riotpiao-poimen/homelab-frontend
2
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix: gateway authentik port from 80 to 9000 #22

Merged
rock merged 2 commits from fix/gateway-authentik-port into main 2026-09-13 00:07:59 +00:00
Conversation 0 Commits 2 Files Changed 2
+24 -153
2 Commits
Author SHA1 Message Date
Admin Bot db3a30fbcf fix: gateway authentik port 80→9000 + encrypt internal infrastructure URLs
CI / CI (pull_request) Successful in 3m45s
Details 
Security improvements:
- Fix NetworkPolicy port: gateway→authentik 80→9000
- Encrypt internal cluster DNS names (.svc.cluster.local)
- SOPS encryption preserves Kubernetes structure (apiVersion, kind, metadata)
- Only sensitive URLs are encrypted, not the config structure

What's encrypted:
✓ jwksUrl, tokenUrl (authentik endpoints)
✓ All upstream service URLs (.svc.cluster.local)
✓ Internal infrastructure topology

What stays readable:
✓ apiVersion, kind (Kubernetes needs these)
✓ metadata.name, namespace (pod identification)
✓ Configuration structure

Fixes JWT validation failures and 401 errors on LLM requests.
 2026-09-13 08:58:07 +09:00
Admin Bot 45254a48b0 fix: gateway authentik port from 80 to 9000
CI / CI (pull_request) Successful in 3m9s
Details 
NetworkPolicy allows gateway→iam only on ports 9000/9443, but config
used port 80 for JWKS fetch and token endpoints. This caused
'operation not permitted' errors and JWKS refresh failures.

Affects:
- auth.jwksUrl: uses port 9000 (Authentik HTTP)
- auth.tokenUrl: uses port 9000 for token exchange
- iam adapter upstream: routes to port 9000

Fixes: Gateway unable to validate JWT tokens, all chat/inference requests
returned 401 with 'token is unverifiable' error.
 2026-09-13 08:48:08 +09:00