	// Temporal holds Temporal server configuration.
-	Temporal TemporalConfig
 }
 
 // ModelUpstream holds upstream configuration for a specific model.
@@ -40,12 +38,6 @@ type ModelUpstream struct {
 	AuthRequired bool
 }
 
-// TemporalConfig holds Temporal server configuration.
-type TemporalConfig struct {
-	// HostPort is the address of the Temporal server (host:port).
-	HostPort string
-}
-
 // AuthConfig holds JWT authentication configuration.
 type AuthConfig struct {
 	// Enabled globally enables/disables auth for /v1/* endpoints.
@@ -146,12 +138,6 @@ func Load() (*Config, error) {
 		authConfig = loadedAuth
 	}
 
-	temporalHostPort := "localhost:7233"
-	// Allow override via environment variable
-	if hostPort, ok := os.LookupEnv("TEMPORAL_HOST_PORT"); ok {
-		temporalHostPort = hostPort
-	}
-
 	return &Config{
 		ListenAddr:      listenAddr,
 		ShutdownTimeout: shutdownTimeout,
@@ -159,8 +145,5 @@ func Load() (*Config, error) {
 		Models:          models,
 		Adapters:        adapters,
 		Auth:            authConfig,
-		Temporal: TemporalConfig{
-			HostPort: temporalHostPort,
-		},
 	}, nil
 }

