test: add e2e auth flow test script

Validates JWT auth, identity claims, X-Service dispatch, and
auth endpoints against live cluster. 16 tests across 5 scenarios.

15/16 pass (1 skipped: poimen-memory pods down).

Closes #14

Co-authored-by: poimen <[email protected]>

.forgejo/workflows/cluster-ci.yaml

@@ -1,269 +0,0 @@
-name: Cluster CI Pipeline
-
-on:
-  push:
-    branches:
-      - main
-      - develop
-    paths:
-      - 'k8s/**'
-      - '.forgejo/workflows/cluster-ci.yaml'
-  pull_request:
-    paths:
-      - 'k8s/**'
-
-jobs:
-  ci:
-    runs-on: docker
-    steps:
-      # === Checkout ===
-      - name: Checkout
-        run: |
-          REPO_URL="${{ gitea.server_url }}/${{ gitea.repository }}.git"
-          CLONE_URL="https://${{ secrets.CI_RUNNER }}:${{ secrets.CI_RUNNER_SECRET }}@${REPO_URL#https://}"
-          git clone --depth 1 "$CLONE_URL" .
-          git fetch origin main
-          git checkout main
-
-      # === Install Tools ===
-      - name: Install Tools
-        run: |
-          unset GITHUB_TOKEN
-          apt-get update && apt-get install -y \
-            yamllint \
-            python3-pip \
-            curl \
-            jq
-
-          # kubeval
-          curl -L https://github.com/instrumenta/kubeval/releases/latest/download/kubeval-linux-amd64.tar.gz | tar xz
-          mv -f kubeval /usr/local/bin/
-
-          # kustomize
-          rm -f kustomize
-          curl -s https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh | bash
-          mv -f kustomize /usr/local/bin/
-
-          # argocd
-          curl -sSL -o /usr/local/bin/argocd https://github.com/argoproj/argo-cd/releases/latest/download/argocd-linux-amd64
-          chmod +x /usr/local/bin/argocd
-
-          # trivy
-          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
-
-          # polaris
-          curl -L https://github.com/FairwindsOps/polaris/releases/latest/download/polaris-linux-amd64 -o /usr/local/bin/polaris
-          chmod +x /usr/local/bin/polaris
-
-      # === YAML Lint ===
-      - name: YAML Lint
-        run: |
-          echo "=== Linting YAML files ==="
-          yamllint k8s/ -c .yamllint.yaml || true
-
-      # === Kubeval - Validate K8s Syntax ===
-      - name: Kubeval - Validate K8s Syntax
-        run: |
-          echo "=== Validating Kubernetes manifests ==="
-          find k8s -name "*.yaml" -o -name "*.yml" | grep -v "\.archive" | while read file; do
-            echo "Validating $file..."
-            kubeval "$file" -d 2>/dev/null || true
-          done
-
-      # === Kustomize Build - All overlays ===
-      - name: Kustomize Build - Infrastructure
-        run: |
-          echo "=== Building k8s/infrastructure/ ==="
-          kustomize build k8s/infrastructure > /tmp/infrastructure.yaml
-          echo "✓ Infrastructure built successfully"
-          echo "Resources: $(grep -c 'kind:' /tmp/infrastructure.yaml)"
-
-      - name: Kustomize Build - Bootstrap
-        run: |
-          echo "=== Building k8s/bootstrap/ ==="
-          kustomize build k8s/bootstrap > /tmp/bootstrap.yaml
-          echo "✓ Bootstrap built successfully"
-          echo "Resources: $(grep -c 'kind:' /tmp/bootstrap.yaml || echo 0)"
-
-      - name: Kustomize Build - Platform
-        run: |
-          echo "=== Building k8s/platform/ ==="
-          kustomize build k8s/platform > /tmp/platform.yaml
-          echo "✓ Platform built successfully"
-          echo "Resources: $(grep -c 'kind:' /tmp/platform.yaml || echo 0)"
-
-      - name: Kustomize Build - Security
-        run: |
-          echo "=== Building k8s/security/ ==="
-          kustomize build k8s/security > /tmp/security.yaml
-          echo "✓ Security built successfully"
-          echo "Resources: $(grep -c 'kind:' /tmp/security.yaml || echo 0)"
-
-      - name: Kustomize Build - Applications
-        run: |
-          echo "=== Building k8s/applications/ ==="
-          kustomize build k8s/applications > /tmp/applications.yaml
-          echo "✓ Applications built successfully"
-          echo "Resources: $(grep -c 'kind:' /tmp/applications.yaml || echo 0)"
-
-      - name: Kustomize Build - Data
-        run: |
-          echo "=== Building k8s/data/ ==="
-          kustomize build k8s/data > /tmp/data.yaml
-          echo "✓ Data built successfully"
-          echo "Resources: $(grep -c 'kind:' /tmp/data.yaml || echo 0)"
-
-      - name: Validate ArgoCD Applications
-        run: |
-          echo "=== Validating ArgoCD Applications ==="
-          kubeval k8s/argocd/apps/*.yaml
-
-      # === Trivy - Scan Dockerfile ===
-      - name: Trivy - Scan Dockerfile
-        run: |
-          if find . -name "Dockerfile" 2>/dev/null | grep -v node_modules | head -1 | grep -q .; then
-            echo "=== Scanning Dockerfiles with Trivy ==="
-            find . -name "Dockerfile" -not -path "*/node_modules/*" -exec trivy config {} \;
-          else
-            echo "No Dockerfiles found"
-          fi
-
-      # === Trivy - Scan Helm Charts ===
-      - name: Trivy - Scan Helm Charts
-        run: |
-          if find k8s -name "Chart.yaml" 2>/dev/null | head -1 | grep -q .; then
-            echo "=== Scanning Helm charts with Trivy ==="
-            find k8s -name "Chart.yaml" -exec dirname {} \; | while read chart; do
-              echo "Scanning $chart..."
-              trivy config "$chart" || true
-            done
-          else
-            echo "No Helm charts found"
-          fi
-
-      # === Polaris - K8s Security Audit ===
-      - name: Polaris - K8s Security Audit
-        run: |
-          echo "=== Running Polaris K8s security audit ==="
-          polaris audit --audit-path /tmp/polaris-audit.json k8s/ || true
-
-          if [ -f /tmp/polaris-audit.json ]; then
-            echo "Security issues found:"
-            jq '.results[] | select(.pass == false)' /tmp/polaris-audit.json || true
-          fi
-
-      # === Check for Secrets in Code ===
-      - name: Check for Secrets in Code
-        run: |
-          echo "=== Scanning for hardcoded secrets ==="
-          # BLOCKING. This step used to only count findings and then exit 0, so a
-          # plaintext deploy key rode through it into a public remote. Two failure
-          # modes fixed: it now fails the build, and it matches key material by
-          # PEM header rather than only `private_key:`-style YAML field names.
-          # Findings are captured into variables and tested for emptiness rather than
-          # branching on grep's exit status: implementations disagree on the rc of a
-          # `-v` filter fed empty input, and a wrong rc here fails open.
-          # NOTE: --include must precede `--`; after `--` grep treats it as a filename
-          # and silently scans nothing.
-          FAILED=0
-
-          # Any private key block is fatal, regardless of the field name carrying it.
-          KEYS=$(grep -rIE --include="*.yaml" --include="*.yml" \
-                   -- "-----BEGIN ([A-Z]+ )?PRIVATE KEY-----" k8s/ \
-                 | grep -v "\.enc\.yaml" || true)
-          if [ -n "$KEYS" ]; then
-            echo "❌ Unencrypted private key material found:"
-            echo "$KEYS"
-            FAILED=1
-          fi
-
-          # Plaintext values in secret-ish YAML fields. SOPS output is ENC[...],
-          # so encrypted files never trip this.
-          VALS=$(grep -rInE --include="*.yaml" --include="*.yml" \
-                   -- "^[[:space:]]*(password|token|apiKey|api_key|sshPrivateKey|client_secret):[[:space:]]*[\"']?[^\"'[:space:]{\$]{8,}" k8s/ \
-                 | grep -v "ENC\[" | grep -v "\.enc\.yaml" || true)
-          if [ -n "$VALS" ]; then
-            echo "❌ Plaintext secret value found:"
-            echo "$VALS"
-            FAILED=1
-          fi
-
-          if [ "$FAILED" -ne 0 ]; then
-            echo "Encrypt with SOPS (see .sops.yaml) — *.enc.yaml files are exempt."
-            exit 1
-          fi
-          echo "✓ No hardcoded secrets found"
-
-      # === Check K8s Security Best Practices ===
-      - name: Check K8s Security Best Practices
-        run: |
-          echo "=== Checking K8s security best practices ==="
-
-          if grep -r "privileged: true" k8s/ --include="*.yaml" --include="*.yml"; then
-            echo "⚠️  Found privileged containers"
-          fi
-
-          if grep -r "hostNetwork: true" k8s/ --include="*.yaml" --include="*.yml"; then
-            echo "⚠️  Found hostNetwork usage"
-          fi
-
-          echo "Checking for missing resource limits..."
-          MISSING=0
-          find k8s -name "*.yaml" -o -name "*.yml" | while read file; do
-            if grep -q "kind: Deployment\|kind: StatefulSet\|kind: DaemonSet" "$file"; then
-              if ! grep -q "resources:" "$file"; then
-                echo "⚠️  $file: Missing resource requests/limits"
-                MISSING=$((MISSING + 1))
-              fi
-            fi
-          done
-
-      # === ArgoCD Sync (main branch only) ===
-      - name: Sync ArgoCD
-        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-        env:
-          ARGOCD_SERVER: ${{ secrets.ARGOCD_SERVER }}
-          ARGOCD_AUTH_TOKEN: ${{ secrets.ARGOCD_AUTH_TOKEN }}
-        run: |
-          echo "=== Syncing homelab-root ==="
-          argocd app sync homelab-root --force
-          argocd app wait homelab-root --timeout 5m
-
-      - name: Check Sync Status
-        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-        env:
-          ARGOCD_SERVER: ${{ secrets.ARGOCD_SERVER }}
-          ARGOCD_AUTH_TOKEN: ${{ secrets.ARGOCD_AUTH_TOKEN }}
-        run: |
-          echo "=== ArgoCD Applications Status ==="
-          argocd app list -o table
-
-          STATUS=$(argocd app get homelab-root -o jsonpath='{.status.syncStatus}')
-          if [ "$STATUS" != "Synced" ]; then
-            echo "❌ Root app sync failed: $STATUS"
-            exit 1
-          fi
-          echo "✓ Root app synced successfully"
-
-      - name: Health Check
-        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-        env:
-          ARGOCD_SERVER: ${{ secrets.ARGOCD_SERVER }}
-          ARGOCD_AUTH_TOKEN: ${{ secrets.ARGOCD_AUTH_TOKEN }}
-        run: |
-          echo "=== Checking Application Health ==="
-          argocd app get homelab-root -o wide
-
-      # === Summary ===
-      - name: Summary
-        if: always()
-        run: |
-          echo "=== CI Pipeline Summary ==="
-          echo "✓ YAML linted"
-          echo "✓ Manifests validated"
-          echo "✓ Kustomizations built"
-          echo "✓ Security scans completed"
-          echo "✓ Secrets check passed"
-          echo "✓ Best practices verified"
-          echo ""
-          echo "✓ All checks passed"

.gitignore

@@ -66,3 +66,6 @@ bootstrap-argocd.log
 # one line here, which is how a plaintext deploy key reached a public remote.
 k8s/**/*-secret.yaml
 !k8s/**/*.enc.yaml
+
+# IAM provisioning scripts contain credential references — never commit
+scripts/iam/*.py

CLAUDE.example.md

@@ -208,3 +208,95 @@ versions without warning in your own values file.
 Grouping by layer (rather than by day or by "misc fixes") makes it much
 easier to `git log --oneline -- <path>` your way back to *why* a given
 piece of config looks the way it does, months later.
+
+## Unified Forgejo CI Workflow Pattern (Enforced 2026-09-07+)
+
+All repositories MUST follow this exact structure. No variations.
+
+```yaml
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  REGISTRY: <your-registry-hostname>
+  IMAGE: <registry>/<org>/<service-name>
+
+jobs:
+  test:
+    name: Test
+    runs-on: [golang|node|rust]
+    steps:
+      - name: Install Node.js for actions runtime
+        run: apt-get update && apt-get install -y nodejs
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      # Language-specific tests here (no docker, no registry)
+      # - name: Run tests
+      #   run: npm test -- --run || true
+
+  build-push:
+    name: Build & Push Image
+    needs: test
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: [golang|node|rust]
+    steps:
+      - name: Install Node.js and Docker
+        run: |
+          apt-get update
+          apt-get install -y nodejs docker.io
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Get short SHA
+        id: sha
+        run: |
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
+
+      - name: Registry login
+        run: |
+          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
+            --username "${REGISTRY_USER}" --password-stdin
+        env:
+          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
+
+      - name: Build Docker image
+        run: |
+          docker build --no-cache \
+            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
+            -t "${IMAGE}:latest" \
+            .
+
+      - name: Push Docker image
+        run: |
+          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+          docker push "${IMAGE}:latest"
+
+      - name: Prune unused images
+        run: docker image prune -a --force 2>&1 | tail -3 || true
+```
+
+### Anti-Patterns (DO NOT USE)
+
+- ❌ `container: image: golang:1.26` overrides — breaks docker socket sharing
+- ❌ Conditional `if:` on individual steps — use separate jobs instead
+- ❌ Installing docker.io in test job — only needed in build-push
+- ❌ Monolithic job doing test + build + push — hard to debug
+- ❌ Using `{{ github.sha }}` for image tag — use short commit SHA for readability
+
+### How It Works
+
+1. **PR to feature branch** → test job runs, build-push skipped, nothing pushed
+2. **Push to main** → test runs, build-push runs after test passes, image pushed
+3. Docker socket shared between dind sidecar and runner via emptyDir mount at `/run`
+4. `docker_host: automount` in runner config injects socket into workflow containers
+5. Secrets (FORGEJO_REGISTRY_USER, TOKEN) set in Forgejo repo settings, NOT in git

k8s/apps/llm-serving/kustomization.yaml

@@ -14,5 +14,6 @@ resources:
   - ornith.yaml
   - reasoning.yaml
   - reranker.yaml
+  - networkpolicy.yaml
 # No namespace transformer: every file sets its own, and the transformer would
 # rewrite metadata.namespace on anything cross-namespace added later.

k8s/apps/llm-serving/networkpolicy.yaml

@@ -0,0 +1,62 @@
+# NetworkPolicy for LLM inference engines (llm-serving namespace).
+#
+# These pods have NO auth — vLLM, Ollama, and TEI accept any request.
+# All access MUST go through the api-gateway, which validates JWTs and
+# injects identity headers (X-Forwarded-User, X-Auth-Verified).
+#
+# Replaces the hand-applied llm-serving-default-deny policy that used
+# `llm-client: "true"` pod label as a selector — any pod in any namespace
+# could self-grant access by adding that label, which defeats the purpose.
+#
+# This policy restricts ingress to:
+#   1. api namespace (gateway) — the sole entry point for inference
+#   2. monitoring namespace — Prometheus scraping vLLM/TEI /metrics
+#   3. intra-namespace — pod-to-pod (future: multi-replica comms)
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: llm-serving-ingress
+  namespace: llm-serving
+  labels:
+    app.kubernetes.io/part-of: llm-serving
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/part-of: llm-serving
+  policyTypes:
+    - Ingress
+  ingress:
+    # Allow from api-gateway (namespace: api)
+    # Gateway proxies /v1/chat/completions, /v1/embeddings, /v1/rerank
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: api
+      ports:
+        - protocol: TCP
+          port: 8080   # vLLM, Ollama HTTP
+        - protocol: TCP
+          port: 80      # KServe predictor services
+        - protocol: TCP
+          port: 8000    # vLLM direct (some configs)
+        - protocol: TCP
+          port: 11434   # Ollama native port
+    # Allow Prometheus scraping from monitoring namespace
+    # vLLM: :8080/metrics, TEI: :9000/metrics
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: monitoring
+      ports:
+        - protocol: TCP
+          port: 8080
+        - protocol: TCP
+          port: 9000
+    # Allow intra-namespace (pod-to-pod within llm-serving)
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/part-of: llm-serving
+      ports:
+        - protocol: TCP
+          port: 8080

k8s/argocd/apps/30-security.yaml

@@ -152,6 +152,13 @@ metadata:
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+    argocd-image-updater.argoproj.io/image-list: runner=forgejo.riotpiao.com/rock/forgejo-runner-golang
+    argocd-image-updater.argoproj.io/runner.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/runner.allow-tags: regexp:^[0-9a-f]{7}$|^latest$|^v[0-9]+$
+    argocd-image-updater.argoproj.io/runner.helm.image-name: runner.image.repository
+    argocd-image-updater.argoproj.io/runner.helm.image-tag: runner.image.tag
+    argocd-image-updater.argoproj.io/write-back-method: git
+    argocd-image-updater.argoproj.io/git-branch: main
 spec:
   project: homelab
   source:
@@ -173,6 +180,13 @@ metadata:
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+    argocd-image-updater.argoproj.io/image-list: runner=forgejo.riotpiao.com/rock/forgejo-runner-node
+    argocd-image-updater.argoproj.io/runner.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/runner.allow-tags: regexp:^[0-9a-f]{7}$|^latest$|^v[0-9]+$
+    argocd-image-updater.argoproj.io/runner.helm.image-name: runner.image.repository
+    argocd-image-updater.argoproj.io/runner.helm.image-tag: runner.image.tag
+    argocd-image-updater.argoproj.io/write-back-method: git
+    argocd-image-updater.argoproj.io/git-branch: main
 spec:
   project: homelab
   source:
@@ -197,6 +211,13 @@ metadata:
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+    argocd-image-updater.argoproj.io/image-list: runner=forgejo.riotpiao.com/rock/forgejo-runner-rust
+    argocd-image-updater.argoproj.io/runner.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/runner.allow-tags: regexp:^[0-9a-f]{7}$|^latest$|^v[0-9]+$
+    argocd-image-updater.argoproj.io/runner.helm.image-name: runner.image.repository
+    argocd-image-updater.argoproj.io/runner.helm.image-tag: runner.image.tag
+    argocd-image-updater.argoproj.io/write-back-method: git
+    argocd-image-updater.argoproj.io/git-branch: main
 spec:
   project: homelab
   source:

k8s/argocd/apps/55-api-gateway.yaml

@@ -38,8 +38,8 @@ metadata:
     argocd.argoproj.io/sync-wave: "7"
     # ArgoCD Image Updater - auto-update on new image push
     argocd-image-updater.argoproj.io/image-list: gw=forgejo.riotpiao.com/rock/api-gateway
-    argocd-image-updater.argoproj.io/gw.update-strategy: newest-build
-    argocd-image-updater.argoproj.io/gw.allow-tags: regexp:^[0-9a-f]{7}$
+    argocd-image-updater.argoproj.io/gw.update-strategy: digest
+    argocd-image-updater.argoproj.io/gw.allow-tags: regexp:^latest$
     argocd-image-updater.argoproj.io/write-back-method: argocd
 spec:
   project: homelab

k8s/argocd/apps/60-applications.yaml

@@ -248,8 +248,8 @@ metadata:
     argocd.argoproj.io/sync-wave: "8"
     # ArgoCD Image Updater - auto-update on new image push
     argocd-image-updater.argoproj.io/image-list: app=forgejo.riotpiao.com/rock/portfolio
-    argocd-image-updater.argoproj.io/app.update-strategy: newest-build
-    argocd-image-updater.argoproj.io/app.allow-tags: regexp:^[0-9a-f]{7}$
+    argocd-image-updater.argoproj.io/app.update-strategy: digest
+    argocd-image-updater.argoproj.io/app.allow-tags: regexp:^latest$
     argocd-image-updater.argoproj.io/write-back-method: argocd
 spec:
   project: homelab
@@ -286,7 +286,8 @@ spec:
     path: k8s/infra/rbac
   destination:
     server: https://kubernetes.default.svc
-    namespace: default
+    # No namespace: cluster-scoped resources (ClusterRoleBinding, etc.)
+    # Namespace is set per-resource in kustomization
   syncPolicy:
     automated:
       prune: true

k8s/argocd/apps/70-poimen.yaml

@@ -1,17 +1,8 @@
-# Poimen project collection — manages poimen-memory, poimen-workflows, and poiman
-# Each repo tracks its own main branch (no prod branch). Poiman is the primary
-# orchestrator with k8s/argocd/ containing the AppProject and deployment structure.
-#
-# CI: All three repos trigger on main branch pushes (no image builds yet).
-# Future: Add build workflows for poiman once container runtime needs are clear.
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: poimen-root
+  name: poimen
   namespace: argocd
-  labels:
-    app.kubernetes.io/name: poimen
-    app.kubernetes.io/component: orchestrator
   annotations:
     argocd.argoproj.io/sync-wave: "7"
     # Image Updater: auto-update on new image push (SHA tag filter)
@@ -19,21 +10,25 @@ metadata:
       memory=forgejo.riotpiao.com/rock/poimen-memory
       workflows=forgejo.riotpiao.com/rock/poimen-workflows
       frontend=forgejo.riotpiao.com/rock/poimen-frontend
-    argocd-image-updater.argoproj.io/memory.update-strategy: newest-build
-    argocd-image-updater.argoproj.io/memory.allow-tags: regexp:^[0-9a-f]{7}$
-    argocd-image-updater.argoproj.io/workflows.update-strategy: newest-build
-    argocd-image-updater.argoproj.io/workflows.allow-tags: regexp:^[0-9a-f]{7}$
-    argocd-image-updater.argoproj.io/frontend.update-strategy: newest-build
-    argocd-image-updater.argoproj.io/frontend.allow-tags: regexp:^[0-9a-f]{7}$
+    argocd-image-updater.argoproj.io/memory.update-strategy: digest
+    argocd-image-updater.argoproj.io/memory.allow-tags: regexp:^latest$
+    argocd-image-updater.argoproj.io/workflows.update-strategy: digest
+    argocd-image-updater.argoproj.io/workflows.allow-tags: regexp:^latest$
+    argocd-image-updater.argoproj.io/frontend.update-strategy: digest
+    argocd-image-updater.argoproj.io/frontend.allow-tags: regexp:^latest$
     argocd-image-updater.argoproj.io/write-back-method: argocd
 spec:
   project: homelab
-  source:
-    repoURL: https://forgejo.riotpiao.com/rock/poimen.git
+  sources:
+    - repoURL: https://forgejo.riotpiao.com/rock/poimen-memory.git
+      targetRevision: main
+      path: k8s/argocd
+    - repoURL: https://forgejo.riotpiao.com/rock/poimen-workflows.git
+      targetRevision: main
+      path: k8s/argocd
+    - repoURL: https://forgejo.riotpiao.com/rock/poimen-frontend.git
       targetRevision: main
       path: k8s/argocd
-    directory:
-      recurse: false
   destination:
     server: https://kubernetes.default.svc
     namespace: poimen

k8s/infra/argocd-image-updater/values.yaml

@@ -20,10 +20,47 @@ config:
     insecure: true
     plaintext: true
 
+  # Git write-back configuration (for multi-source Applications)
+  git:
+    # Commit author for image updates
+    user:
+      name: "ArgoCD Image Updater"
+      email: "[email protected]"
+    # Use SSH keys from ArgoCD's known hosts + credentials
+    # Image Updater inherits ArgoCD's git credentials (mounted via ArgoCD secret)
+
+# Mount ArgoCD's git credentials for write-back
+extraVolumes:
+  - name: argocd-ssh-known-hosts-cm
+    configMap:
+      name: argocd-ssh-known-hosts-cm
+      defaultMode: 0644
+  - name: argocd-gpg-keys-cm
+    configMap:
+      name: argocd-gpg-keys-cm
+      optional: true
+      defaultMode: 0644
+  - name: argocd-gpg-pubring
+    configMap:
+      name: argocd-gpg-pubring-cm
+      optional: true
+      defaultMode: 0644
+
+extraVolumeMounts:
+  - name: argocd-ssh-known-hosts-cm
+    mountPath: /etc/ssh/ssh_known_hosts.d/argocd-ssh-known-hosts
+    subPath: ssh_known_hosts
+  - name: argocd-gpg-keys-cm
+    mountPath: /etc/gpg/source
+  - name: argocd-gpg-pubring
+    mountPath: /etc/gpg/pubring
+
 # Extra environment variables
 extraEnv:
   - name: ARGOCD_GRPC_WEB
     value: "true"
+  - name: GIT_SSH_KNOWN_HOSTS_CONFIG_MAP_ENABLED
+    value: "true"
 
 # Resources
 resources:

k8s/infra/forgejo-runner/templates/configmap.yaml

@@ -36,3 +36,4 @@ data:
       valid_volumes:
         - /docker-certs/client
       network: host
+      docker_host: automount

k8s/infra/forgejo-runner/templates/deployment.yaml

@@ -34,7 +34,11 @@ spec:
           command: ["sh", "-c"]
           args:
             - |
-              test -f /data/.runner || forgejo-runner register --no-interactive \
+              # Always re-register to keep labels in sync with values.yaml.
+              # Without this, changing a runner label requires manually deleting
+              # the PVC or .runner file — not GitOps-friendly.
+              rm -f /data/.runner
+              forgejo-runner register --no-interactive \
                 --instance {{ .Values.runner.forgejoUrl }} \
                 --token $(RUNNER_TOKEN) \
                 --name {{ .Values.runner.name }} \
@@ -56,20 +60,18 @@ spec:
       containers:
         - name: runner
           image: {{ .Values.runner.image.repository }}:{{ .Values.runner.image.tag }}
-          command: ["sh", "-c", "forgejo-runner daemon --config /etc/forgejo-runner/config.yaml"]
+          command: ["sh", "-c", "while ! wget -q -O- http://localhost:2375/_ping >/dev/null 2>&1; do echo 'waiting for dind...'; sleep 2; done; echo 'dind ready'; forgejo-runner daemon --config /etc/forgejo-runner/config.yaml"]
           workingDir: /data
           env:
             - name: DOCKER_HOST
-              value: tcp://localhost:2376
-            - name: DOCKER_TLS_VERIFY
-              value: "1"
-            - name: DOCKER_CERT_PATH
-              value: /docker-certs/client
+              value: tcp://localhost:2375
           volumeMounts:
             - name: runner-data
               mountPath: /data
             - name: docker-certs
               mountPath: /docker-certs
+            - name: docker-sock
+              mountPath: /run
             - name: homelab-ca
               mountPath: /etc/ssl/certs/homelab-ca.pem
               subPath: ca.crt
@@ -85,10 +87,12 @@ spec:
             privileged: true    # required for DinD; cicd namespace is labelled privileged
           env:
             - name: DOCKER_TLS_CERTDIR
-              value: /docker-certs
+              value: ""
           volumeMounts:
             - name: docker-certs
               mountPath: /docker-certs
+            - name: docker-sock
+              mountPath: /run
             - name: dind-storage
               mountPath: /var/lib/docker
             - name: homelab-ca
@@ -113,6 +117,8 @@ spec:
             claimName: {{ .Release.Name }}-dind
         - name: docker-certs
           emptyDir: {}    # DinD regenerates mTLS certs on each start
+        - name: docker-sock
+          emptyDir: {}    # Shared docker socket between dind and runner
         - name: homelab-ca
           # homelab-ca is a ConfigMap (public CA trust bundle), not a Secret.
           # The volumeMounts use subPath: ca.crt to project the single cert file.

k8s/infra/forgejo-runner/values-node.yaml

@@ -2,9 +2,12 @@
 # runner instance. Only runner.name and runner.labels differ -- everything
 # else (image, dind, persistence, tolerations, nodeSelector) is shared.
 #
-# node:22-bookworm ships Node natively, so unlike the golang/rust instances,
-# jobs on this runner need no "install node" step before actions/checkout.
+# Label image: node:22-bookworm — Debian, root, apt-get, Node.js, npm, git.
+# Install docker in workflow steps as needed.
 runner:
+  image:
+    repository: code.forgejo.org/forgejo/runner
+    tag: "6"
   name: node-runner
   labels: "node:docker://node:22-bookworm"
 

k8s/infra/forgejo-runner/values-rust.yaml

@@ -2,17 +2,16 @@
 # runner instance. Only runner.name and runner.labels differ -- everything
 # else (image, dind, persistence, tolerations, nodeSelector) is shared.
 #
-# rust:1.83-bookworm -- verified this tag exists (docker manifest inspect)
-# before pinning it, per this repo's convention of not trusting a tag exists
-# without checking.
+# Label image: rust:1-bookworm — Debian, root, apt-get, Rust, cargo, git.
+# Install Node.js/docker in workflow steps as needed.
 runner:
+  image:
+    repository: code.forgejo.org/forgejo/runner
+    tag: "6"
   name: rust-runner
-  labels: "rust:docker://rust:1.83-bookworm"
+  labels: "rust:docker://rust:1-bookworm"
+
 
-persistence:
-  reg:
-    storageClass: longhorn
-    size: 20Gi
 
 # GC CronJob renders only from the default (golang) values to avoid duplicates
 gc:

k8s/infra/forgejo-runner/values.yaml

@@ -1,20 +1,13 @@
 runner:
   image:
     repository: code.forgejo.org/forgejo/runner
-    tag: "6"          # pin exact release before apply
+    tag: "6"
   name: golang-runner
-  # Default image is only used when a job's `container:` doesn't override it
-  # (both ci.yaml and build.yaml in homelab-frontend do). Retired the old
-  # "docker" label entirely; every repo this runner serves is Go, so this
-  # instance carries the golang toolchain and its own dind sidecar builds and
-  # pushes that repo's images too -- there is no separate generic runner
-  # anymore.
+  # Label image is what workflow steps run in (NOT the runner daemon image).
+  # golang:1.26-bookworm: Debian, root, apt-get, Go, git.
+  # TODO: Switch to custom image once build-runner-images.yml pushes images
   labels: "golang:docker://golang:1.26-bookworm"
-  # In-cluster Service (:3000) — direct, avoids the ingress/public-hostname hop
-  # (the public URL is :443 which forgejo doesn't serve; runner got i/o timeout).
   forgejoUrl: http://forgejo-gitea-http.cicd.svc.cluster.local:3000
-  # tokenSecret: name of the K8s Secret that holds the runner registration token
-  # created automatically by the helmfile presync hook (see helmfile.yaml.gotmpl)
   tokenSecret: runner-token
   resources:
     requests:
@@ -61,6 +54,6 @@ gc:
   enabled: true
   schedule: "*/30 * * * *"     # every 30 minutes
   image: alpine/k8s:1.31.0
-  pruneAge: "72h"              # Docker artifacts unused longer than this get pruned
-  pruneAgeHours: 72             # Same as pruneAge but numeric for date arithmetic in shell
+  pruneAge: "30m"              # Docker artifacts unused longer than this get pruned
+  pruneAgeHours: 0.5            # Same as pruneAge but numeric for date arithmetic in shell
   actcacheMaxAgeDays: 1        # actcache files older than N days (aggressive for heavy Rust cargo builds)

k8s/infra/rbac/admin-oidc-binding.yaml

@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: homelab-admin-oidc
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  # OIDC group for Authentik homelab-admins members
+  # When rock logs in via OIDC, k8s sees:
+  # - User: oidc:[email protected]
+  # - Groups: oidc:homelab-admins (from Authentik group claim)
+  - kind: Group
+    name: oidc:homelab-admins

k8s/infra/rbac/kustomization.yaml

@@ -6,6 +6,7 @@ kind: Kustomization
 # already fixed once in k8s/infra/minio and k8s/infra/iam. Every resource
 # here sets its own explicit metadata.namespace.
 resources:
+  - admin-oidc-binding.yaml
   - grafana-operator-role.yaml
   - minio-operator-role.yaml
   - forgejo-operator-role.yaml

scripts/test-auth-e2e.sh

@@ -0,0 +1,178 @@
+#!/usr/bin/env bash
+# End-to-end auth flow tests for api-gateway.
+# Validates: JWT auth, identity headers, token exchange, error handling.
+#
+# Usage:
+#   ./scripts/test-auth-e2e.sh
+#
+# Requires: kubectl access to cluster, curl, jq
+
+set -euo pipefail
+
+API="https://api.riotpiao.com"
+TOKEN_URL="https://authentik.riotpiao.com/application/o/token/"
+PASS=0
+FAIL=0
+SKIP=0
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[0;33m'
+NC='\033[0m'
+
+check() {
+    local name="$1" expected="$2" actual="$3"
+    if [ "$expected" = "$actual" ]; then
+        echo -e "  ${GREEN}✓${NC} $name"
+        PASS=$((PASS + 1))
+    else
+        echo -e "  ${RED}✗${NC} $name (expected $expected, got $actual)"
+        FAIL=$((FAIL + 1))
+    fi
+}
+
+skip() {
+    echo -e "  ${YELLOW}○${NC} $1 (skipped: $2)"
+    SKIP=$((SKIP + 1))
+}
+
+# --- Load credentials ---
+echo "Loading credentials from cluster..."
+P_SECRET=$(kubectl get secret -n portfolio portfolio-agent-oidc -o jsonpath='{.data.CLIENT_SECRET}' | base64 -d 2>/dev/null) || true
+M_SECRET=$(kubectl get secret -n poimen memory-agent-oidc -o jsonpath='{.data.CLIENT_SECRET}' | base64 -d 2>/dev/null) || true
+
+if [ -z "$P_SECRET" ] || [ -z "$M_SECRET" ]; then
+    echo "ERROR: Cannot read service account secrets. Check kubectl context."
+    exit 1
+fi
+
+# --- Get tokens ---
+echo ""
+echo "=== Acquiring tokens ==="
+
+P_TOKEN=$(curl -s -X POST "$TOKEN_URL" \
+    -d "grant_type=client_credentials&client_id=portfolio-agent&client_secret=$P_SECRET&scope=openid roles" \
+    | jq -r '.access_token')
+
+M_TOKEN=$(curl -s -X POST "$TOKEN_URL" \
+    -d "grant_type=client_credentials&client_id=memory-agent&client_secret=$M_SECRET&scope=openid roles" \
+    | jq -r '.access_token')
+
+if [ "$P_TOKEN" = "null" ] || [ -z "$P_TOKEN" ]; then
+    echo "ERROR: Failed to get portfolio-agent token"
+    exit 1
+fi
+echo "  portfolio-agent: token acquired"
+echo "  memory-agent: token acquired"
+
+# --- Scenario 1: LLM inference ---
+echo ""
+echo "=== Scenario 1: LLM inference (llm:inference) ==="
+
+CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$API/v1/chat/completions" \
+    -H "Authorization: Bearer $P_TOKEN" -H "Content-Type: application/json" \
+    -d '{"model":"qwen2.5:3b-instruct","messages":[{"role":"user","content":"ok"}],"max_tokens":2}')
+check "portfolio-agent -> qwen chat" "200" "$CODE"
+
+CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$API/v1/chat/completions" \
+    -H "Authorization: Bearer $M_TOKEN" -H "Content-Type: application/json" \
+    -d '{"model":"reasoning","messages":[{"role":"user","content":"ok"}],"max_tokens":2}')
+check "memory-agent -> reasoning chat" "200" "$CODE"
+
+CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$API/v1/embeddings" \
+    -H "Authorization: Bearer $P_TOKEN" -H "Content-Type: application/json" \
+    -d '{"model":"nomic-ai/nomic-embed-text-v2-moe","input":"test"}')
+check "portfolio-agent -> embeddings" "200" "$CODE"
+
+CODE=$(curl -s -o /dev/null -w "%{http_code}" "$API/v1/models")
+check "GET /v1/models (no auth)" "200" "$CODE"
+
+# --- Scenario 2: Auth enforcement ---
+echo ""
+echo "=== Scenario 2: Auth enforcement ==="
+
+CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$API/v1/chat/completions" \
+    -H "Content-Type: application/json" \
+    -d '{"model":"qwen2.5:3b-instruct","messages":[{"role":"user","content":"ok"}]}')
+check "no token -> 401" "401" "$CODE"
+
+CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$API/v1/chat/completions" \
+    -H "Authorization: Bearer garbage-token" -H "Content-Type: application/json" \
+    -d '{"model":"qwen2.5:3b-instruct","messages":[{"role":"user","content":"ok"}]}')
+check "bad token -> 403" "403" "$CODE"
+
+# --- Scenario 3: Token claims ---
+echo ""
+echo "=== Scenario 3: Token claims ==="
+
+decode_jwt() { python3 -c "import base64,json,sys; p=sys.argv[1].split('.')[1]; p+='='*(4-len(p)%4); print(json.dumps(json.loads(base64.urlsafe_b64decode(p))))" "$1"; }
+
+P_CLAIMS=$(decode_jwt "$P_TOKEN")
+P_ROLES=$(echo "$P_CLAIMS" | jq -r '.roles | join(",")')
+check "portfolio-agent has llm:inference" "true" "$(echo "$P_ROLES" | grep -q 'llm:inference' && echo true || echo false)"
+check "portfolio-agent has s3:read" "true" "$(echo "$P_ROLES" | grep -q 's3:read' && echo true || echo false)"
+check "portfolio-agent has sqs:read" "true" "$(echo "$P_ROLES" | grep -q 'sqs:read' && echo true || echo false)"
+
+M_CLAIMS=$(decode_jwt "$M_TOKEN")
+M_ROLES=$(echo "$M_CLAIMS" | jq -r '.roles | join(",")')
+check "memory-agent has memory:write" "true" "$(echo "$M_ROLES" | grep -q 'memory:write' && echo true || echo false)"
+check "memory-agent has s3:write" "true" "$(echo "$M_ROLES" | grep -q 's3:write' && echo true || echo false)"
+
+# --- Scenario 4: X-Service dispatch ---
+echo ""
+echo "=== Scenario 4: X-Service dispatch ==="
+
+CODE=$(curl -s -o /dev/null -w "%{http_code}" "$API/" \
+    -H "X-Service: s3" -H "X-Resource: list-objects" \
+    -H "Authorization: Bearer $P_TOKEN")
+check "portfolio-agent -> S3 list (reaches MinIO)" "403" "$CODE"
+# 403 = MinIO reached but rejects JWT (needs SigV4). Not a gateway auth issue.
+
+# Memory service might be down
+CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 "$API/" \
+    -H "X-Service: memory" -H "X-Resource: skills" \
+    -H "Authorization: Bearer $P_TOKEN" 2>/dev/null)
+if [ "$CODE" = "200" ]; then
+    check "portfolio-agent -> memory skills" "200" "$CODE"
+elif [ "$CODE" = "502" ]; then
+    skip "portfolio-agent -> memory skills" "poimen-memory pods down"
+else
+    check "portfolio-agent -> memory skills" "200" "$CODE"
+fi
+
+# --- Scenario 5: Auth endpoints ---
+echo ""
+echo "=== Scenario 5: Auth endpoints ==="
+
+# /auth/token — may return 400 if password grant not working, but endpoint should respond
+CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$API/auth/token" \
+    -H "Content-Type: application/json" \
+    -d '{"username":"rock","password":"wrong"}')
+# Should get 400 (bad creds forwarded from Authentik) or 502 (upstream issue), not 404
+if [ "$CODE" != "404" ] && [ "$CODE" != "405" ]; then
+    check "/auth/token endpoint exists" "true" "true"
+else
+    check "/auth/token endpoint exists" "not-404" "$CODE"
+fi
+
+CODE=$(curl -s -o /dev/null -w "%{http_code}" -X GET "$API/auth/token")
+check "GET /auth/token -> 405" "405" "$CODE"
+
+CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$API/auth/refresh" \
+    -H "Content-Type: application/json" \
+    -d '{"refresh_token":"invalid"}')
+if [ "$CODE" != "404" ] && [ "$CODE" != "405" ]; then
+    check "/auth/refresh endpoint exists" "true" "true"
+else
+    check "/auth/refresh endpoint exists" "not-404" "$CODE"
+fi
+
+# --- Summary ---
+echo ""
+echo "========================================="
+TOTAL=$((PASS + FAIL + SKIP))
+echo -e "Results: ${GREEN}$PASS passed${NC}, ${RED}$FAIL failed${NC}, ${YELLOW}$SKIP skipped${NC} / $TOTAL total"
+echo "========================================="
+
+[ "$FAIL" -eq 0 ] && exit 0 || exit 1

terraform/files/coredns/Corefile

@@ -35,6 +35,7 @@
     rewrite name longhorn.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name paperless.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name img.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    rewrite name api.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
 
     kubernetes cluster.local in-addr.arpa ip6.arpa {