riotpiao-poimen/homelab-frontend
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: gateway authentik port from 80 to 9000 #22

Merged
rock merged 2 commits from fix/gateway-authentik-port into main 2026-09-13 00:07:59 +00:00
Conversation 0 Commits 2 Files Changed 2
+24 -153
poimen commented 2026-09-12 23:50:11 +00:00
Member
Copy Link
Copy Source

Fix gateway authentik port from 80 to 9000

NetworkPolicy allows gateway→iam only on ports 9000/9443.
Gateway config was using port 80, causing JWT validation failures.

Changes made:

  • auth.jwksUrl: port 80 → 9000
  • auth.tokenUrl: port 80 → 9000
  • iam.upstream: port 80 → 9000

This fixes JWKS refresh and JWT token validation.

Fix gateway authentik port from 80 to 9000 NetworkPolicy allows gateway→iam only on ports 9000/9443. Gateway config was using port 80, causing JWT validation failures. Changes made: - auth.jwksUrl: port 80 → 9000 - auth.tokenUrl: port 80 → 9000 - iam.upstream: port 80 → 9000 This fixes JWKS refresh and JWT token validation.
rock force-pushed fix/gateway-authentik-port from 3188ce3e6a to 2d55830412 2026-09-12 23:54:44 +00:00 Compare
rock added 1 commit 2026-09-12 23:56:35 +00:00
fix: gateway authentik port from 80 to 9000
CI / CI (pull_request) Successful in 3m9s
Details
45254a48b0 
NetworkPolicy allows gateway→iam only on ports 9000/9443, but config
used port 80 for JWKS fetch and token endpoints. This caused
'operation not permitted' errors and JWKS refresh failures.

Affects:
- auth.jwksUrl: uses port 9000 (Authentik HTTP)
- auth.tokenUrl: uses port 9000 for token exchange
- iam adapter upstream: routes to port 9000

Fixes: Gateway unable to validate JWT tokens, all chat/inference requests
returned 401 with 'token is unverifiable' error.
rock force-pushed fix/gateway-authentik-port from 2d55830412 to 45254a48b0 2026-09-12 23:56:35 +00:00 Compare
rock added 1 commit 2026-09-12 23:58:16 +00:00
fix: gateway authentik port 80→9000 + encrypt internal infrastructure URLs
CI / CI (pull_request) Successful in 3m45s
Details
db3a30fbcf 
Security improvements:
- Fix NetworkPolicy port: gateway→authentik 80→9000
- Encrypt internal cluster DNS names (.svc.cluster.local)
- SOPS encryption preserves Kubernetes structure (apiVersion, kind, metadata)
- Only sensitive URLs are encrypted, not the config structure

What's encrypted:
✓ jwksUrl, tokenUrl (authentik endpoints)
✓ All upstream service URLs (.svc.cluster.local)
✓ Internal infrastructure topology

What stays readable:
✓ apiVersion, kind (Kubernetes needs these)
✓ metadata.name, namespace (pod identification)
✓ Configuration structure

Fixes JWT validation failures and 401 errors on LLM requests.
rock merged commit d49756886a into main 2026-09-13 00:07:59 +00:00
rock deleted branch fix/gateway-authentik-port 2026-09-13 00:07:59 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
area/auth
Authentication & authorization
 area/authentik
Authentik OIDC provider config
 area/downstream
Downstream service changes
 area/gateway
API gateway code
 priority/high
Must have
 priority/low
Nice to have
 priority/medium
Should have
 status/blocked
Blocked by dependency
 status/done
Completed
 status/in-progress
Currently being worked on
 status/review
Ready for review
 status/todo
Not started
 type/docs
Documentation
 type/feature
New feature
 type/infra
Infrastructure change
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
poimen rock (Rock)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab-frontend#22