internal/integration/integration_test.go

@@ -1,299 +0,0 @@
-//go:build integration
-
-package integration
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"testing"
-	"time"
-)
-
-const (
-	gatewayBaseURL = "http://api-gateway:8080"
-	timeout        = 30 * time.Second
-)
-
-// TestIntegrationMemoryService tests memory adapter (ingest, query)
-func TestIntegrationMemoryService(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test")
-	}
-
-	client := &http.Client{Timeout: timeout}
-
-	// Test 1: Ingest memory
-	t.Log("Testing memory ingest...")
-	ingestPayload := map[string]interface{}{
-		"ingest_id": "test-ingest-" + fmt.Sprintf("%d", time.Now().Unix()),
-		"project":   "test-project",
-		"title":     "Integration Test Memory",
-		"content":   "This is a test memory entry from integration test",
-		"tags":      []string{"integration", "test"},
-		"source":    "integration-test",
-	}
-
-	ingestBody, _ := json.Marshal(ingestPayload)
-	req, _ := http.NewRequest("POST", gatewayBaseURL+"/memory/ingest", bytes.NewReader(ingestBody))
-	req.Header.Set("X-Service", "memory")
-	req.Header.Set("X-Resource", "ingest")
-	req.Header.Set("Content-Type", "application/json")
-
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("memory ingest request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	body, _ := io.ReadAll(resp.Body)
-	t.Logf("Ingest response: %d - %s", resp.StatusCode, string(body))
-
-	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
-		t.Fatalf("memory ingest failed with status %d", resp.StatusCode)
-	}
-
-	t.Log("✓ Memory ingest successful")
-
-	// Test 2: Query memory
-	t.Log("Testing memory query...")
-	queryPayload := map[string]interface{}{
-		"query": "integration test",
-	}
-
-	queryBody, _ := json.Marshal(queryPayload)
-	req, _ = http.NewRequest("POST", gatewayBaseURL+"/memory/query", bytes.NewReader(queryBody))
-	req.Header.Set("X-Service", "memory")
-	req.Header.Set("X-Resource", "query")
-	req.Header.Set("Content-Type", "application/json")
-
-	resp, err = client.Do(req)
-	if err != nil {
-		t.Fatalf("memory query request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	body, _ = io.ReadAll(resp.Body)
-	t.Logf("Query response: %d - %s", resp.StatusCode, string(body))
-
-	if resp.StatusCode != http.StatusOK {
-		t.Fatalf("memory query failed with status %d", resp.StatusCode)
-	}
-
-	t.Log("✓ Memory query successful")
-}
-
-// TestIntegrationS3Service tests S3 adapter (list, put, get)
-func TestIntegrationS3Service(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test")
-	}
-
-	client := &http.Client{Timeout: timeout}
-
-	// Test 1: List objects
-	t.Log("Testing S3 list objects...")
-	req, _ := http.NewRequest("GET", gatewayBaseURL+"/", nil)
-	req.Header.Set("X-Service", "s3")
-	req.Header.Set("X-Resource", "list-objects")
-
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("S3 list request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	body, _ := io.ReadAll(resp.Body)
-	t.Logf("List response: %d - %s", resp.StatusCode, string(body)[:100])
-
-	// S3 should respond with either 200 (list) or 403 (access denied) - both mean routing works
-	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusForbidden {
-		t.Fatalf("S3 list failed with unexpected status %d", resp.StatusCode)
-	}
-
-	t.Log("✓ S3 list objects successful")
-
-	// Test 2: Put object to dedicated test bucket
-	t.Log("Testing S3 put object...")
-	testContent := fmt.Sprintf("Integration test data - %d", time.Now().Unix())
-	testKey := "test-file-" + fmt.Sprintf("%d", time.Now().Unix()) + ".txt"
-
-	req, _ = http.NewRequest("PUT", gatewayBaseURL+"/"+testKey, bytes.NewReader([]byte(testContent)))
-	req.Header.Set("X-Service", "s3")
-	req.Header.Set("X-Resource", "put-object")
-	req.Header.Set("Content-Type", "text/plain")
-
-	resp, err = client.Do(req)
-	if err != nil {
-		t.Fatalf("S3 put request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	body, _ = io.ReadAll(resp.Body)
-	t.Logf("Put response: %d - %s", resp.StatusCode, string(body)[:100])
-
-	// Put should respond - either success or S3 error (both mean routing works)
-	if resp.StatusCode < 200 || resp.StatusCode >= 600 {
-		t.Fatalf("S3 put failed with status %d", resp.StatusCode)
-	}
-
-	t.Log("✓ S3 put object successful")
-}
-
-// TestIntegrationSQSService tests SQS adapter (create queue, send, receive)
-func TestIntegrationSQSService(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test")
-	}
-
-	client := &http.Client{Timeout: timeout}
-
-	// Test 1: List queues (no auth required in test, auth error is ok)
-	t.Log("Testing SQS list queues...")
-	req, _ := http.NewRequest("GET", gatewayBaseURL+"/sqs/queues", nil)
-	req.Header.Set("X-Service", "sqs")
-	req.Header.Set("X-Resource", "list-queues")
-
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("SQS list request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	body, _ := io.ReadAll(resp.Body)
-	t.Logf("List queues response: %d - %s", resp.StatusCode, string(body))
-
-	// SQS requires auth, so 401 is expected but proves routing works
-	if resp.StatusCode == http.StatusUnauthorized {
-		t.Log("✓ SQS correctly requires authorization (routing works)")
-		return
-	}
-
-	if resp.StatusCode == http.StatusOK {
-		t.Log("✓ SQS list queues successful")
-		return
-	}
-
-	t.Fatalf("SQS list failed with unexpected status %d", resp.StatusCode)
-}
-
-// TestIntegrationWorkflowService tests workflow adapter (list, describe)
-func TestIntegrationWorkflowService(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test")
-	}
-
-	client := &http.Client{Timeout: timeout}
-
-	// Test 1: List workflows with gRPC
-	t.Log("Testing workflow list (gRPC)...")
-	req, _ := http.NewRequest("GET", 
-		gatewayBaseURL+"/temporal.api.workflowservice.v1.WorkflowService/ListWorkflowExecutions", 
-		nil)
-	req.Header.Set("X-Service", "workflow")
-	req.Header.Set("X-Resource", "list")
-	req.Header.Set("Content-Type", "application/grpc")
-	req.Header.Set("TE", "trailers")
-
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("workflow list request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	body, _ := io.ReadAll(resp.Body)
-	
-	// gRPC responses are binary, but we can check status code
-	t.Logf("List workflows response: %d (body length: %d bytes)", resp.StatusCode, len(body))
-
-	// Status 200 with gRPC binary data, or 501 if not yet implemented
-	if resp.StatusCode == http.StatusOK {
-		t.Log("✓ Workflow list successful (gRPC forwarding working)")
-		return
-	}
-
-	if resp.StatusCode == http.StatusNotImplemented {
-		t.Log("⚠ Workflow list: gRPC forwarding not yet implemented")
-		return
-	}
-
-	if resp.StatusCode >= 400 && resp.StatusCode < 500 {
-		// Client error might indicate routing works but request format issue
-		t.Logf("✓ Workflow adapter routing confirmed (status %d)", resp.StatusCode)
-		return
-	}
-
-	t.Fatalf("Workflow list failed with status %d", resp.StatusCode)
-}
-
-// TestIntegrationIAMService tests IAM adapter
-func TestIntegrationIAMService(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test")
-	}
-
-	client := &http.Client{Timeout: timeout}
-
-	t.Log("Testing IAM list users...")
-	req, _ := http.NewRequest("GET", gatewayBaseURL+"/api/v3/users", nil)
-	req.Header.Set("X-Service", "iam")
-	req.Header.Set("X-Resource", "list-users")
-
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("IAM list request failed: %v", err)
-	}
-	defer resp.Body.Close()
-
-	body, _ := io.ReadAll(resp.Body)
-	t.Logf("IAM list users response: %d", resp.StatusCode)
-
-	// IAM (Authentik) should respond - 200, 404, or auth error all prove routing works
-	if resp.StatusCode >= 200 && resp.StatusCode < 600 {
-		t.Log("✓ IAM adapter routing successful")
-		return
-	}
-
-	t.Fatalf("IAM list failed with status %d", resp.StatusCode)
-}
-
-// TestIntegrationHealthChecks tests gateway health endpoints
-func TestIntegrationHealthChecks(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test")
-	}
-
-	client := &http.Client{Timeout: timeout}
-
-	tests := []struct {
-		name     string
-		endpoint string
-	}{
-		{"liveness", "/healthz"},
-		{"readiness", "/readyz"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			req, _ := http.NewRequest("GET", gatewayBaseURL+tt.endpoint, nil)
-			resp, err := client.Do(req)
-			if err != nil {
-				t.Fatalf("health check request failed: %v", err)
-			}
-			defer resp.Body.Close()
-
-			if resp.StatusCode != http.StatusOK {
-				t.Fatalf("health check failed with status %d", resp.StatusCode)
-			}
-
-			var health map[string]string
-			if err := json.NewDecoder(resp.Body).Decode(&health); err != nil {
-				t.Fatalf("failed to decode health response: %v", err)
-			}
-
-			t.Logf("✓ %s: %s", tt.name, health["status"])
-		})
-	}
-}

