From 7f96da880fb57d61777582b9866df7f416c3a130 Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Mon, 26 Oct 2026 03:12:26 -0700
Subject: [PATCH] fix(ingress): restore the authentik.riotpiao.com route

Commit a02bee5 had both the Ingress rule and the cloudflared tunnel
hostname for authentik.riotpiao.com. Both were lost, so the tunnel
answered 404 for the hostname and the ingress had no matching rule.

The CoreDNS rewrite and the authentik-server Service were still intact;
only the two routing entries were missing. Re-add the Ingress (namespace
iam, service authentik-server port 80, TLS terminated by the wildcard
default-ssl-certificate) and the tunnel hostname.
---
 k8s/apps/cloudflared/configmap.yaml |  4 ++++
 k8s/bootstrap/ingress/ingress.yaml  | 28 ++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/k8s/apps/cloudflared/configmap.yaml b/k8s/apps/cloudflared/configmap.yaml
index 656469c..2fba788 100644
--- a/k8s/apps/cloudflared/configmap.yaml
+++ b/k8s/apps/cloudflared/configmap.yaml
@@ -53,4 +53,8 @@ data:
       # even though the DNS CNAME points at the tunnel.
       - hostname: zitadel.riotpiao.com
         service: https://zitadel.riotpiao.com
+      # AUTHENTIK. Same reasoning as ZITADEL: a hostname absent from this table
+      # gets 404 from the connector. CoreDNS rewrites the name to ingress-nginx.
+      - hostname: authentik.riotpiao.com
+        service: https://authentik.riotpiao.com
       - service: http_status:404
diff --git a/k8s/bootstrap/ingress/ingress.yaml b/k8s/bootstrap/ingress/ingress.yaml
index 378c9d9..de57a83 100644
--- a/k8s/bootstrap/ingress/ingress.yaml
+++ b/k8s/bootstrap/ingress/ingress.yaml
@@ -275,3 +275,31 @@ spec:
                 name: temporal-web
                 port:
                   number: 8080
+
+---
+# ── Authentik (identity provider) ─────────────────────────────────────────────
+# The chart's ingress is disabled in k8s/infra/iam/authentik-values.yaml; the
+# rule lives here so ingress-config owns every hostname. TLS terminates at
+# nginx via the wildcard default-ssl-certificate, so the backend stays HTTP.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: authentik
+  namespace: iam
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: "16m"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: authentik.riotpiao.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: authentik-server
+                port:
+                  number: 80