homelab-frontend/k8s/configmap.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: api-gateway-config
  namespace: api
  labels:
    app: api-gateway
data:
  config.yaml: |
    # Gateway configuration - loaded at startup, never compiled in
    # See REQUIREMENTS.md for full specification
    
    # JWT Authentication for /v1/* endpoints (LLM API)
    auth:
      enabled: true
      issuer: "https://authentik.riotpiao.com/application/o/api-gw/"
      audience: "api-gw"
      jwksUrl: "http://authentik-server.iam.svc.cluster.local/application/o/api-gw/jwks/"
      requiredCapability: "llm:inference"
      tokenUrl: "http://authentik-server.iam.svc.cluster.local/application/o/token/"
      clientId: "api-gw"
    
    # Routes: standard HTTP proxy routes (not LLM-specific)
    # These are for non-LLM services (agent-pod/console, etc.)
    routes: []
    
    # Models: LLM model registry for body-based dispatch
    # POST /v1/chat/completions routes based on the "model" field in request JSON
    models:
    - name: "reasoning"
      address: "reasoning-predictor.llm-serving:80"
      path: "/v1/chat/completions"
    
    - name: "ornith:35b"
      address: "ornith-predictor.llm-serving:80"
      path: "/v1/chat/completions"
    
    - name: "qwen2.5:3b-instruct"
      address: "ornith-predictor.llm-serving:80"
      path: "/v1/chat/completions"
    
    - name: "nomic-ai/nomic-embed-text-v2-moe"
      address: "embeddings-predictor.llm-serving:80"
      path: "/v1/embeddings"
    
    - name: "BAAI/bge-reranker-base"
      address: "reranker-predictor.llm-serving:80"
      path: "/v1/rerank"
    
    # Service adapters for X-Service header routing
    adapters:
    - serviceName: sqs
      upstream:
        url: http://management-service.sqs.svc.cluster.local:9090
        timeoutSeconds: 30
      auth:
        required: true
        # Gateway validates (kmsvc JWT validation code unverified)
        # TODO: Phase 3 - validate JWT signature against Authentik JWKS
      resources:
      - name: send-message
        methods:
        - verb: POST
          upstreamPath: /sqs/send
      - name: receive-message
        methods:
        - verb: POST
          upstreamPath: /sqs/receive
      - name: list-queues
        methods:
        - verb: GET
          upstreamPath: /sqs/queues

    - serviceName: workflow
      upstream:
        url: grpc://temporal-frontend.temporal.svc.cluster.local:7233
        timeoutSeconds: 60
      auth:
        required: false
        # Temporal has native JWT support via jwtKeyProvider
        # Phase 3: configure and test Temporal JWT validation
      resources:
      - name: execute
        methods:
        - verb: POST
          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ExecuteWorkflow
      - name: describe
        methods:
        - verb: GET
          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/DescribeWorkflowExecution
      - name: list
        methods:
        - verb: GET
          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ListWorkflowExecutions

    - serviceName: memory
      upstream:
        url: http://poimen-memory.poimen.svc.cluster.local:8080
        timeoutSeconds: 30
      auth:
        required: false
      resources:
      - name: query
        methods:
        - verb: POST
          upstreamPath: /memory/query
      - name: ingest
        methods:
        - verb: POST
          upstreamPath: /memory/ingest
      - name: skills
        methods:
        - verb: GET
          upstreamPath: /memory/skills

    - serviceName: s3
      upstream:
        url: http://minio.storage.svc.cluster.local:80
        timeoutSeconds: 30
      auth:
        required: false
        # MinIO has native JWT/OIDC support - validates JWTs itself
        # Phase 3: load-test MinIO JWT validation
      resources:
      - name: list-objects
        methods:
        - verb: GET
          upstreamPath: /
      - name: get-object
        methods:
        - verb: GET
          upstreamPath: /
      - name: put-object
        methods:
        - verb: PUT
          upstreamPath: /

    - serviceName: iam
      upstream:
        url: http://authentik-server.iam.svc.cluster.local:80
        timeoutSeconds: 30
      auth:
        required: false
        # Authentik validates bearer tokens independently
      resources:
      - name: list-roles
        methods:
        - verb: GET
          upstreamPath: /api/v3/roles
      - name: list-users
        methods:
        - verb: GET
          upstreamPath: /api/v3/users
      - name: create-role
        methods:
        - verb: POST
          upstreamPath: /api/v3/roles