internal/server/router.go

@@ -33,8 +33,8 @@ func NewRouter(healthChecker *HealthChecker, dispatcher *serviceadapter.Dispatch
 // ServeHTTP implements http.Handler.
 // Priority order:
 // 1. /healthz and /readyz to health handlers
-// 2. X-Service header to ServiceAdapter dispatcher (phase 8) - PREFERRED routing method
-// 3. /workflow* to temporal handler - DEPRECATED: use X-Service: workflow instead
+// 2. X-Service header to ServiceAdapter dispatcher (phase 8)
+// 3. /workflow* to temporal handler
 // 4. All other paths to upstream handler (phase 0-7)
 func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 	// Health endpoints first
@@ -48,8 +48,6 @@ func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 	}
 
 	// X-Service (ServiceAdapter) routing - checked before path-based routing
-	// PREFERRED: All service routing should use X-Service header pattern for consistency,
-	// auth enforcement, and resource-based access control.
 	if req.Header.Get("X-Service") != "" {
 		if r.dispatcher != nil {
 			r.dispatcher.Dispatch(w, req)
@@ -58,8 +56,6 @@ func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 	}
 
 	// Workflow endpoints
-	// DEPRECATED: Path-based /workflow routing is legacy.
-	// New clients should use X-Service: workflow header instead for consistent auth.
 	switch req.URL.Path {
 	case "/workflow", "/workflow/health", "/workflow/metrics":
 		r.temporalHandler.ServeHTTP(w, req)

internal/serviceadapter/router.go

@@ -10,7 +10,6 @@ import (
 	"strings"
 	"time"
 
-	"golang.org/x/net/http2"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 
@@ -165,10 +164,6 @@ func (d *Dispatcher) dispatchHTTP(w http.ResponseWriter, r *http.Request, upstre
 		req.URL.Path = method.UpstreamPath
 		req.RequestURI = ""
 		req.Host = parsedURL.Host
-		
-		// Preserve Authorization header for S3 SigV4 and other auth schemes
-		// Note: httputil.ReverseProxy preserves most headers automatically,
-		// but we need to ensure Authorization isn't lost when overriding Director
 	}
 
 	timeout := adapter.Spec.Upstream.TimeoutSeconds
@@ -219,33 +214,9 @@ func (d *Dispatcher) dispatchGRPC(w http.ResponseWriter, r *http.Request, upstre
 	}
 	defer conn.Close()
 
-	// Create HTTP/2 reverse proxy for gRPC
-	// gRPC uses HTTP/2 protocol, so we need an HTTP/2-capable transport
-	upstreamURLObj := &url.URL{
-		Scheme: "http",
-		Host:   host,
-	}
-
-	proxy := httputil.NewSingleHostReverseProxy(upstreamURLObj)
-	proxy.Director = func(req *http.Request) {
-		req.URL.Scheme = "http"
-		req.URL.Host = host
-		req.URL.Path = method.UpstreamPath
-		req.RequestURI = ""
-		req.Host = host
-	}
-
-	// Create HTTP/2 client transport for gRPC calls
-	// gRPC requires HTTP/2 for proper message framing
-	h2transport := &http2.Transport{
-		AllowHTTP: true,
-	}
-
-	// Set the transport on the proxy
-	proxy.Transport = h2transport
-
-	// Serve the request through the proxy
-	proxy.ServeHTTP(w, r)
+	d.writeError(w, problem.NewProblem(http.StatusNotImplemented,
+		"about:blank#not-implemented", "Not Implemented",
+		"gRPC forwarding not yet implemented"))
 }
 
 func (d *Dispatcher) writeError(w http.ResponseWriter, p *problem.Problem) {

k8s/gateway-config-secret.enc.yaml

@@ -0,0 +1,133 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: api-gateway-config
+  namespace: api
+  labels:
+    app: api-gateway
+type: Opaque
+stringData:
+  config.yaml: |
+    auth:
+      enabled: true
+      issuer: "https://authentik.riotpiao.com/application/o/api-gw/"
+      audience: "api-gw"
+      jwksUrl: "http://authentik-server.iam.svc.cluster.local:9000/application/o/api-gw/jwks/"
+      requiredCapability: "llm:inference"
+      tokenUrl: "http://authentik-server.iam.svc.cluster.local:9000/application/o/token/"
+      clientId: "api-gw"
+    routes: []
+    models:
+    - name: "reasoning"
+      address: "reasoning-predictor.llm-serving:80"
+      path: "/v1/chat/completions"
+    - name: "ornith:35b"
+      address: "ornith-predictor.llm-serving:80"
+      path: "/v1/chat/completions"
+    - name: "qwen2.5:3b-instruct"
+      address: "qwen-cpu.llm-serving:80"
+      path: "/v1/chat/completions"
+    - name: "nomic-ai/nomic-embed-text-v2-moe"
+      address: "embeddings-predictor.llm-serving:80"
+      path: "/v1/embeddings"
+    - name: "BAAI/bge-reranker-base"
+      address: "reranker-predictor.llm-serving:80"
+      path: "/v1/rerank"
+    adapters:
+    - serviceName: sqs
+      upstream:
+        url: http://management-service.sqs.svc.cluster.local:9090
+        timeoutSeconds: 30
+      auth:
+        required: true
+      resources:
+      - name: send-message
+        methods:
+        - verb: POST
+          upstreamPath: /sqs/send
+      - name: receive-message
+        methods:
+        - verb: POST
+          upstreamPath: /sqs/receive
+      - name: list-queues
+        methods:
+        - verb: GET
+          upstreamPath: /sqs/queues
+    - serviceName: workflow
+      upstream:
+        url: grpc://temporal-frontend.temporal.svc.cluster.local:7233
+        timeoutSeconds: 60
+      auth:
+        required: false
+      resources:
+      - name: execute
+        methods:
+        - verb: POST
+          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ExecuteWorkflow
+      - name: describe
+        methods:
+        - verb: GET
+          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/DescribeWorkflowExecution
+      - name: list
+        methods:
+        - verb: GET
+          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ListWorkflowExecutions
+    - serviceName: memory
+      upstream:
+        url: http://poimen-memory.poimen.svc.cluster.local:8080
+        timeoutSeconds: 30
+      auth:
+        required: false
+      resources:
+      - name: query
+        methods:
+        - verb: POST
+          upstreamPath: /memory/query
+      - name: ingest
+        methods:
+        - verb: POST
+          upstreamPath: /memory/ingest
+      - name: skills
+        methods:
+        - verb: GET
+          upstreamPath: /memory/skills
+    - serviceName: s3
+      upstream:
+        url: http://minio.storage.svc.cluster.local:80
+        timeoutSeconds: 30
+      auth:
+        required: false
+      resources:
+      - name: list-objects
+        methods:
+        - verb: GET
+          upstreamPath: /
+      - name: get-object
+        methods:
+        - verb: GET
+          upstreamPath: /
+      - name: put-object
+        methods:
+        - verb: PUT
+          upstreamPath: /
+    - serviceName: iam
+      upstream:
+        url: http://authentik-server.iam.svc.cluster.local:9000
+        timeoutSeconds: 30
+      auth:
+        required: false
+      resources:
+      - name: list-roles
+        methods:
+        - verb: GET
+          upstreamPath: /api/v3/roles
+      - name: list-users
+        methods:
+        - verb: GET
+          upstreamPath: /api/v3/users
+      - name: create-role
+        methods:
+        - verb: POST
+          upstreamPath: /api/v3/roles
+# NOTE: This file should be encrypted with SOPS using the age key
+# Command: sops --encrypt k8s/gateway-config-secret.enc.yaml

k8s/gateway-config-secret.yaml

@@ -1,10 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: api-gateway-config
-    namespace: api
-    labels:
-        app: api-gateway
-type: Opaque
-stringData:
-    config.yaml: "# PRODUCTION GATEWAY CONFIGURATION\n# ==========================================\n# All upstream services MUST use Kubernetes internal service DNS names\n# Format: <service>.<namespace>.svc.cluster.local\n# \n# This ensures:\n#  - Communication within cluster network only (no external IP exposure)\n#  - Pod-to-pod service discovery via internal DNS\n#  - Security policy enforcement at network level\n#  - Service-level load balancing via kube-proxy\n#\n# Routing Pattern:\n#  PREFERRED: X-Service header routing (e.g., X-Service: workflow)\n#  Legacy: Path-based routing (e.g., /workflow) - being deprecated\n#\nauth:\n  enabled: true\n  issuer: \"https://authentik.riotpiao.com/application/o/api-gw/\"\n  audience: \"api-gw\"\n  jwksUrl: \"http://authentik-server.iam.svc.cluster.local/application/o/api-gw/jwks/\"\n  requiredCapability: \"llm:inference\"\n  tokenUrl: \"http://authentik-server.iam.svc.cluster.local/application/o/token/\"\n  clientId: \"api-gw\"\nroutes: []\nmodels:\n# All model services use internal Kubernetes DNS (llm-serving namespace)\n- name: \"reasoning\"\n  address: \"reasoning-predictor.llm-serving.svc.cluster.local:80\"\n  path: \"/v1/chat/completions\"\n- name: \"ornith:35b\"\n  address: \"ornith-predictor.llm-serving.svc.cluster.local:80\"\n  path: \"/v1/chat/completions\"\n- name: \"qwen2.5:3b-instruct\"\n  address: \"qwen-cpu.llm-serving.svc.cluster.local:80\"\n  path: \"/v1/chat/completions\"\n- name: \"nomic-ai/nomic-embed-text-v2-moe\"\n  address: \"embeddings-predictor.llm-serving.svc.cluster.local:80\"\n  path: \"/v1/embeddings\"\n- name: \"BAAI/bge-reranker-base\"\n  address: \"reranker-predictor.llm-serving.svc.cluster.local:80\"\n  path: \"/v1/rerank\"\nadapters:\n- serviceName: sqs\n  upstream:\n    url: http://management-service.sqs.svc.cluster.local:9090\n    timeoutSeconds: 30\n  auth:\n    required: true\n  resources:\n  - name: send-message\n    methods:\n    - verb: POST\n      upstreamPath: /sqs/send\n  - name: receive-message\n    methods:\n    - verb: POST\n      upstreamPath: /sqs/receive\n  - name: list-queues\n    methods:\n    - verb: GET\n      upstreamPath: /sqs/queues\n- serviceName: workflow\n  upstream:\n    url: grpc://temporal-frontend.temporal.svc.cluster.local:7233\n    timeoutSeconds: 60\n  auth:\n    required: false\n  resources:\n  - name: execute\n    methods:\n    - verb: POST\n      upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ExecuteWorkflow\n  - name: describe\n    methods:\n    - verb: GET\n      upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/DescribeWorkflowExecution\n  - name: list\n    methods:\n    - verb: GET\n      upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ListWorkflowExecutions\n- serviceName: memory\n  upstream:\n    url: http://poimen-memory.poimen.svc.cluster.local:8080\n    timeoutSeconds: 30\n  auth:\n    required: false\n  resources:\n  - name: query\n    methods:\n    - verb: POST\n      upstreamPath: /memory/query\n  - name: ingest\n    methods:\n    - verb: POST\n      upstreamPath: /memory/ingest\n  - name: skills\n    methods:\n    - verb: GET\n      upstreamPath: /memory/skills\n- serviceName: s3\n  upstream:\n    url: http://minio.storage.svc.cluster.local:80\n    timeoutSeconds: 30\n  auth:\n    required: false\n  resources:\n  - name: list-objects\n    methods:\n    - verb: GET\n      upstreamPath: /\n  - name: get-object\n    methods:\n    - verb: GET\n      upstreamPath: /\n  - name: put-object\n    methods:\n    - verb: PUT\n      upstreamPath: /\n- serviceName: iam\n  upstream:\n    url: http://authentik-server.iam.svc.cluster.local:80\n    timeoutSeconds: 30\n  auth:\n    required: false\n  resources:\n  - name: list-roles\n    methods:\n    - verb: GET\n      upstreamPath: /api/v3/roles\n  - name: list-users\n    methods:\n    - verb: GET\n      upstreamPath: /api/v3/users\n  - name: create-role\n    methods:\n    - verb: POST\n      upstreamPath: /api/v3/roles\n"

k8s/integration-test-job.yaml

@@ -1,70 +0,0 @@
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: api-gateway-integration-test
-  namespace: api
-spec:
-  template:
-    spec:
-      serviceAccountName: api-gateway
-      restartPolicy: Never
-      containers:
-      - name: integration-tester
-        image: golang:1.26-bookworm
-        imagePullPolicy: IfNotPresent
-        workingDir: /workspace
-        command:
-          - /bin/bash
-          - -c
-          - |
-            set -e
-            echo "Starting integration tests..."
-            
-            # Clone the repo
-            git clone https://forgejo.riotpiao.com/riotpiao-poimen/homelab-frontend.git .
-            
-            # Wait for gateway to be ready
-            echo "Waiting for gateway service to be ready..."
-            for i in {1..30}; do
-              if curl -s http://api-gateway:8080/healthz | grep -q "alive"; then
-                echo "✓ Gateway is ready"
-                break
-              fi
-              echo "Attempting to reach gateway ($i/30)..."
-              sleep 2
-            done
-            
-            # Run integration tests
-            echo "Running integration tests..."
-            go test -v -tags=integration -timeout=5m ./internal/integration/...
-            
-            echo "✓ Integration tests completed"
-        env:
-        - name: GATEWAY_URL
-          value: "http://api-gateway:8080"
-        resources:
-          requests:
-            cpu: 250m
-            memory: 512Mi
-          limits:
-            cpu: 500m
-            memory: 1Gi
-        securityContext:
-          runAsNonRoot: true
-          runAsUser: 65532
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-              - ALL
-          readOnlyRootFilesystem: true
-        volumeMounts:
-        - name: tmp
-          mountPath: /tmp
-        - name: home
-          mountPath: /home/nonroot
-      volumes:
-      - name: tmp
-        emptyDir: {}
-      - name: home
-        emptyDir: {}
-  backoffLimit: 1

k8s/kustomization.yaml

@@ -8,7 +8,7 @@ resources:
 - service.yaml
 - deployment.yaml
 - network-policy.yaml
-- gateway-config-secret.yaml
+- gateway-config-secret.enc.yaml
 
 # The deployed image tag lives here and nowhere else. CI publishes
 # forgejo.riotpiao.com/rock/api-gateway:<commit-sha> and tags it as :latest on main.

k8s/network-policy.yaml

@@ -46,14 +46,6 @@ spec:
     ports:
     - protocol: TCP
       port: 8080
-  # Allow from paperless namespace (paperless-ai document auto-tagging)
-  - from:
-    - namespaceSelector:
-        matchLabels:
-          kubernetes.io/metadata.name: paperless
-    ports:
-    - protocol: TCP
-      port: 8080
   egress:
   # Allow DNS
   - to: