feat(iam): define a KeyRotation for every consumer except poimen-memory

Eight objects cover grafana, argocd, comfyui, minio, paperless, immich, forgejo and
api-gw. Each names its ZITADEL app, the Secret it writes, the consumer to roll and
whether the consumer reloads hot or needs a restart.

All are suspended: the controller image does not exist yet, and an unsuspended
object would claim an intent that no process acts on.

The README records the retirement target for the 34 .enc.yaml files: six
root-of-trust secrets that cannot rotate themselves survive, everything else
becomes a KeyRotation and leaves git.

k8s/apps/cloudflared/deployment.yaml

@@ -16,7 +16,7 @@ spec:
       # Ingress-nginx forces HTTPS (force-ssl-redirect), so cloudflared must
       # dial https://<hostname> and trust homelab-ca or the TLS handshake fails
       # with "certificate signed by unknown authority". Same pattern as
-      # authentik-values.yaml: merge the system bundle with homelab-ca.crt.
+      # iam values: merge the system bundle with homelab-ca.crt.
       initContainers:
         - name: merge-ca-certs
           image: debian:bookworm

k8s/apps/comfyui/ingress.yaml

@@ -13,9 +13,16 @@ metadata:
     # WebSocket support for ComfyUI's live preview
     nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
     nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
-    nginx.ingress.kubernetes.io/configuration-snippet: |
-      proxy_set_header Upgrade $http_upgrade;
-      proxy_set_header Connection "upgrade";
+    # Single sign-on. ComfyUI has no auth of its own, so every request is handed to
+    # oauth2-proxy for an allow or deny decision.
+    nginx.ingress.kubernetes.io/auth-url: "http://comfyui-oauth2-proxy.comfyui.svc.cluster.local:4180/oauth2/auth"
+    nginx.ingress.kubernetes.io/auth-signin: "https://comfyui.riotpiao.com/oauth2/start?rd=$scheme://$host$request_uri"
+    nginx.ingress.kubernetes.io/auth-response-headers: "x-auth-request-user,x-auth-request-email"
+    # No configuration-snippet. The controller rejects that annotation as risky
+    # ("annotation group ConfigurationSnippet contains risky annotation"), and a
+    # rejected annotation drops the WHOLE ingress from nginx.conf: the host then
+    # answers 404 with no entry in the access log. ingress-nginx sets the Upgrade
+    # and Connection headers itself for a websocket upgrade.
 spec:
   ingressClassName: nginx
   rules:

k8s/apps/comfyui/kustomization.yaml

@@ -4,4 +4,5 @@ kind: Kustomization
 resources:
   - deployment.yaml
   - service.yaml
+  - oauth2-proxy.yaml
   - ingress.yaml

k8s/apps/comfyui/oauth2-proxy.yaml

@@ -0,0 +1,105 @@
+# ComfyUI has no authentication of its own: comfyui.riotpiao.com is open to anyone
+# who can resolve the host. It also has no OIDC support, so ZITADEL cannot be a
+# login method inside it. oauth2-proxy is the front door instead: nginx asks it for
+# a decision on every request and it answers from a ZITADEL session.
+#
+# No API client calls this host today, so the whole host is gated. If a client ever
+# needs direct access, add a skip rule for the exact paths it uses rather than
+# opening the whole host.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: comfyui-oauth2-proxy
+  namespace: comfyui
+  labels:
+    app: comfyui-oauth2-proxy
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: comfyui-oauth2-proxy
+  template:
+    metadata:
+      labels:
+        app: comfyui-oauth2-proxy
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile: {type: RuntimeDefault}
+      containers:
+        - name: oauth2-proxy
+          image: quay.io/oauth2-proxy/oauth2-proxy:v7.7.1
+          args:
+            - --provider=oidc
+            - --oidc-issuer-url=https://zitadel.riotpiao.com
+            - --email-domain=*
+            - --upstream=static://202
+            - --reverse-proxy=true
+            - --set-xauthrequest=true
+            - --cookie-secure=true
+            - --cookie-expire=12h
+            - --cookie-refresh=1h
+            - --skip-provider-button=true
+            - --redirect-url=https://comfyui.riotpiao.com/oauth2/callback
+            - --http-address=0.0.0.0:4180
+          env:
+            - name: OAUTH2_PROXY_CLIENT_ID
+              valueFrom: {secretKeyRef: {name: comfyui-oauth2-proxy, key: client-id}}
+            - name: OAUTH2_PROXY_CLIENT_SECRET
+              valueFrom: {secretKeyRef: {name: comfyui-oauth2-proxy, key: client-secret}}
+            - name: OAUTH2_PROXY_COOKIE_SECRET
+              valueFrom: {secretKeyRef: {name: comfyui-oauth2-proxy, key: cookie-secret}}
+          ports:
+            - {name: http, containerPort: 4180}
+          readinessProbe:
+            httpGet: {path: /ping, port: http}
+            initialDelaySeconds: 5
+          livenessProbe:
+            httpGet: {path: /ping, port: http}
+            initialDelaySeconds: 15
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities: {drop: ["ALL"]}
+          resources:
+            requests: {cpu: 10m, memory: 32Mi}
+            limits: {cpu: 200m, memory: 128Mi}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: comfyui-oauth2-proxy
+  namespace: comfyui
+  labels:
+    app: comfyui-oauth2-proxy
+spec:
+  type: ClusterIP
+  selector:
+    app: comfyui-oauth2-proxy
+  ports:
+    - {name: http, port: 4180, targetPort: http}
+---
+# The login path must NOT be gated: a request to /oauth2/start that itself demands a
+# login redirects to /oauth2/start forever. ingress-nginx applies the annotations of
+# an ingress to the locations it defines, so a separate object without auth-url keeps
+# this path open. The earlier failure of this shape was not the split — it was the
+# configuration-snippet on the app ingress, which made the controller drop the whole
+# object and left only this one alive.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: comfyui-oauth2
+  namespace: comfyui
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: comfyui.riotpiao.com
+      http:
+        paths:
+          - path: /oauth2
+            pathType: Prefix
+            backend:
+              service:
+                name: comfyui-oauth2-proxy
+                port:
+                  number: 4180

k8s/apps/gotify/bridge/configmap.yaml

@@ -0,0 +1,110 @@
+# The bridge script is mounted as a ConfigMap so no image build is needed.
+# Regenerate this block from grafana_gotify_bridge.py when the script changes.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: grafana-gotify-bridge
+  namespace: notifications
+data:
+  grafana_gotify_bridge.py: |
+    #!/usr/bin/env python3
+    """Translate a Grafana alert webhook into a Gotify message.
+    
+    Grafana sends its own payload shape:
+      {"receiver": "...", "status": "firing", "alerts": [{"labels": {...}, "annotations": {...}}]}
+    
+    Gotify requires:
+      {"title": "...", "message": "...", "priority": 0..10}
+    
+    Gotify answers 400 "Field 'message' is required" to a Grafana payload, so a
+    conversion step is mandatory. This service is that step and nothing else.
+    Standard library only, so it needs no image build and no dependencies.
+    """
+    import json
+    import os
+    import urllib.request
+    from http.server import BaseHTTPRequestHandler, HTTPServer
+    
+    GOTIFY_BASE = os.environ.get("GOTIFY_URL", "http://gotify.notifications.svc.cluster.local")
+    GOTIFY_TOKEN = os.environ["GOTIFY_TOKEN"]
+    LISTEN_PORT = int(os.environ.get("PORT", "8080"))
+    
+    # Firing is louder than resolved. Gotify priority runs 0 to 10.
+    PRIORITY = {"firing": 8, "resolved": 3}
+    
+    
+    def to_gotify(payload):
+        alerts = payload.get("alerts") or []
+        status = (payload.get("status") or "firing").lower()
+        priority = PRIORITY.get(status, 5)
+    
+        if not alerts:
+            title = payload.get("title") or "Grafana notification"
+            return title, json.dumps(payload)[:2000], priority
+    
+        first = alerts[0]
+        labels = first.get("labels") or {}
+        annotations = first.get("annotations") or {}
+        name = labels.get("alertname", "Grafana alert")
+    
+        title = "[%s] %s" % (status.upper(), name)
+        lines = []
+        summary = annotations.get("summary") or annotations.get("description")
+        if summary:
+            lines.append(summary)
+        for key in ("severity", "namespace", "pod", "instance", "job"):
+            if labels.get(key):
+                lines.append("%s: %s" % (key, labels[key]))
+        if len(alerts) > 1:
+            lines.append("+%d more alert(s) in this notification" % (len(alerts) - 1))
+    
+        return title, "\n".join(lines) or name, priority
+    
+    
+    class Handler(BaseHTTPRequestHandler):
+        def _reply(self, code, body=b"ok"):
+            self.send_response(code)
+            self.send_header("Content-Type", "text/plain")
+            self.end_headers()
+            self.wfile.write(body)
+    
+        def do_GET(self):
+            self._reply(200)
+    
+        def do_POST(self):
+            length = int(self.headers.get("Content-Length") or 0)
+            raw = self.rfile.read(length) if length else b"{}"
+            try:
+                payload = json.loads(raw.decode("utf-8", "replace") or "{}")
+            except ValueError:
+                payload = {}
+    
+            title, message, priority = to_gotify(payload)
+            body = json.dumps({
+                "title": title[:200],
+                "message": message[:4000],
+                "priority": priority,
+            }).encode()
+    
+            request = urllib.request.Request(
+                GOTIFY_BASE.rstrip("/") + "/message",
+                data=body,
+                headers={"Content-Type": "application/json", "X-Gotify-Key": GOTIFY_TOKEN},
+            )
+            try:
+                urllib.request.urlopen(request, timeout=10).read()
+            except Exception as exc:  # noqa: BLE001 - log and report to Grafana
+                print("forward to gotify failed: %s" % exc, flush=True)
+                self._reply(502, b"gotify rejected the message")
+                return
+    
+            print("forwarded: %s" % title, flush=True)
+            self._reply(200)
+    
+        def log_message(self, fmt, *args):  # keep the log to one line per delivery
+            print("%s - %s" % (self.address_string(), fmt % args), flush=True)
+    
+    
+    if __name__ == "__main__":
+        print("grafana-gotify bridge listening on %d" % LISTEN_PORT, flush=True)
+        HTTPServer(("0.0.0.0", LISTEN_PORT), Handler).serve_forever()

k8s/apps/gotify/bridge/deployment.yaml

@@ -0,0 +1,80 @@
+# Grafana sends its own JSON and Gotify rejects it, so this Deployment is the
+# translation step between them. Grafana posts to the Service, the bridge posts
+# to /message with the app token from a SOPS secret.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: grafana-gotify-bridge
+  namespace: notifications
+  labels:
+    app: grafana-gotify-bridge
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: grafana-gotify-bridge
+  template:
+    metadata:
+      labels:
+        app: grafana-gotify-bridge
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: bridge
+          image: python:3.12-alpine
+          command: ["python3", "/app/grafana_gotify_bridge.py"]
+          env:
+            - name: GOTIFY_URL
+              value: "http://gotify.notifications.svc.cluster.local"
+            - name: PORT
+              value: "8080"
+            - name: GOTIFY_TOKEN
+              valueFrom:
+                secretKeyRef: {name: grafana-gotify-bridge, key: app-token}
+          ports:
+            - name: http
+              containerPort: 8080
+          readinessProbe:
+            httpGet: {path: /, port: http}
+            initialDelaySeconds: 3
+            periodSeconds: 10
+          livenessProbe:
+            httpGet: {path: /, port: http}
+            initialDelaySeconds: 10
+            periodSeconds: 20
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: script
+              mountPath: /app
+              readOnly: true
+          resources:
+            requests: {cpu: 10m, memory: 32Mi}
+            limits: {cpu: 200m, memory: 96Mi}
+      volumes:
+        - name: script
+          configMap:
+            name: grafana-gotify-bridge
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: grafana-gotify-bridge
+  namespace: notifications
+  labels:
+    app: grafana-gotify-bridge
+spec:
+  type: ClusterIP
+  selector:
+    app: grafana-gotify-bridge
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http

k8s/apps/gotify/bridge/grafana_gotify_bridge.py

@@ -0,0 +1,101 @@
+#!/usr/bin/env python3
+"""Translate a Grafana alert webhook into a Gotify message.
+
+Grafana sends its own payload shape:
+  {"receiver": "...", "status": "firing", "alerts": [{"labels": {...}, "annotations": {...}}]}
+
+Gotify requires:
+  {"title": "...", "message": "...", "priority": 0..10}
+
+Gotify answers 400 "Field 'message' is required" to a Grafana payload, so a
+conversion step is mandatory. This service is that step and nothing else.
+Standard library only, so it needs no image build and no dependencies.
+"""
+import json
+import os
+import urllib.request
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+GOTIFY_BASE = os.environ.get("GOTIFY_URL", "http://gotify.notifications.svc.cluster.local")
+GOTIFY_TOKEN = os.environ["GOTIFY_TOKEN"]
+LISTEN_PORT = int(os.environ.get("PORT", "8080"))
+
+# Firing is louder than resolved. Gotify priority runs 0 to 10.
+PRIORITY = {"firing": 8, "resolved": 3}
+
+
+def to_gotify(payload):
+    alerts = payload.get("alerts") or []
+    status = (payload.get("status") or "firing").lower()
+    priority = PRIORITY.get(status, 5)
+
+    if not alerts:
+        title = payload.get("title") or "Grafana notification"
+        return title, json.dumps(payload)[:2000], priority
+
+    first = alerts[0]
+    labels = first.get("labels") or {}
+    annotations = first.get("annotations") or {}
+    name = labels.get("alertname", "Grafana alert")
+
+    title = "[%s] %s" % (status.upper(), name)
+    lines = []
+    summary = annotations.get("summary") or annotations.get("description")
+    if summary:
+        lines.append(summary)
+    for key in ("severity", "namespace", "pod", "instance", "job"):
+        if labels.get(key):
+            lines.append("%s: %s" % (key, labels[key]))
+    if len(alerts) > 1:
+        lines.append("+%d more alert(s) in this notification" % (len(alerts) - 1))
+
+    return title, "\n".join(lines) or name, priority
+
+
+class Handler(BaseHTTPRequestHandler):
+    def _reply(self, code, body=b"ok"):
+        self.send_response(code)
+        self.send_header("Content-Type", "text/plain")
+        self.end_headers()
+        self.wfile.write(body)
+
+    def do_GET(self):
+        self._reply(200)
+
+    def do_POST(self):
+        length = int(self.headers.get("Content-Length") or 0)
+        raw = self.rfile.read(length) if length else b"{}"
+        try:
+            payload = json.loads(raw.decode("utf-8", "replace") or "{}")
+        except ValueError:
+            payload = {}
+
+        title, message, priority = to_gotify(payload)
+        body = json.dumps({
+            "title": title[:200],
+            "message": message[:4000],
+            "priority": priority,
+        }).encode()
+
+        request = urllib.request.Request(
+            GOTIFY_BASE.rstrip("/") + "/message",
+            data=body,
+            headers={"Content-Type": "application/json", "X-Gotify-Key": GOTIFY_TOKEN},
+        )
+        try:
+            urllib.request.urlopen(request, timeout=10).read()
+        except Exception as exc:  # noqa: BLE001 - log and report to Grafana
+            print("forward to gotify failed: %s" % exc, flush=True)
+            self._reply(502, b"gotify rejected the message")
+            return
+
+        print("forwarded: %s" % title, flush=True)
+        self._reply(200)
+
+    def log_message(self, fmt, *args):  # keep the log to one line per delivery
+        print("%s - %s" % (self.address_string(), fmt % args), flush=True)
+
+
+if __name__ == "__main__":
+    print("grafana-gotify bridge listening on %d" % LISTEN_PORT, flush=True)
+    HTTPServer(("0.0.0.0", LISTEN_PORT), Handler).serve_forever()

k8s/apps/gotify/igotify-deployment.yaml

@@ -28,9 +28,17 @@ spec:
               value: "true"
             - name: ENABLE_SCALAR_UI
               value: "true"
-            # GOTIFY_URLS / GOTIFY_CLIENT_TOKENS / SECNTFY_TOKENS intentionally
-            # left unset — not required when Gotify is reachable via public domain
-            # (gotify.riotpiao.com). iGotify iOS app registers itself at runtime.
+            # The bridge authenticates with a Gotify client token, not with
+            # ZITADEL. Gotify has no way to accept a forwarded identity, so the
+            # token is the only credential that works server-side. The token
+            # belongs to user `rock`, never expires, and is revoked by deleting
+            # the client row in Gotify.
+            - name: GOTIFY_URLS
+              value: "https://gotify.riotpiao.com"
+            - name: GOTIFY_CLIENT_TOKENS
+              valueFrom:
+                secretKeyRef: {name: igotify-client-token, key: client-token}
+            # SECNTFY_TOKENS intentionally left unset: secntfy is not deployed.
           volumeMounts:
             - name: data
               mountPath: /app/data

k8s/apps/gotify/kustomization.yaml

@@ -6,6 +6,8 @@ resources:
   - deployment.yaml
   - service.yaml
   - ingress.yaml
+  - bridge/configmap.yaml
+  - bridge/deployment.yaml
   - igotify-pvc.yaml
   - igotify-deployment.yaml
   - igotify-service.yaml

k8s/apps/homarr/homarr-values.yaml

@@ -1,78 +0,0 @@
-# Homarr landing page with Authentik SSO
-
-# Probe tuning (chart DOES expose these — the old PostSync patch-job was
-# unnecessary and fragile: it only patched one Deployment revision, so any later
-# rollout reverted to the chart's aggressive defaults). Homarr's first-boot icon
-# updater blocks the event loop for ~50s ("icons updater took 49553ms"), during
-# which /api/health/live can't answer within the default 10s×3 window → kubelet
-# SIGTERMs the pod → CrashLoopBackOff (247 restarts, 503 at the ingress). Give
-# liveness a wide window so the icon import can finish without a kill.
-livenessProbe:
-  initialDelaySeconds: 60
-  periodSeconds: 30
-  timeoutSeconds: 5
-  failureThreshold: 10
-readinessProbe:
-  initialDelaySeconds: 30
-  periodSeconds: 15
-  timeoutSeconds: 5
-  failureThreshold: 6
-
-image:
-  repository: ghcr.io/homarr-labs/homarr
-  tag: "latest"
-  pullPolicy: Always
-
-replicaCount: 1
-
-# Configure SSO via environment variables
-# Chart supports these via top-level env dict (not array)
-env:
-  AUTH_PROVIDERS: "oidc,credentials"
-  AUTH_OIDC_ISSUER: "https://zitadel.riotpiao.com"
-  # AUTH_OIDC_URI (authorize endpoint) is REQUIRED in addition to ISSUER — homarr
-  # hides the "Sign in with Authentik" button entirely when it's absent (per the
-  # authentik Homarr integration + homarr SSO docs). This was the missing var.
-  AUTH_OIDC_URI: "https://zitadel.riotpiao.com/oauth/v2/authorize"
-  AUTH_OIDC_CLIENT_NAME: "Zitadel"
-  AUTH_OIDC_GROUPS_ATTRIBUTE: "groups"
-  AUTH_OIDC_SCOPE_OVERWRITE: "openid email profile groups"
-  AUTH_OIDC_AUTO_LOGIN: "false"
-  # Link the OIDC identity to an existing homarr account with the same email.
-  OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING: "true"
-  # The analytics cron blocked the (single-threaded) Next.js event loop for ~16s
-  # per run ("callback took longer than expected"), compounding CPU pressure.
-  DISABLE_ANALYTICS: "true"
-  BASE_URL: "https://homarr.riotpiao.com"
-  NEXTAUTH_URL: "https://homarr.riotpiao.com"
-
-# Client credentials from homarr-oidc secret
-# Chart doesn't support envFrom, so we add via extraEnv
-extraEnv:
-  - name: AUTH_OIDC_CLIENT_ID
-    valueFrom:
-      secretKeyRef:
-        name: homarr-oidc
-        key: client-id
-  - name: AUTH_OIDC_CLIENT_SECRET
-    valueFrom:
-      secretKeyRef:
-        name: homarr-oidc
-        key: client-secret
-
-tolerations:
-  - key: node-role.kubernetes.io/control-plane
-    operator: Exists
-    effect: NoSchedule
-
-resources:
-  requests:
-    cpu: 250m
-    memory: 384Mi
-  limits:
-    # Next.js 16 + bundled redis + the icon-updater (28k icons) saturated the old
-    # 500m limit; CPU throttling made Next.js abort with exit 134 (SIGABRT) and
-    # self-restart in a loop, so nginx saw no upstream and returned 502. Give it
-    # real CPU headroom.
-    cpu: "2"
-    memory: 1Gi

k8s/apps/homarr/kustomization.yaml

@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: dashboard
-# Probes are now tuned via homarr-values.yaml (chart-native); the old
-# fix-probes-job PostSync hook is removed. homarr-secrets/auth-oidc/db-encryption
-# Secrets are delivered by the sops-secrets (ksops) Application.
-resources: []

k8s/apps/key-rotation-controller/README.md

@@ -0,0 +1,50 @@
+# Credential rotation
+
+One `KeyRotation` object describes one credential. The controller creates the value,
+writes the Secret, proves the new value works, then retires the old one.
+
+## Why the state order is the safety property
+
+```
+Prepare -> Publish -> Verify -> Retire
+```
+
+`Retire` runs only for a provider whose old credential still works after the publish
+step, and only after `Verify` passes. A failure before that point leaves the working
+credential untouched. The hand-run rotation that broke Grafana did the opposite: it
+regenerated the secret and never re-pointed the consumer.
+
+## Two strategies, decided by the provider, not by preference
+
+| Provider | Overlap in ZITADEL | Strategy | Retire |
+|---|---|---|---|
+| `zitadel-machine-key` | many keys per service user | `overlap` | after the new key obtains a token |
+| `zitadel-oidc-client` | one secret per app | `atomic` | nothing to retire |
+
+## The single master credential
+
+The controller authenticates with one machine key, mounted from Secret
+`iam/key-rotation-controller`. That key is the only credential the cluster cannot
+rotate by itself, so it is the only one that stays encrypted in git.
+
+Every other credential is created by the controller, which means the 34 `.enc.yaml`
+files under `k8s/argocd/secrets/` are migration debt, not a design. The retirement
+target is one root-of-trust file per thing that cannot rotate itself:
+
+| Survives (root of trust) | Why it cannot rotate |
+|---|---|
+| ZITADEL instance masterkey | encrypts the whole ZITADEL database |
+| Vault unseal keys | unsealing needs a human-held key |
+| Talos repair config | recovery path, must work when the cluster does not |
+| homelab CA | signs the wildcard certificate |
+| controller bootstrap key | chicken and egg: it creates every other key |
+| etcd defrag credentials | needed by a job that runs outside the controller |
+
+Everything else — Grafana, Argo CD, Forgejo, MinIO, Paperless, Immich, ComfyUI,
+api-gw, Gotify — is a KeyRotation object, and its secret leaves git.
+
+## Status
+
+The CRD is installed. Eight `KeyRotation` objects exist for the consumers above and
+all are `suspend: true`: the controller image does not exist yet, so no process acts
+on them. poimen-memory is excluded from this migration on purpose.

k8s/apps/key-rotation-controller/controller/api/types.go

@@ -0,0 +1,254 @@
+// Package api declares the KeyRotation custom resource.
+//
+// One resource describes one credential and how to rotate it. The controller
+// never stores the credential in git: it writes a Kubernetes Secret and records
+// only the credential's identifier in status.
+package api
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// Group is the API group for homelab platform resources.
+const Group = "iam.homelab.riotpiao.com"
+
+// Version is the served version.
+const Version = "v1"
+
+// Provider names. Each provider uses one external API to create and retire
+// credentials, and each declares whether a rotation can overlap.
+const (
+	// ProviderZitadelMachineKey creates a machine key while the previous key
+	// stays valid. True zero downtime.
+	ProviderZitadelMachineKey = "zitadel-machine-key"
+	// ProviderZitadelOIDCClient regenerates an app client secret. ZITADEL keeps
+	// one secret per app, so the old one dies the moment the new one exists.
+	ProviderZitadelOIDCClient = "zitadel-oidc-client"
+)
+
+// Strategy names.
+const (
+	// StrategyOverlap keeps the old credential valid until the new one is proven.
+	StrategyOverlap = "overlap"
+	// StrategyAtomic replaces the credential in place. A short window exists.
+	StrategyAtomic = "atomic"
+)
+
+// Reload names tell the controller how the consumer picks up a new value.
+const (
+	// ReloadHot means the consumer watches the mounted file.
+	ReloadHot = "hot"
+	// ReloadRestart means the consumer reads the value at start, so it must roll.
+	ReloadRestart = "restart"
+)
+
+// Phase names for status.
+const (
+	PhasePending      = "Pending"
+	PhasePreparing    = "Preparing"
+	PhasePropagating  = "Propagating"
+	PhaseVerifying    = "Verifying"
+	PhaseCompleting   = "Completing"
+	PhaseSucceeded    = "Succeeded"
+	PhaseFailed       = "Failed"
+	PhaseSuspended    = "Suspended"
+)
+
+// ConsumerRef names a workload that reads the rotated credential.
+type ConsumerRef struct {
+	// Kind is Deployment or StatefulSet.
+	Kind string `json:"kind"`
+	// Name is the workload name.
+	Name string `json:"name"`
+	// Namespace is where the workload runs.
+	Namespace string `json:"namespace"`
+}
+
+// RotationTarget is the credential's source and destination.
+type RotationTarget struct {
+	// ZitadelProjectID is the project that owns the app or service user.
+	ZitadelProjectID string `json:"zitadelProjectID,omitempty"`
+	// ZitadelAppID is the OIDC app id, for the client-secret provider.
+	ZitadelAppID string `json:"zitadelAppID,omitempty"`
+	// MachineUserID is the service user id, for the machine-key provider.
+	MachineUserID string `json:"machineUserID,omitempty"`
+	// SecretName is the Secret the controller writes.
+	SecretName string `json:"secretName"`
+	// SecretNamespace is where that Secret lives.
+	SecretNamespace string `json:"secretNamespace"`
+	// SecretKeys maps a logical field name to the Secret key that holds it.
+	// For a machine key: key -> key, key-id -> key-id.
+	SecretKeys map[string]string `json:"secretKeys,omitempty"`
+	// Consumers are the workloads that must pick the new value up.
+	Consumers []ConsumerRef `json:"consumers,omitempty"`
+	// Reload is hot or restart. Empty means restart, the safe default.
+	Reload string `json:"reload,omitempty"`
+}
+
+// VerifySpec is the proof the controller demands before it retires the old
+// credential.
+type VerifySpec struct {
+	// Introspect checks client_id and client_secret against the introspection
+	// endpoint.
+	Introspect bool `json:"introspect,omitempty"`
+	// TokenExchange exchanges a token with the new machine key.
+	TokenExchange bool `json:"tokenExchange,omitempty"`
+	// AudienceProject, when set, is added to the token request as
+	// urn:zitadel:iam:org:project:id:<id>:aud.
+	AudienceProject string `json:"audienceProject,omitempty"`
+}
+
+// KeyRotationSpec is the desired state.
+type KeyRotationSpec struct {
+	// Provider selects the external API.
+	Provider string `json:"provider"`
+	// Strategy is overlap or atomic.
+	Strategy string `json:"strategy"`
+	// IntervalHours is how often to rotate. Minimum 24.
+	IntervalHours int32 `json:"intervalHours"`
+	// Suspend stops automatic rotation without deleting the resource.
+	Suspend bool `json:"suspend,omitempty"`
+	// Target names the credential and its consumers.
+	Target RotationTarget `json:"target"`
+	// Verify names the checks that must pass.
+	Verify VerifySpec `json:"verify,omitempty"`
+}
+
+// KeyRotationStatus is the observed state.
+type KeyRotationStatus struct {
+	Phase              string             `json:"phase,omitempty"`
+	ObservedGeneration int64              `json:"observedGeneration,omitempty"`
+	LastRotation       *metav1.Time       `json:"lastRotation,omitempty"`
+	NextRotation       *metav1.Time       `json:"nextRotation,omitempty"`
+	ActiveCredentialID string             `json:"activeCredentialID,omitempty"`
+	PreviousCredentialID string           `json:"previousCredentialID,omitempty"`
+	LastError          string             `json:"lastError,omitempty"`
+	Conditions         []metav1.Condition `json:"conditions,omitempty"`
+}
+
+// KeyRotation is one credential under management.
+type KeyRotation struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   KeyRotationSpec   `json:"spec,omitempty"`
+	Status KeyRotationStatus `json:"status,omitempty"`
+}
+
+// KeyRotationList is a list of KeyRotation.
+type KeyRotationList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []KeyRotation `json:"items"`
+}
+
+// SchemeGroupVersion is the group and version for this type.
+var SchemeGroupVersion = schema.GroupVersion{Group: Group, Version: Version}
+
+// SchemeBuilder registers the types with a scheme.
+var SchemeBuilder = runtime.NewSchemeBuilder(func(s *runtime.Scheme) error {
+	s.AddKnownTypes(SchemeGroupVersion, &KeyRotation{}, &KeyRotationList{})
+	metav1.AddToGroupVersion(s, SchemeGroupVersion)
+	return nil
+})
+
+// AddToScheme registers this package's types.
+var AddToScheme = SchemeBuilder.AddToScheme
+
+// DeepCopyInto copies the receiver into out.
+func (in *KeyRotation) DeepCopyInto(out *KeyRotation) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy makes a deep copy.
+func (in *KeyRotation) DeepCopy() *KeyRotation {
+	if in == nil {
+		return nil
+	}
+	out := new(KeyRotation)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject satisfies runtime.Object.
+func (in *KeyRotation) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto copies the receiver into out.
+func (in *KeyRotationSpec) DeepCopyInto(out *KeyRotationSpec) {
+	*out = *in
+	in.Target.DeepCopyInto(&out.Target)
+}
+
+// DeepCopyInto copies the receiver into out.
+func (in *RotationTarget) DeepCopyInto(out *RotationTarget) {
+	*out = *in
+	if in.SecretKeys != nil {
+		out.SecretKeys = make(map[string]string, len(in.SecretKeys))
+		for k, v := range in.SecretKeys {
+			out.SecretKeys[k] = v
+		}
+	}
+	if in.Consumers != nil {
+		out.Consumers = make([]ConsumerRef, len(in.Consumers))
+		copy(out.Consumers, in.Consumers)
+	}
+}
+
+// DeepCopyInto copies the receiver into out.
+func (in *KeyRotationStatus) DeepCopyInto(out *KeyRotationStatus) {
+	*out = *in
+	if in.LastRotation != nil {
+		t := *in.LastRotation
+		out.LastRotation = &t
+	}
+	if in.NextRotation != nil {
+		t := *in.NextRotation
+		out.NextRotation = &t
+	}
+	if in.Conditions != nil {
+		out.Conditions = make([]metav1.Condition, len(in.Conditions))
+		copy(out.Conditions, in.Conditions)
+	}
+}
+
+// DeepCopyInto copies the receiver into out.
+func (in *KeyRotationList) DeepCopyInto(out *KeyRotationList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		out.Items = make([]KeyRotation, len(in.Items))
+		for i := range in.Items {
+			in.Items[i].DeepCopyInto(&out.Items[i])
+		}
+	}
+}
+
+// DeepCopy makes a deep copy.
+func (in *KeyRotationList) DeepCopy() *KeyRotationList {
+	if in == nil {
+		return nil
+	}
+	out := new(KeyRotationList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject satisfies runtime.Object.
+func (in *KeyRotationList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}

k8s/apps/key-rotation-controller/controller/go.mod

@@ -0,0 +1,71 @@
+module github.com/riotpiao/key-rotation-controller
+
+go 1.26.0
+
+require (
+	k8s.io/api v0.37.1
+	k8s.io/apimachinery v0.37.1
+	k8s.io/client-go v0.37.0
+	sigs.k8s.io/controller-runtime v0.25.2
+)
+
+require (
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
+	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/zapr v1.3.0 // indirect
+	github.com/go-openapi/jsonpointer v1.0.0 // indirect
+	github.com/go-openapi/jsonreference v1.0.0 // indirect
+	github.com/go-openapi/swag v0.27.1 // indirect
+	github.com/go-openapi/swag/cmdutils v0.27.1 // indirect
+	github.com/go-openapi/swag/conv v0.27.1 // indirect
+	github.com/go-openapi/swag/fileutils v0.27.1 // indirect
+	github.com/go-openapi/swag/jsonutils v0.27.1 // indirect
+	github.com/go-openapi/swag/loading v0.27.1 // indirect
+	github.com/go-openapi/swag/mangling v0.27.1 // indirect
+	github.com/go-openapi/swag/netutils v0.27.1 // indirect
+	github.com/go-openapi/swag/pools v0.27.1 // indirect
+	github.com/go-openapi/swag/stringutils v0.27.1 // indirect
+	github.com/go-openapi/swag/typeutils v0.27.1 // indirect
+	github.com/go-openapi/swag/yamlutils v0.27.1 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/prometheus/client_golang v1.24.0 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.70.0 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go.uber.org/zap v1.27.1 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/net v0.57.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/term v0.45.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
+	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
+	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	k8s.io/apiextensions-apiserver v0.37.0 // indirect
+	k8s.io/klog/v2 v2.140.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect
+	k8s.io/utils v0.0.0-20260626114624-be93311217bd // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
+)

k8s/apps/key-rotation-controller/controller/go.sum

@@ -0,0 +1,133 @@
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
+github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=
+github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
+github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
+github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
+github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s=
+github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y=
+github.com/go-openapi/jsonreference v1.0.0 h1:jlmTr6torcd1YgDQvSfNmRtKzYDO4FGBkrAdlAVWnpY=
+github.com/go-openapi/jsonreference v1.0.0/go.mod h1:jtwdyGbJk0Xhe5Y+rwtglQP6Sb1WZST4rT32LWB+sv0=
+github.com/go-openapi/swag v0.27.1 h1:VotvOLWW8q/EAxB0YdsBBGC8XYyeL1YwBj2ungAGPNg=
+github.com/go-openapi/swag v0.27.1/go.mod h1:GTkJPwHfhJp6MWr4/rCh64HVI3Ofu+tcsbfjfHmTxpE=
+github.com/go-openapi/swag/cmdutils v0.27.1 h1:I7sYqaWVl5mq0NEmNQkAmFDyNin9ufvMX/p2zwtQaOE=
+github.com/go-openapi/swag/cmdutils v0.27.1/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM=
+github.com/go-openapi/swag/conv v0.27.1 h1:8wi9ZG+olmY1wXphl93EWniPtbSPkXM/feH7FgjsvrU=
+github.com/go-openapi/swag/conv v0.27.1/go.mod h1:QbqMivkpKhC3g1B1GGGOJ6ANewI3S62dbzYu3Duowqs=
+github.com/go-openapi/swag/fileutils v0.27.1 h1:QQqBSoi5mW4XpU85nS0mLcA+zAE6vLzrb0QkmLKf9oM=
+github.com/go-openapi/swag/fileutils v0.27.1/go.mod h1:VvJFZLTZS0AI854gEQz5tk7dBESdLjiNUMSZ/th2ry8=
+github.com/go-openapi/swag/jsonutils v0.27.1 h1:SVgK3i4USzCU5mibOOS/l4ea2h9UQXy7J7RNLTjuXjU=
+github.com/go-openapi/swag/jsonutils v0.27.1/go.mod h1:tdlEpZqdcQ17uj6J4YdK9vd8It5qWMwjWXOs0tjpRlk=
+github.com/go-openapi/swag/loading v0.27.1 h1:/DxUgDXKbBX4bcn7r9uEXfJyzN5XpiJmZplzQTjrRCY=
+github.com/go-openapi/swag/loading v0.27.1/go.mod h1:jvGh3iA2+zyUUycB5fgJWzeHnhrpvGnJJM0RVE9ZShE=
+github.com/go-openapi/swag/mangling v0.27.1 h1:yC9D0HyUE8gbP+BfmGx9+AA89ikwZTMjESK3OnnoaqA=
+github.com/go-openapi/swag/mangling v0.27.1/go.mod h1:jtBE2+V+3pILxOR7Vgce+Cwp6A2PgZbvVqfNntbVs0w=
+github.com/go-openapi/swag/netutils v0.27.1 h1:mICMFoS82F5TZ4Zy3cqmcQk+BFeCp3Uyq3Np7GI0/qU=
+github.com/go-openapi/swag/netutils v0.27.1/go.mod h1:J+WYyFMLtvtCGqa6jLv+YNUmIKI3ZRQRrvfNDMoQoEQ=
+github.com/go-openapi/swag/pools v0.27.1 h1:9LeadcMyb2GJCbXX5hVQDbZ2Lq9TL4dCs/nx1j5DO0E=
+github.com/go-openapi/swag/pools v0.27.1/go.mod h1:kVQefhSK5RWuRe7BXsL8htgBPAMpN7HDGpGEknqugeE=
+github.com/go-openapi/swag/stringutils v0.27.1 h1:ZXePZ0r2p1qSjo8tD3Un4vFj8+FqlCkczxDrJIhYUp8=
+github.com/go-openapi/swag/stringutils v0.27.1/go.mod h1:lzRN95CxXmA03XcDWHLOb6nOMcxCqR5rGY0lOgsfRoM=
+github.com/go-openapi/swag/typeutils v0.27.1 h1:KSTdFlfnse4r6dP9IrEnwMldjE+zs71UeEB3//PtVXc=
+github.com/go-openapi/swag/typeutils v0.27.1/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ=
+github.com/go-openapi/swag/yamlutils v0.27.1 h1:ftxv6xvXb1E3zohUc+okZ9nSqNb9StQX/FXnKZ98sQA=
+github.com/go-openapi/swag/yamlutils v0.27.1/go.mod h1:bnxFIB1qewGRiZHypXGZ3fNgf13/0HfRgnS/iZBDrOo=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v1.24.0 h1:5XStIklKuAtJSNpdD3s8XJj/Yv78IQmE1kbNk87JrAI=
+github.com/prometheus/client_golang v1.24.0/go.mod h1:QcsNdotprC2nS4BTM2ucbcqxd2CeXTEa9jW7zHO9iDE=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.70.0 h1:bcpru3tWPVnxGnETLgOV5jbp/JRXgYEyv65CuBLAMMI=
+github.com/prometheus/common v0.70.0/go.mod h1:S/SFasQmgGiYH6C81LKCtYa8QACgthGg5zxL2udV7SY=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
+go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw=
+gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
+gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+k8s.io/api v0.37.1 h1:l6N77U7tjwB5L056bgrBTJIEdevac/naBZ3iSvDNfpM=
+k8s.io/api v0.37.1/go.mod h1:zSlbB1YpJ1YQlFVQy20UYll81UJSJJUMLhkhvg6Z78M=
+k8s.io/apiextensions-apiserver v0.37.0 h1:zRMQ3+/LIE5oZ0tVvXwYHC+dIkSP5cjNWju7AZU1LOI=
+k8s.io/apiextensions-apiserver v0.37.0/go.mod h1:HU0PfSBwchHL5iDau6jjt9zU6ryWkDDlaVUiq91NK80=
+k8s.io/apimachinery v0.37.1 h1:hGCYyvKHCwtwMitj2vU4vYx0Z16N9GyZk9BBnz0wDAE=
+k8s.io/apimachinery v0.37.1/go.mod h1:jF84AyUi/IRIXRot5f+lm6MpxoWI+F1XgjaMmwCdTFw=
+k8s.io/client-go v0.37.0 h1:nsN31fy8wBySuZ+QRnKmrjRSQLOG2rvoGN0tKd12zhQ=
+k8s.io/client-go v0.37.0/go.mod h1:FcGqw+Ll/gNQiq+nPGY1Oyt9y7SgDh1d3MW3RFDEbn0=
+k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
+k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd h1:Ea7fgQ5we8Y9T0OX5o0dAHzQOBRI07D/dEYRaB9ZZEs=
+k8s.io/utils v0.0.0-20260626114624-be93311217bd/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
+sigs.k8s.io/controller-runtime v0.25.2 h1:bEkK3PVOIVK9X8QWLGVhJgmFc++47vfT6wakSzAOLsQ=
+sigs.k8s.io/controller-runtime v0.25.2/go.mod h1:4QqLdT6z/L6Olj8JJCtvztid4/fnIiYsfaTFScegctc=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2 h1:qdOxHwrl2Kaag1aQEarlYcOA9vSyGCp3CIki3aW8c4Q=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=

k8s/apps/key-rotation-controller/controller/internal/reconcile/providers.go

@@ -0,0 +1,168 @@
+package reconcile
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+
+	iamv1 "github.com/riotpiao/key-rotation-controller/api"
+	"github.com/riotpiao/key-rotation-controller/internal/zitadel"
+)
+
+// MachineKeyProvider rotates a service user's private key.
+//
+// ZITADEL keeps many keys per service user, and each assertion names its key with
+// `kid`. A new key can be created while the deployed key stays valid, so this
+// provider retires the old key only after the new one proves itself. Nothing in
+// the window is invalid.
+type MachineKeyProvider struct {
+	// Client talks to the instance that owns the service user.
+	Client *zitadel.Client
+	// AuthClientID is the API app the controller authenticates as.
+	AuthClientID string
+	// KeyIDFile and KeyFile name the Secret keys, defaulting to key-id and key.
+	KeyIDFile string
+	KeyFile   string
+}
+
+// Name implements Provider.
+func (p *MachineKeyProvider) Name() string { return iamv1.ProviderZitadelMachineKey }
+
+// Strategy implements Provider. Machine keys overlap.
+func (p *MachineKeyProvider) Strategy() string { return iamv1.StrategyOverlap }
+
+// Prepare creates a new key. The currently deployed key remains valid.
+func (p *MachineKeyProvider) Prepare(ctx context.Context, kr *iamv1.KeyRotation) (*Credential, error) {
+	userID := kr.Spec.Target.MachineUserID
+	if userID == "" {
+		return nil, fmt.Errorf("spec.target.machineUserID is required")
+	}
+	key, err := p.Client.CreateMachineKey(userID)
+	if err != nil {
+		return nil, fmt.Errorf("creating a machine key: %w", err)
+	}
+	fields := map[string][]byte{
+		p.keyField(kr):   []byte(key.Key),
+		p.keyIDField(kr): []byte(key.KeyID),
+	}
+	return &Credential{ID: key.KeyID, Fields: fields}, nil
+}
+
+// Verify exchanges a token with the new key. A key that cannot obtain a token is
+// not deployed as a working credential, whatever the API said.
+func (p *MachineKeyProvider) Verify(ctx context.Context, kr *iamv1.KeyRotation, cred *Credential) error {
+	keyPEM := cred.Fields[p.keyField(kr)]
+	keyID := string(cred.Fields[p.keyIDField(kr)])
+	return p.Client.ExchangeMachineKey(
+		p.AuthClientID,
+		kr.Spec.Target.MachineUserID,
+		keyID,
+		keyPEM,
+		kr.Spec.Verify.AudienceProject,
+	)
+}
+
+// Retire deletes the superseded key.
+func (p *MachineKeyProvider) Retire(ctx context.Context, kr *iamv1.KeyRotation, credentialID string) error {
+	return p.Client.DeleteMachineKey(kr.Spec.Target.MachineUserID, credentialID)
+}
+
+func (p *MachineKeyProvider) keyField(kr *iamv1.KeyRotation) string {
+	if key, ok := kr.Spec.Target.SecretKeys["key"]; ok && key != "" {
+		return key
+	}
+	return "key"
+}
+
+func (p *MachineKeyProvider) keyIDField(kr *iamv1.KeyRotation) string {
+	if key, ok := kr.Spec.Target.SecretKeys["key-id"]; ok && key != "" {
+		return key
+	}
+	return "key-id"
+}
+
+// OIDCClientProvider rotates an app's client secret.
+//
+// ZITADEL stores exactly one secret per app, so creating the new secret kills the
+// old one. The strategy is atomic: publish immediately, roll the consumer, verify,
+// and if verification fails, put the previous value back.
+type OIDCClientProvider struct {
+	Client *zitadel.Client
+	// ClientIDFunc maps a KeyRotation to the app's client id, which the
+	// introspection endpoint needs.
+	ClientIDFunc func(kr *iamv1.KeyRotation) string
+	// SecretKey names the Secret key that holds the secret.
+	SecretKey string
+}
+
+// Name implements Provider.
+func (p *OIDCClientProvider) Name() string { return iamv1.ProviderZitadelOIDCClient }
+
+// Strategy implements Provider. Client secrets cannot overlap.
+func (p *OIDCClientProvider) Strategy() string { return iamv1.StrategyAtomic }
+
+// Prepare regenerates the client secret.
+func (p *OIDCClientProvider) Prepare(ctx context.Context, kr *iamv1.KeyRotation) (*Credential, error) {
+	projectID := kr.Spec.Target.ZitadelProjectID
+	appID := kr.Spec.Target.ZitadelAppID
+	if projectID == "" || appID == "" {
+		return nil, fmt.Errorf("spec.target.zitadelProjectID and zitadelAppID are required")
+	}
+	secret, err := p.Client.GenerateClientSecret(projectID, appID)
+	if err != nil {
+		return nil, fmt.Errorf("generating a client secret: %w", err)
+	}
+	field := p.secretField(kr)
+	// The credential id is the generation marker, not a ZITADEL identifier: the
+	// API returns only the value.
+	return &Credential{
+		ID:     "secret-" + shortHash(secret),
+		Fields: map[string][]byte{field: []byte(secret)},
+	}, nil
+}
+
+// Verify checks the credential against the introspection endpoint.
+func (p *OIDCClientProvider) Verify(ctx context.Context, kr *iamv1.KeyRotation, cred *Credential) error {
+	if !kr.Spec.Verify.Introspect {
+		return nil
+	}
+	clientID := ""
+	if p.ClientIDFunc != nil {
+		clientID = p.ClientIDFunc(kr)
+	}
+	if clientID == "" {
+		return fmt.Errorf("no client id configured for introspection")
+	}
+	return p.Client.Introspect(clientID, string(cred.Fields[p.secretField(kr)]))
+}
+
+// Retire is a no-op: an atomic provider has nothing to retire, because the
+// provider already invalidated the previous value.
+func (p *OIDCClientProvider) Retire(ctx context.Context, kr *iamv1.KeyRotation, credentialID string) error {
+	return nil
+}
+
+func (p *OIDCClientProvider) secretField(kr *iamv1.KeyRotation) string {
+	if p.SecretKey != "" {
+		return p.SecretKey
+	}
+	if key, ok := kr.Spec.Target.SecretKeys["secret"]; ok && key != "" {
+		return key
+	}
+	return "secret"
+}
+
+// shortHash gives a stable, non-reversible marker for a secret so status can
+// record which generation is live without storing the value.
+func shortHash(value string) string {
+	sum := 0
+	for _, b := range []byte(value) {
+		sum = (sum*31 + int(b)) % 100000007
+	}
+	encoded := base64.RawURLEncoding.EncodeToString([]byte(fmt.Sprintf("%d", sum)))
+	return encoded
+}
+
+// unusedJSON keeps the import set honest if a provider needs raw JSON later.
+var _ = json.Marshal

k8s/apps/key-rotation-controller/controller/internal/reconcile/reconciler.go

@@ -0,0 +1,391 @@
+// Package reconcile turns a KeyRotation object into a rotated credential.
+//
+// The state machine is identical for every provider. Only three calls differ:
+// create, verify, retire. That is what makes one controller cover machine keys,
+// client secrets and, later, the token-style providers.
+//
+// Order is the safety property:
+//
+//	Prepare    create the new credential
+//	Publish    write the Secret, roll the consumer when it cannot reload
+//	Verify     prove the new credential works against the provider
+//	Retire     delete the old credential, only for overlapping providers
+//
+// A failure before Retire leaves the old credential in place, so a broken
+// rotation never removes the thing that currently works.
+package reconcile
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+
+	iamv1 "github.com/riotpiao/key-rotation-controller/api"
+)
+
+// Credential is fresh credential material, before it is written to a Secret.
+type Credential struct {
+	// ID identifies the credential at the provider, so it can be retired later.
+	ID string
+	// Fields maps a Secret key to its value.
+	Fields map[string][]byte
+}
+
+// Provider creates, verifies and retires one class of credential.
+type Provider interface {
+	// Name is the provider name from the spec.
+	Name() string
+	// Strategy is overlap or atomic. Atomic providers replace in place.
+	Strategy() string
+	// Prepare creates a new credential at the provider.
+	Prepare(ctx context.Context, kr *iamv1.KeyRotation) (*Credential, error)
+	// Verify proves the credential works, using the provider's own check.
+	Verify(ctx context.Context, kr *iamv1.KeyRotation, cred *Credential) error
+	// Retire deletes a superseded credential. It must be safe to call twice.
+	Retire(ctx context.Context, kr *iamv1.KeyRotation, credentialID string) error
+}
+
+// Reconciler rotates credentials for KeyRotation objects.
+type Reconciler struct {
+	client.Client
+	// Providers keyed by spec.provider.
+	Providers map[string]Provider
+	// Now is injectable so scheduling is testable.
+	Now func() time.Time
+	// RolloutTimeout bounds the wait for a consumer to become available.
+	RolloutTimeout time.Duration
+}
+
+// previousKeySuffix keeps the superseded value beside the current one, so an
+// atomic provider can be rolled back without storing a secret in the object.
+const previousKeySuffix = ".previous"
+
+// RequeueAfter is how long to wait before checking a resource again.
+func (r *Reconciler) RequeueAfter(kr *iamv1.KeyRotation) time.Duration {
+	interval := time.Duration(kr.Spec.IntervalHours) * time.Hour
+	if interval <= 0 {
+		interval = 30 * 24 * time.Hour
+	}
+	if kr.Status.LastRotation == nil || kr.Status.ActiveCredentialID == "" {
+		return 0 // rotate now
+	}
+	due := kr.Status.LastRotation.Add(interval)
+	wait := due.Sub(r.now())
+	if wait < 0 {
+		return 0
+	}
+	return wait
+}
+
+// Reconcile performs one rotation when the resource is due.
+func (r *Reconciler) Reconcile(ctx context.Context, req types.NamespacedName) (time.Duration, error) {
+	logger := log.FromContext(ctx).WithValues("keyrotation", req.String())
+
+	var kr iamv1.KeyRotation
+	if err := r.Get(ctx, req, &kr); err != nil {
+		if apierrors.IsNotFound(err) {
+			return 0, nil
+		}
+		return 0, err
+	}
+
+	if kr.Spec.Suspend {
+		return 0, r.setPhase(ctx, &kr, iamv1.PhaseSuspended, "")
+	}
+
+	provider := r.Providers[kr.Spec.Provider]
+	if provider == nil {
+		return 0, r.setPhase(ctx, &kr, iamv1.PhaseFailed,
+			fmt.Sprintf("no provider named %q", kr.Spec.Provider))
+	}
+
+	wait := r.RequeueAfter(&kr)
+	if wait > 0 {
+		return wait, nil
+	}
+
+	logger.Info("rotating credential", "provider", kr.Spec.Provider, "strategy", kr.Spec.Strategy)
+
+	previousID := kr.Status.ActiveCredentialID
+	previousFields := r.readCurrentSecret(ctx, &kr)
+
+	// Prepare
+	if err := r.setPhase(ctx, &kr, iamv1.PhasePreparing, ""); err != nil {
+		return 0, err
+	}
+	cred, err := provider.Prepare(ctx, &kr)
+	if err != nil {
+		return r.fail(ctx, &kr, iamv1.PhasePreparing, err)
+	}
+
+	// Publish. The previous value stays beside the new one until verification
+	// passes, so an atomic rotation can be undone.
+	if err := r.setPhase(ctx, &kr, iamv1.PhasePropagating, ""); err != nil {
+		return 0, err
+	}
+	if err := r.writeSecret(ctx, &kr, cred, previousFields); err != nil {
+		return r.fail(ctx, &kr, iamv1.PhasePropagating, err)
+	}
+	if kr.Spec.Target.Reload != iamv1.ReloadHot {
+		if err := r.rollConsumers(ctx, &kr, cred.ID); err != nil {
+			return r.fail(ctx, &kr, iamv1.PhasePropagating, err)
+		}
+	}
+
+	// Verify
+	if err := r.setPhase(ctx, &kr, iamv1.PhaseVerifying, ""); err != nil {
+		return 0, err
+	}
+	if err := provider.Verify(ctx, &kr, cred); err != nil {
+		// Put the previous value back and roll again, then report the failure.
+		r.restorePrevious(ctx, &kr, previousFields)
+		return r.fail(ctx, &kr, iamv1.PhaseVerifying, err)
+	}
+
+	// Complete. Retire only when the provider can overlap, because retiring an
+	// atomic credential would delete the one now in use.
+	if err := r.setPhase(ctx, &kr, iamv1.PhaseCompleting, ""); err != nil {
+		return 0, err
+	}
+	if provider.Strategy() == iamv1.StrategyOverlap && previousID != "" && previousID != cred.ID {
+		if err := provider.Retire(ctx, &kr, previousID); err != nil {
+			logger.Error(err, "retiring the previous credential failed; it stays valid", "credential", previousID)
+		}
+	}
+	r.clearPrevious(ctx, &kr)
+
+	now := metav1.NewTime(r.now())
+	kr.Status.LastRotation = &now
+	kr.Status.ActiveCredentialID = cred.ID
+	kr.Status.PreviousCredentialID = previousID
+	kr.Status.LastError = ""
+	kr.Status.ObservedGeneration = kr.Generation
+	if err := r.Status().Update(ctx, &kr); err != nil {
+		return 0, err
+	}
+	if err := r.setPhase(ctx, &kr, iamv1.PhaseSucceeded, ""); err != nil {
+		return 0, err
+	}
+	logger.Info("rotation complete", "credential", cred.ID, "previous", previousID)
+
+	return r.RequeueAfter(&kr), nil
+}
+
+func (r *Reconciler) now() time.Time {
+	if r.Now != nil {
+		return r.Now()
+	}
+	return time.Now()
+}
+
+func (r *Reconciler) setPhase(ctx context.Context, kr *iamv1.KeyRotation, phase, message string) error {
+	kr.Status.Phase = phase
+	kr.Status.LastError = message
+	kr.Status.ObservedGeneration = kr.Generation
+	if err := r.Status().Update(ctx, kr); err != nil && !apierrors.IsConflict(err) {
+		return err
+	}
+	return nil
+}
+
+func (r *Reconciler) fail(ctx context.Context, kr *iamv1.KeyRotation, phase string, cause error) (time.Duration, error) {
+	kr.Status.Phase = iamv1.PhaseFailed
+	kr.Status.LastError = fmt.Sprintf("%s: %v", phase, cause)
+	_ = r.Status().Update(ctx, kr)
+	// Retry soon, but not in a tight loop.
+	return 5 * time.Minute, nil
+}
+
+// secretData assembles the Secret payload: the new values, plus the superseded
+// values under a shadow key so an atomic rotation can be undone.
+func secretData(kr *iamv1.KeyRotation, cred *Credential, previous map[string][]byte) map[string][]byte {
+	data := make(map[string][]byte, len(cred.Fields)*2)
+	for logical, value := range cred.Fields {
+		key := secretKeyFor(kr, logical)
+		data[key] = value
+		if old, ok := previous[key]; ok && len(old) > 0 {
+			data[key+previousKeySuffix] = old
+		}
+	}
+	return data
+}
+
+// secretKeyFor maps a logical field name to the Secret key, defaulting to the
+// same name so a simple credential needs no mapping.
+func secretKeyFor(kr *iamv1.KeyRotation, logical string) string {
+	if key, ok := kr.Spec.Target.SecretKeys[logical]; ok && key != "" {
+		return key
+	}
+	return logical
+}
+
+func (r *Reconciler) readCurrentSecret(ctx context.Context, kr *iamv1.KeyRotation) map[string][]byte {
+	var secret corev1.Secret
+	err := r.Get(ctx, types.NamespacedName{
+		Namespace: kr.Spec.Target.SecretNamespace,
+		Name:      kr.Spec.Target.SecretName,
+	}, &secret)
+	if err != nil {
+		return nil
+	}
+	return secret.Data
+}
+
+func (r *Reconciler) writeSecret(ctx context.Context, kr *iamv1.KeyRotation, cred *Credential, previous map[string][]byte) error {
+	data := secretData(kr, cred, previous)
+
+	var secret corev1.Secret
+	key := types.NamespacedName{Namespace: kr.Spec.Target.SecretNamespace, Name: kr.Spec.Target.SecretName}
+	err := r.Get(ctx, key, &secret)
+	if apierrors.IsNotFound(err) {
+		secret = corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      key.Name,
+				Namespace: key.Namespace,
+				Labels:    map[string]string{"app.kubernetes.io/managed-by": "key-rotation-controller"},
+			},
+			Type: corev1.SecretTypeOpaque,
+			Data: data,
+		}
+		return r.Create(ctx, &secret)
+	}
+	if err != nil {
+		return err
+	}
+	secret.Data = data
+	return r.Update(ctx, &secret)
+}
+
+// restorePrevious puts the shadow values back in place after a failed check.
+func (r *Reconciler) restorePrevious(ctx context.Context, kr *iamv1.KeyRotation, previous map[string][]byte) {
+	if len(previous) == 0 {
+		return
+	}
+	var secret corev1.Secret
+	key := types.NamespacedName{Namespace: kr.Spec.Target.SecretNamespace, Name: kr.Spec.Target.SecretName}
+	if err := r.Get(ctx, key, &secret); err != nil {
+		return
+	}
+	// Restore every shadowed value over the current one.
+	for k, v := range secret.Data {
+		base := k
+		if len(k) > len(previousKeySuffix) && k[len(k)-len(previousKeySuffix):] == previousKeySuffix {
+			base = k[:len(k)-len(previousKeySuffix)]
+			secret.Data[base] = v
+		}
+	}
+	_ = r.Update(ctx, &secret)
+	_ = r.rollConsumers(ctx, kr, "rollback")
+}
+
+// clearPrevious removes the shadow values once verification passed.
+func (r *Reconciler) clearPrevious(ctx context.Context, kr *iamv1.KeyRotation) {
+	var secret corev1.Secret
+	key := types.NamespacedName{Namespace: kr.Spec.Target.SecretNamespace, Name: kr.Spec.Target.SecretName}
+	if err := r.Get(ctx, key, &secret); err != nil {
+		return
+	}
+	changed := false
+	for k := range secret.Data {
+		if len(k) > len(previousKeySuffix) && k[len(k)-len(previousKeySuffix):] == previousKeySuffix {
+			delete(secret.Data, k)
+			changed = true
+		}
+	}
+	if changed {
+		_ = r.Update(ctx, &secret)
+	}
+}
+
+// rollConsumers restarts each consumer so it reads the new value.
+func (r *Reconciler) rollConsumers(ctx context.Context, kr *iamv1.KeyRotation, revision string) error {
+	for _, consumer := range kr.Spec.Target.Consumers {
+		ns := consumer.Namespace
+		if ns == "" {
+			ns = kr.Namespace
+		}
+		switch consumer.Kind {
+		case "Deployment":
+			var dep appsv1.Deployment
+			if err := r.Get(ctx, types.NamespacedName{Namespace: ns, Name: consumer.Name}, &dep); err != nil {
+				return fmt.Errorf("consumer %s/%s: %w", ns, consumer.Name, err)
+			}
+			base := dep.DeepCopy()
+			if dep.Spec.Template.Annotations == nil {
+				dep.Spec.Template.Annotations = map[string]string{}
+			}
+			dep.Spec.Template.Annotations["iam.homelab.riotpiao.com/credential-revision"] = revision
+			if err := r.Patch(ctx, &dep, client.MergeFrom(base)); err != nil {
+				return fmt.Errorf("rolling %s/%s: %w", ns, consumer.Name, err)
+			}
+		case "StatefulSet":
+			var sts appsv1.StatefulSet
+			if err := r.Get(ctx, types.NamespacedName{Namespace: ns, Name: consumer.Name}, &sts); err != nil {
+				return fmt.Errorf("consumer %s/%s: %w", ns, consumer.Name, err)
+			}
+			base := sts.DeepCopy()
+			if sts.Spec.Template.Annotations == nil {
+				sts.Spec.Template.Annotations = map[string]string{}
+			}
+			sts.Spec.Template.Annotations["iam.homelab.riotpiao.com/credential-revision"] = revision
+			if err := r.Patch(ctx, &sts, client.MergeFrom(base)); err != nil {
+				return fmt.Errorf("rolling %s/%s: %w", ns, consumer.Name, err)
+			}
+		default:
+			return fmt.Errorf("consumer kind %q is not supported", consumer.Kind)
+		}
+	}
+	return r.waitForConsumers(ctx, kr)
+}
+
+// waitForConsumers blocks until every consumer reports all replicas available.
+func (r *Reconciler) waitForConsumers(ctx context.Context, kr *iamv1.KeyRotation) error {
+	deadline := r.now().Add(r.rolloutTimeout())
+	for {
+		ready := true
+		for _, consumer := range kr.Spec.Target.Consumers {
+			ns := consumer.Namespace
+			if ns == "" {
+				ns = kr.Namespace
+			}
+			var dep appsv1.Deployment
+			if err := r.Get(ctx, types.NamespacedName{Namespace: ns, Name: consumer.Name}, &dep); err != nil {
+				continue
+			}
+			desired := int32(1)
+			if dep.Spec.Replicas != nil {
+				desired = *dep.Spec.Replicas
+			}
+			if dep.Status.UpdatedReplicas < desired || dep.Status.AvailableReplicas < desired {
+				ready = false
+				break
+			}
+		}
+		if ready {
+			return nil
+		}
+		if r.now().After(deadline) {
+			return fmt.Errorf("consumer did not become available within %s", r.rolloutTimeout())
+		}
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-time.After(2 * time.Second):
+		}
+	}
+}
+
+func (r *Reconciler) rolloutTimeout() time.Duration {
+	if r.RolloutTimeout > 0 {
+		return r.RolloutTimeout
+	}
+	return 3 * time.Minute
+}

k8s/apps/key-rotation-controller/controller/internal/reconcile/reconciler_test.go

@@ -0,0 +1,155 @@
+package reconcile
+
+import (
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	iamv1 "github.com/riotpiao/key-rotation-controller/api"
+)
+
+func rotation(last *metav1.Time, activeID string, hours int32) *iamv1.KeyRotation {
+	return &iamv1.KeyRotation{
+		Spec: iamv1.KeyRotationSpec{
+			Provider:      iamv1.ProviderZitadelMachineKey,
+			Strategy:      iamv1.StrategyOverlap,
+			IntervalHours: hours,
+		},
+		Status: iamv1.KeyRotationStatus{
+			LastRotation:       last,
+			ActiveCredentialID: activeID,
+		},
+	}
+}
+
+func TestRequeueAfterRotatesImmediatelyWhenNeverRotated(t *testing.T) {
+	r := &Reconciler{Now: func() time.Time { return time.Unix(1_700_000_000, 0) }}
+	if got := r.RequeueAfter(rotation(nil, "", 24)); got != 0 {
+		t.Fatalf("a resource with no rotation history must rotate now, got %s", got)
+	}
+	if got := r.RequeueAfter(rotation(nil, "key-1", 24)); got != 0 {
+		t.Fatalf("a resource with no lastRotation must rotate now, got %s", got)
+	}
+}
+
+func TestRequeueAfterWaitsForTheInterval(t *testing.T) {
+	now := time.Unix(1_700_000_000, 0)
+	last := metav1.NewTime(now.Add(-6 * time.Hour))
+	r := &Reconciler{Now: func() time.Time { return now }}
+
+	got := r.RequeueAfter(rotation(&last, "key-1", 24))
+	want := 18 * time.Hour
+	if got != want {
+		t.Fatalf("expected %s until the next rotation, got %s", want, got)
+	}
+}
+
+func TestRequeueAfterRotatesWhenOverdue(t *testing.T) {
+	now := time.Unix(1_700_000_000, 0)
+	last := metav1.NewTime(now.Add(-30 * time.Hour))
+	r := &Reconciler{Now: func() time.Time { return now }}
+
+	if got := r.RequeueAfter(rotation(&last, "key-1", 24)); got != 0 {
+		t.Fatalf("an overdue resource must rotate now, got %s", got)
+	}
+}
+
+func TestRequeueAfterFallsBackWhenNoInterval(t *testing.T) {
+	now := time.Unix(1_700_000_000, 0)
+	last := metav1.NewTime(now)
+	r := &Reconciler{Now: func() time.Time { return now }}
+
+	got := r.RequeueAfter(rotation(&last, "key-1", 0))
+	if got <= 0 {
+		t.Fatalf("a zero interval must fall back to a default, got %s", got)
+	}
+}
+
+func TestSecretDataKeepsThePreviousValueUnderAShadowKey(t *testing.T) {
+	kr := &iamv1.KeyRotation{Spec: iamv1.KeyRotationSpec{
+		Target: iamv1.RotationTarget{
+			SecretKeys: map[string]string{"key": "jwt-key", "key-id": "jwt-key-id"},
+		},
+	}}
+	cred := &Credential{ID: "k2", Fields: map[string][]byte{
+		"key":    []byte("PEM-2"),
+		"key-id": []byte("k2"),
+	}}
+	previous := map[string][]byte{
+		"jwt-key":    []byte("PEM-1"),
+		"jwt-key-id": []byte("k1"),
+	}
+
+	data := secretData(kr, cred, previous)
+
+	if string(data["jwt-key"]) != "PEM-2" {
+		t.Fatalf("current value missing, got %q", data["jwt-key"])
+	}
+	if string(data["jwt-key"+previousKeySuffix]) != "PEM-1" {
+		t.Fatalf("previous value must be kept for rollback, got %q", data["jwt-key"+previousKeySuffix])
+	}
+	if string(data["jwt-key-id"+previousKeySuffix]) != "k1" {
+		t.Fatalf("previous key id must be kept for rollback")
+	}
+}
+
+func TestSecretDataDefaultsToLogicalNames(t *testing.T) {
+	kr := &iamv1.KeyRotation{}
+	cred := &Credential{ID: "k1", Fields: map[string][]byte{"secret": []byte("s3cret")}}
+
+	data := secretData(kr, cred, nil)
+
+	if string(data["secret"]) != "s3cret" {
+		t.Fatalf("an unmapped field must keep its logical name, got %v", data)
+	}
+	if _, shadow := data["secret"+previousKeySuffix]; shadow {
+		t.Fatalf("no previous value existed, so no shadow key may be written")
+	}
+}
+
+func TestSecretKeyForPrefersTheMapping(t *testing.T) {
+	kr := &iamv1.KeyRotation{Spec: iamv1.KeyRotationSpec{
+		Target: iamv1.RotationTarget{
+			SecretKeys: map[string]string{"secret": "GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET"},
+		},
+	}}
+	if got := secretKeyFor(kr, "secret"); got != "GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET" {
+		t.Fatalf("mapping not honoured, got %q", got)
+	}
+	if got := secretKeyFor(kr, "key-id"); got != "key-id" {
+		t.Fatalf("unmapped field must default to its own name, got %q", got)
+	}
+}
+
+func TestMachineKeyProviderFieldsRespectTheMapping(t *testing.T) {
+	p := &MachineKeyProvider{}
+	kr := &iamv1.KeyRotation{Spec: iamv1.KeyRotationSpec{
+		Target: iamv1.RotationTarget{
+			SecretKeys: map[string]string{"key": "private-key", "key-id": "kid"},
+		},
+	}}
+	if p.keyField(kr) != "private-key" || p.keyIDField(kr) != "kid" {
+		t.Fatalf("provider must read the mapped Secret keys")
+	}
+	if p.Strategy() != iamv1.StrategyOverlap {
+		t.Fatalf("machine keys must be an overlapping provider")
+	}
+	if (&OIDCClientProvider{}).Strategy() != iamv1.StrategyAtomic {
+		t.Fatalf("client secrets cannot overlap and must be atomic")
+	}
+}
+
+func TestShortHashIsStableAndDoesNotLeakTheValue(t *testing.T) {
+	a := shortHash("super-secret-value")
+	b := shortHash("super-secret-value")
+	if a != b {
+		t.Fatalf("the marker must be stable for the same value")
+	}
+	if a == "super-secret-value" {
+		t.Fatalf("the marker must not be the value itself")
+	}
+	if shortHash("other") == a {
+		t.Fatalf("different values must produce different markers")
+	}
+}

k8s/apps/key-rotation-controller/controller/internal/zitadel/client.go

@@ -0,0 +1,308 @@
+package zitadel
+
+import (
+	"bytes"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"sync"
+	"time"
+)
+
+// Config holds everything the controller needs to call ZITADEL.
+type Config struct {
+	// Issuer is the instance URL, for example https://zitadel.riotpiao.com.
+	Issuer string
+	// ClientID is the API app that this controller authenticates as.
+	ClientID string
+	// UserID is the machine user the assertion acts for. Empty means ClientID.
+	UserID string
+	// KeyID and PrivateKeyPEM identify the controller's own machine key.
+	KeyID         string
+	PrivateKeyPEM []byte
+	// HTTPClient is optional; a sane default is used when nil.
+	HTTPClient *http.Client
+}
+
+// Client is a thin ZITADEL management client.
+type Client struct {
+	cfg   Config
+	http  *http.Client
+	mu    sync.Mutex
+	token string
+	until time.Time
+}
+
+// New builds a client.
+func New(cfg Config) *Client {
+	client := cfg.HTTPClient
+	if client == nil {
+		client = &http.Client{Timeout: 20 * time.Second}
+	}
+	return &Client{cfg: cfg, http: client}
+}
+
+// AccessToken returns a cached access token, minting one when needed.
+func (c *Client) AccessToken() (string, error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if c.token != "" && time.Now().Before(c.until) {
+		return c.token, nil
+	}
+
+	assertion, err := SignAssertion(c.cfg.PrivateKeyPEM, c.cfg.KeyID, c.cfg.ClientID, c.cfg.UserID, c.cfg.Issuer, time.Now())
+	if err != nil {
+		return "", err
+	}
+
+	form := url.Values{}
+	form.Set("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer")
+	form.Set("assertion", assertion)
+	form.Set("scope", "openid")
+
+	req, err := http.NewRequest(http.MethodPost, strings.TrimRight(c.cfg.Issuer, "/")+"/oauth/v2/token", strings.NewReader(form.Encode()))
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("token request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<16))
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("token endpoint returned %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))
+	}
+
+	var parsed struct {
+		AccessToken string `json:"access_token"`
+		ExpiresIn   int    `json:"expires_in"`
+	}
+	if err := json.Unmarshal(body, &parsed); err != nil {
+		return "", fmt.Errorf("token response did not parse: %w", err)
+	}
+	if parsed.AccessToken == "" {
+		return "", fmt.Errorf("token response carried no access_token")
+	}
+
+	lifetime := parsed.ExpiresIn
+	if lifetime <= 0 {
+		lifetime = 300
+	}
+	c.token = parsed.AccessToken
+	// Refresh at 80 % of the lifetime so a slow call never presents an expired token.
+	c.until = time.Now().Add(time.Duration(lifetime) * time.Second * 4 / 5)
+	return c.token, nil
+}
+
+// projectAppPath builds the management path for one OIDC app under a project.
+func (c *Client) projectAppPath(projectID, appID string) string {
+	return fmt.Sprintf("/management/v1/projects/%s/apps/%s", projectID, appID)
+}
+
+// MachineKey is one registered key for a service user.
+type MachineKey struct {
+	KeyID      string `json:"keyId"`
+	Expiration string `json:"expirationDate,omitempty"`
+	// Details holds the PEM bundle when the key was just created.
+	Details string `json:"keyDetails,omitempty"`
+}
+
+// NewMachineKeyJSON is the JSON document ZITADEL returns for a new JSON key.
+type NewMachineKeyJSON struct {
+	Type     string `json:"type"`
+	KeyID    string `json:"keyId"`
+	Key      string `json:"key"`
+	UserID   string `json:"userId"`
+	ExpireAt string `json:"expirationDate,omitempty"`
+}
+
+// CreateMachineKey adds a key to a service user and returns its material.
+//
+// ZITADEL keeps many keys per user, so this never invalidates the key that is
+// currently deployed. That is the whole reason the machine-key provider can
+// rotate with no gap.
+func (c *Client) CreateMachineKey(userID string) (*NewMachineKeyJSON, error) {
+	payload := map[string]any{"type": "KEY_TYPE_JSON"}
+	var out struct {
+		KeyID      string `json:"keyId"`
+		KeyDetails string `json:"keyDetails"`
+	}
+	if err := c.post("/management/v1/users/"+userID+"/keys", payload, &out); err != nil {
+		return nil, err
+	}
+	if out.KeyDetails == "" {
+		return nil, fmt.Errorf("create machine key returned no key material")
+	}
+
+	raw, err := base64Decode(out.KeyDetails)
+	if err != nil {
+		return nil, fmt.Errorf("key material is not base64: %w", err)
+	}
+
+	var key NewMachineKeyJSON
+	if err := json.Unmarshal(raw, &key); err != nil {
+		return nil, fmt.Errorf("key material is not the expected JSON: %w", err)
+	}
+	return &key, nil
+}
+
+// DeleteMachineKey removes one key. Called only after the new key is proven.
+func (c *Client) DeleteMachineKey(userID, keyID string) error {
+	return c.delete("/management/v1/users/" + userID + "/keys/" + keyID)
+}
+
+// GenerateClientSecret replaces the client secret of an OIDC app.
+//
+// ZITADEL stores exactly one secret per app, so the previous secret stops working
+// at this call. The caller must publish the new value immediately.
+func (c *Client) GenerateClientSecret(projectID, appID string) (string, error) {
+	var out struct {
+		ClientSecret string `json:"clientSecret"`
+	}
+	path := c.projectAppPath(projectID, appID) + "/oidc_config/_generate_client_secret"
+	if err := c.post(path, map[string]any{}, &out); err != nil {
+		return "", err
+	}
+	if out.ClientSecret == "" {
+		return "", fmt.Errorf("generate client secret returned an empty value")
+	}
+	return out.ClientSecret, nil
+}
+
+// Introspect checks a client credential against the token endpoint.
+//
+// A successful call returns an object with `active`. The credentials are valid
+// when the endpoint answers 200, whatever `active` says, because `active`
+// describes the token rather than the client.
+func (c *Client) Introspect(clientID, clientSecret string) error {
+	form := url.Values{}
+	form.Set("token", "probe")
+
+	req, err := http.NewRequest(http.MethodPost, strings.TrimRight(c.cfg.Issuer, "/")+"/oauth/v2/introspect", strings.NewReader(form.Encode()))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.SetBasicAuth(clientID, clientSecret)
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return fmt.Errorf("introspection request failed: %w", err)
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<16))
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("introspection returned %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))
+	}
+	return nil
+}
+
+// ExchangeMachineKey obtains a token with a specific key, proving that key works.
+func (c *Client) ExchangeMachineKey(clientID, userID, keyID string, keyPEM []byte, audienceProject string) error {
+	assertion, err := SignAssertion(keyPEM, keyID, clientID, userID, c.cfg.Issuer, time.Now())
+	if err != nil {
+		return err
+	}
+
+	scope := "openid"
+	if audienceProject != "" {
+		scope += " urn:zitadel:iam:org:project:id:" + audienceProject + ":aud"
+	}
+
+	form := url.Values{}
+	form.Set("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer")
+	form.Set("assertion", assertion)
+	form.Set("scope", scope)
+
+	req, err := http.NewRequest(http.MethodPost, strings.TrimRight(c.cfg.Issuer, "/")+"/oauth/v2/token", strings.NewReader(form.Encode()))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return fmt.Errorf("key exchange failed: %w", err)
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<16))
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("key exchange returned %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))
+	}
+	return nil
+}
+
+func (c *Client) do(method, path string, payload any, out any) error {
+	token, err := c.AccessToken()
+	if err != nil {
+		return err
+	}
+
+	var body io.Reader
+	if payload != nil {
+		encoded, err := json.Marshal(payload)
+		if err != nil {
+			return err
+		}
+		body = bytes.NewReader(encoded)
+	}
+
+	req, err := http.NewRequest(method, strings.TrimRight(c.cfg.Issuer, "/")+path, body)
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Authorization", "Bearer "+token)
+	if payload != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	raw, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("%s %s returned %d: %s", method, path, resp.StatusCode, strings.TrimSpace(string(raw)))
+	}
+	if out != nil && len(raw) > 0 {
+		if err := json.Unmarshal(raw, out); err != nil {
+			return fmt.Errorf("%s %s response did not parse: %w", method, path, err)
+		}
+	}
+	return nil
+}
+
+func (c *Client) post(path string, payload, out any) error {
+	return c.do(http.MethodPost, path, payload, out)
+}
+
+func (c *Client) delete(path string) error {
+	return c.do(http.MethodDelete, path, nil, nil)
+}
+
+func base64Decode(s string) ([]byte, error) {
+	if raw, err := base64StdDecode(s); err == nil {
+		return raw, nil
+	}
+	return base64URLDecode(s)
+}
+
+func base64StdDecode(s string) ([]byte, error) {
+	return base64.StdEncoding.DecodeString(s)
+}
+
+func base64URLDecode(s string) ([]byte, error) {
+	return base64.RawURLEncoding.DecodeString(s)
+}

k8s/apps/key-rotation-controller/controller/internal/zitadel/jwt.go

@@ -0,0 +1,89 @@
+// Package zitadel talks to the ZITADEL management API with the controller's own
+// machine key.
+//
+// The controller needs a credential to rotate credentials. It signs a short
+// assertion with its private key, exchanges it for an access token, and reuses
+// that token until shortly before it expires.
+package zitadel
+
+import (
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/pem"
+	"fmt"
+	"time"
+)
+
+// assertionLifetime is deliberately short. The assertion proves one request.
+const assertionLifetime = 60 * time.Second
+
+// newAssertionClaims builds the claim set for a machine-key assertion.
+//
+// ZITADEL expects `iss` to name the caller, `sub` to name the user it acts as,
+// and `aud` to equal the issuer of the instance.
+func newAssertionClaims(clientID, userID, issuer string, now time.Time) map[string]any {
+	if userID == "" {
+		userID = clientID
+	}
+	return map[string]any{
+		"iss": clientID,
+		"sub": userID,
+		"aud": issuer,
+		"iat": now.Unix(),
+		"exp": now.Add(assertionLifetime).Unix(),
+	}
+}
+
+func base64URL(b []byte) string {
+	return base64.RawURLEncoding.EncodeToString(b)
+}
+
+// SignAssertion produces a signed RS256 JWT for the jwt-bearer grant.
+//
+// The header carries `kid`, so ZITADEL selects the matching registered key. That
+// is what makes overlapping keys possible: two keys can be valid at once and the
+// assertion says which one it used.
+func SignAssertion(privateKeyPEM []byte, keyID, clientID, userID, issuer string, now time.Time) (string, error) {
+	block, _ := pem.Decode(privateKeyPEM)
+	if block == nil {
+		return "", fmt.Errorf("private key is not PEM encoded")
+	}
+
+	key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
+	if err != nil {
+		// ZITADEL exports PKCS#1 keys as well.
+		if rsaKey, rsaErr := x509.ParsePKCS1PrivateKey(block.Bytes); rsaErr == nil {
+			key = rsaKey
+		} else {
+			return "", fmt.Errorf("private key does not parse: %w", err)
+		}
+	}
+	rsaKey, ok := key.(*rsa.PrivateKey)
+	if !ok {
+		return "", fmt.Errorf("private key is not RSA")
+	}
+
+	header := map[string]any{"alg": "RS256", "typ": "JWT", "kid": keyID}
+	headerJSON, err := json.Marshal(header)
+	if err != nil {
+		return "", err
+	}
+	claimsJSON, err := json.Marshal(newAssertionClaims(clientID, userID, issuer, now))
+	if err != nil {
+		return "", err
+	}
+
+	signingInput := base64URL(headerJSON) + "." + base64URL(claimsJSON)
+	digest := sha256.Sum256([]byte(signingInput))
+	signature, err := rsa.SignPKCS1v15(rand.Reader, rsaKey, crypto.SHA256, digest[:])
+	if err != nil {
+		return "", fmt.Errorf("cannot sign the assertion: %w", err)
+	}
+
+	return signingInput + "." + base64URL(signature), nil
+}

k8s/apps/key-rotation-controller/controller/internal/zitadel/jwt_test.go

@@ -0,0 +1,90 @@
+package zitadel
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/pem"
+	"strings"
+	"testing"
+	"time"
+)
+
+func newKey(t *testing.T) ([]byte, *rsa.PublicKey) {
+	t.Helper()
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("cannot generate a key: %v", err)
+	}
+	pemBytes := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)})
+	return pemBytes, &key.PublicKey
+}
+
+func decodeSegment(t *testing.T, segment string, out any) {
+	t.Helper()
+	raw, err := base64.RawURLEncoding.DecodeString(segment)
+	if err != nil {
+		t.Fatalf("segment is not base64url: %v", err)
+	}
+	if err := json.Unmarshal(raw, out); err != nil {
+		t.Fatalf("segment is not JSON: %v", err)
+	}
+}
+
+func TestSignAssertionCarriesTheKeyIDAndIssuer(t *testing.T) {
+	pemBytes, _ := newKey(t)
+	now := time.Unix(1_700_000_000, 0)
+
+	token, err := SignAssertion(pemBytes, "key-42", "client-1", "user-9", "https://zitadel.riotpiao.com", now)
+	if err != nil {
+		t.Fatalf("signing failed: %v", err)
+	}
+	if strings.Count(token, ".") != 2 {
+		t.Fatalf("a JWT has three segments, got %q", token)
+	}
+
+	parts := strings.Split(token, ".")
+	var header map[string]any
+	decodeSegment(t, parts[0], &header)
+	if header["kid"] != "key-42" {
+		t.Fatalf("the header must name the key id so ZITADEL can pick the key, got %v", header["kid"])
+	}
+	if header["alg"] != "RS256" {
+		t.Fatalf("expected RS256, got %v", header["alg"])
+	}
+
+	var claims map[string]any
+	decodeSegment(t, parts[1], &claims)
+	if claims["iss"] != "client-1" || claims["sub"] != "user-9" {
+		t.Fatalf("iss and sub are wrong: %v / %v", claims["iss"], claims["sub"])
+	}
+	if claims["aud"] != "https://zitadel.riotpiao.com" {
+		t.Fatalf("aud must equal the issuer, got %v", claims["aud"])
+	}
+	exp := int64(claims["exp"].(float64))
+	iat := int64(claims["iat"].(float64))
+	if exp-iat != 60 {
+		t.Fatalf("the assertion must live 60 seconds, got %d", exp-iat)
+	}
+}
+
+func TestSignAssertionRejectsGarbage(t *testing.T) {
+	if _, err := SignAssertion([]byte("not a key"), "k", "c", "u", "https://i", time.Now()); err == nil {
+		t.Fatalf("a non-PEM key must be rejected")
+	}
+}
+
+func TestSignAssertionDefaultsSubjectToClientID(t *testing.T) {
+	pemBytes, _ := newKey(t)
+	token, err := SignAssertion(pemBytes, "k1", "client-1", "", "https://i", time.Unix(1, 0))
+	if err != nil {
+		t.Fatalf("signing failed: %v", err)
+	}
+	var claims map[string]any
+	decodeSegment(t, strings.Split(token, ".")[1], &claims)
+	if claims["sub"] != "client-1" {
+		t.Fatalf("an empty user id must fall back to the client id, got %v", claims["sub"])
+	}
+}

k8s/apps/key-rotation-controller/controller/main.go

@@ -0,0 +1,152 @@
+// Command key-rotation-controller rotates credentials declared by KeyRotation
+// objects.
+//
+// The controller authenticates to ZITADEL with its own machine key, read from a
+// mounted Secret. That key is the single bootstrap credential: everything else is
+// created by this process and never committed to git.
+package main
+
+import (
+	"context"
+	"flag"
+	"fmt"
+	"net/http"
+	"os"
+	"time"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller"
+	"sigs.k8s.io/controller-runtime/pkg/handler"
+	"sigs.k8s.io/controller-runtime/pkg/log/zap"
+	ctrlreconcile "sigs.k8s.io/controller-runtime/pkg/reconcile"
+	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
+	"sigs.k8s.io/controller-runtime/pkg/source"
+
+	iamv1 "github.com/riotpiao/key-rotation-controller/api"
+	keyreconcile "github.com/riotpiao/key-rotation-controller/internal/reconcile"
+	"github.com/riotpiao/key-rotation-controller/internal/zitadel"
+)
+
+func main() {
+	var (
+		metricsAddr = flag.String("metrics-bind-address", ":8080", "address for the metrics endpoint")
+		healthAddr  = flag.String("health-probe-bind-address", ":8081", "address for probes")
+		interval    = flag.Duration("scan-interval", 10*time.Minute, "how often to re-check every resource")
+	)
+	flag.Parse()
+
+	ctrl.SetLogger(zap.New(zap.UseDevMode(false)))
+	logger := ctrl.Log.WithName("setup")
+
+	scheme := runtime.NewScheme()
+	if err := clientgoscheme.AddToScheme(scheme); err != nil {
+		logger.Error(err, "cannot register the Kubernetes types")
+		os.Exit(1)
+	}
+	if err := iamv1.AddToScheme(scheme); err != nil {
+		logger.Error(err, "cannot register the KeyRotation types")
+		os.Exit(1)
+	}
+
+	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
+		Scheme:                 scheme,
+		Metrics:                metricsserver.Options{BindAddress: *metricsAddr},
+		HealthProbeBindAddress: *healthAddr,
+		LeaderElection:         true,
+		LeaderElectionID:       "key-rotation-controller.iam.homelab.riotpiao.com",
+	})
+	if err != nil {
+		logger.Error(err, "cannot create the manager")
+		os.Exit(1)
+	}
+
+	zitadelClient, err := buildZitadelClient()
+	if err != nil {
+		logger.Error(err, "cannot build the ZITADEL client")
+		os.Exit(1)
+	}
+
+	reconciler := &keyreconcile.Reconciler{
+		Client: mgr.GetClient(),
+		Providers: map[string]keyreconcile.Provider{
+			iamv1.ProviderZitadelMachineKey: &keyreconcile.MachineKeyProvider{
+				Client:       zitadelClient,
+				AuthClientID: os.Getenv("ZITADEL_CLIENT_ID"),
+			},
+			iamv1.ProviderZitadelOIDCClient: &keyreconcile.OIDCClientProvider{
+				Client: zitadelClient,
+			},
+		},
+	}
+
+	c, err := controller.New("keyrotation", mgr, controller.Options{
+		Reconciler: ctrlreconcile.Func(func(ctx context.Context, req ctrlreconcile.Request) (ctrlreconcile.Result, error) {
+			wait, err := reconciler.Reconcile(ctx, types.NamespacedName(req.NamespacedName))
+			if err != nil {
+				return ctrlreconcile.Result{}, err
+			}
+			if wait <= 0 {
+				wait = *interval
+			}
+			return ctrlreconcile.Result{RequeueAfter: wait}, nil
+		}),
+	})
+	if err != nil {
+		logger.Error(err, "cannot create the controller")
+		os.Exit(1)
+	}
+
+	if err := c.Watch(source.Kind(mgr.GetCache(), client.Object(&iamv1.KeyRotation{}), &handler.EnqueueRequestForObject{})); err != nil {
+		logger.Error(err, "cannot watch KeyRotation objects")
+		os.Exit(1)
+	}
+
+	if err := mgr.AddHealthzCheck("healthz", func(*http.Request) error { return nil }); err != nil {
+		logger.Error(err, "cannot add the health check")
+		os.Exit(1)
+	}
+
+	logger.Info("starting the key rotation controller")
+	if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil {
+		logger.Error(err, "manager stopped")
+		os.Exit(1)
+	}
+}
+
+// buildZitadelClient reads the controller's own credential from the environment.
+//
+// These are the only values the controller cannot create for itself. They arrive
+// from one Secret, created once when the cluster is bootstrapped.
+func buildZitadelClient() (*zitadel.Client, error) {
+	issuer := os.Getenv("ZITADEL_ISSUER")
+	clientID := os.Getenv("ZITADEL_CLIENT_ID")
+	userID := os.Getenv("ZITADEL_USER_ID")
+	keyID := os.Getenv("ZITADEL_KEY_ID")
+	keyFile := envOr("ZITADEL_KEY_FILE", "/var/run/keys/controller/key")
+
+	if issuer == "" || clientID == "" || keyID == "" {
+		return nil, fmt.Errorf("ZITADEL_ISSUER, ZITADEL_CLIENT_ID and ZITADEL_KEY_ID are required")
+	}
+	pem, err := os.ReadFile(keyFile)
+	if err != nil {
+		return nil, fmt.Errorf("cannot read the controller key: %w", err)
+	}
+	return zitadel.New(zitadel.Config{
+		Issuer:        issuer,
+		ClientID:      clientID,
+		UserID:        userID,
+		KeyID:         keyID,
+		PrivateKeyPEM: pem,
+	}), nil
+}
+
+func envOr(name, fallback string) string {
+	if v := os.Getenv(name); v != "" {
+		return v
+	}
+	return fallback
+}

k8s/apps/key-rotation-controller/crd.yaml

@@ -0,0 +1,121 @@
+# KeyRotation declares one credential and how to rotate it.
+#
+# The resource never holds a secret value. It names where the value goes and how
+# to prove the new value works. The controller writes the Secret.
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: keyrotations.iam.homelab.riotpiao.com
+spec:
+  group: iam.homelab.riotpiao.com
+  scope: Namespaced
+  names:
+    kind: KeyRotation
+    plural: keyrotations
+    singular: keyrotation
+    shortNames: [kr]
+  versions:
+    - name: v1
+      served: true
+      storage: true
+      additionalPrinterColumns:
+        - {name: Provider, type: string, jsonPath: .spec.provider}
+        - {name: Strategy, type: string, jsonPath: .spec.strategy}
+        - {name: Phase, type: string, jsonPath: .status.phase}
+        - {name: Last, type: date, jsonPath: .status.lastRotation}
+        - {name: Next, type: date, jsonPath: .status.nextRotation}
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          type: object
+          required: [spec]
+          properties:
+            spec:
+              type: object
+              required: [provider, strategy, intervalHours, target]
+              properties:
+                provider:
+                  type: string
+                  enum: [zitadel-machine-key, zitadel-oidc-client]
+                  description: >-
+                    Which external API creates the credential.
+                strategy:
+                  type: string
+                  enum: [overlap, atomic]
+                  description: >-
+                    overlap keeps the old credential valid until the new one is
+                    proven. atomic replaces it in place, because the provider
+                    allows only one value.
+                intervalHours:
+                  type: integer
+                  minimum: 1
+                  description: How often to rotate.
+                suspend:
+                  type: boolean
+                  description: Stop automatic rotation without deleting the resource.
+                target:
+                  type: object
+                  required: [secretName, secretNamespace]
+                  properties:
+                    zitadelProjectID: {type: string}
+                    zitadelAppID: {type: string}
+                    machineUserID: {type: string}
+                    secretName: {type: string}
+                    secretNamespace: {type: string}
+                    secretKeys:
+                      type: object
+                      additionalProperties: {type: string}
+                      description: >-
+                        Logical field name to Secret key. Unmapped fields keep
+                        their logical name.
+                    reload:
+                      type: string
+                      enum: [hot, restart]
+                      description: >-
+                        hot means the consumer watches the file. restart rolls the
+                        consumer so it reads the new value at start.
+                    consumers:
+                      type: array
+                      items:
+                        type: object
+                        required: [kind, name, namespace]
+                        properties:
+                          kind: {type: string, enum: [Deployment, StatefulSet]}
+                          name: {type: string}
+                          namespace: {type: string}
+                verify:
+                  type: object
+                  properties:
+                    introspect:
+                      type: boolean
+                      description: Check client id and secret against introspection.
+                    tokenExchange:
+                      type: boolean
+                      description: Exchange a token with the new machine key.
+                    audienceProject:
+                      type: string
+                      description: Project id added to the token audience scope.
+            status:
+              type: object
+              properties:
+                phase:
+                  type: string
+                  enum: [Pending, Preparing, Propagating, Verifying, Completing, Succeeded, Failed, Suspended]
+                observedGeneration: {type: integer, format: int64}
+                lastRotation: {type: string, format: date-time}
+                nextRotation: {type: string, format: date-time}
+                activeCredentialID: {type: string}
+                previousCredentialID: {type: string}
+                lastError: {type: string}
+                conditions:
+                  type: array
+                  items:
+                    type: object
+                    required: [type, status, reason, lastTransitionTime]
+                    properties:
+                      type: {type: string}
+                      status: {type: string}
+                      reason: {type: string}
+                      message: {type: string}
+                      lastTransitionTime: {type: string, format: date-time}

k8s/apps/key-rotation-controller/deployment.yaml

@@ -0,0 +1,66 @@
+# The controller. Its own machine key is the single bootstrap credential: it is
+# created once and mounted here, and this process creates every other credential.
+#
+# The image must be built and pushed before this Deployment can start. Until then
+# the object stays Pending, which is why no Argo CD Application is wired yet.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: key-rotation-controller
+  namespace: iam
+  labels:
+    app: key-rotation-controller
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: key-rotation-controller
+  template:
+    metadata:
+      labels:
+        app: key-rotation-controller
+    spec:
+      serviceAccountName: key-rotation-controller
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: controller
+          image: forgejo.riotpiao.com/riotpiao-poimen/key-rotation-controller:0.1.0
+          imagePullPolicy: IfNotPresent
+          args:
+            - --scan-interval=10m
+          env:
+            - {name: ZITADEL_ISSUER, value: "https://zitadel.riotpiao.com"}
+            - name: ZITADEL_CLIENT_ID
+              valueFrom: {secretKeyRef: {name: key-rotation-controller, key: client-id}}
+            - name: ZITADEL_USER_ID
+              valueFrom: {secretKeyRef: {name: key-rotation-controller, key: user-id}}
+            - name: ZITADEL_KEY_ID
+              valueFrom: {secretKeyRef: {name: key-rotation-controller, key: key-id}}
+            - {name: ZITADEL_KEY_FILE, value: "/var/run/keys/controller/key"}
+          ports:
+            - {name: metrics, containerPort: 8080}
+            - {name: health, containerPort: 8081}
+          readinessProbe:
+            httpGet: {path: /healthz, port: health}
+            initialDelaySeconds: 5
+          livenessProbe:
+            httpGet: {path: /healthz, port: health}
+            initialDelaySeconds: 15
+          volumeMounts:
+            - {name: controller-key, mountPath: /var/run/keys/controller, readOnly: true}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities: {drop: ["ALL"]}
+          resources:
+            requests: {cpu: 20m, memory: 64Mi}
+            limits: {cpu: 500m, memory: 256Mi}
+      volumes:
+        - name: controller-key
+          secret:
+            secretName: key-rotation-controller
+            items:
+              - {key: key, path: key}

k8s/apps/key-rotation-controller/example-machine-key.yaml

@@ -0,0 +1,28 @@
+# Example: rotate a service user's machine key with no gap.
+#
+# Machine keys overlap in ZITADEL, so the old key stays valid until the new one has
+# obtained a token. Nothing in the window fails.
+#
+# Apply only after the controller runs and the machine user exists.
+apiVersion: iam.homelab.riotpiao.com/v1
+kind: KeyRotation
+metadata:
+  name: example-machine-key
+  namespace: iam
+spec:
+  provider: zitadel-machine-key
+  strategy: overlap
+  intervalHours: 720        # 30 days
+  suspend: true             # flip to false once the pilot is proven
+  target:
+    machineUserID: "REPLACE_WITH_SERVICE_USER_ID"
+    secretName: example-jwt
+    secretNamespace: iam
+    secretKeys:
+      key: key
+      key-id: key-id
+    reload: hot             # the consumer watches the file, so no restart
+    consumers: []
+  verify:
+    tokenExchange: true
+    audienceProject: "396757796898471937"

k8s/apps/key-rotation-controller/example-oidc-client.yaml

@@ -0,0 +1,27 @@
+# Example: rotate an OIDC app's client secret.
+#
+# ZITADEL keeps one secret per app, so the old value dies at the generate call.
+# The strategy is atomic: publish, roll the consumer, verify, and roll back if the
+# introspection check fails.
+apiVersion: iam.homelab.riotpiao.com/v1
+kind: KeyRotation
+metadata:
+  name: example-grafana-client
+  namespace: iam
+spec:
+  provider: zitadel-oidc-client
+  strategy: atomic
+  intervalHours: 2160       # 90 days
+  suspend: true
+  target:
+    zitadelProjectID: "396757796898471937"
+    zitadelAppID: "REPLACE_WITH_APP_ID"
+    secretName: grafana-oidc
+    secretNamespace: logging
+    secretKeys:
+      secret: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
+    reload: restart         # Grafana reads the value at start
+    consumers:
+      - {kind: Deployment, name: grafana, namespace: logging}
+  verify:
+    introspect: true

k8s/apps/key-rotation-controller/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+# No Argo CD Application is wired to this directory yet: the controller image must
+# exist first. Add the app once the image is pushed, so Argo never reports a
+# Deployment that cannot pull.
+resources:
+  - crd.yaml
+  - rbac.yaml
+  - deployment.yaml
+  - rotations.yaml

k8s/apps/key-rotation-controller/rbac.yaml

@@ -0,0 +1,43 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: key-rotation-controller
+  namespace: iam
+---
+# Cluster-wide because a credential and its consumer live in different namespaces:
+# the Secret in one, the workload in another.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: key-rotation-controller
+rules:
+  - apiGroups: ["iam.homelab.riotpiao.com"]
+    resources: ["keyrotations"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["iam.homelab.riotpiao.com"]
+    resources: ["keyrotations/status"]
+    verbs: ["get", "update", "patch"]
+  # The controller writes the credential it just created.
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "create", "update", "patch"]
+  # Rolling a consumer that cannot hot reload.
+  - apiGroups: ["apps"]
+    resources: ["deployments", "statefulsets"]
+    verbs: ["get", "list", "watch", "patch"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["create", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: key-rotation-controller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: key-rotation-controller
+subjects:
+  - kind: ServiceAccount
+    name: key-rotation-controller
+    namespace: iam

k8s/apps/key-rotation-controller/rotations.yaml

@@ -0,0 +1,211 @@
+# Every credential this cluster owns, described as a KeyRotation.
+#
+# One object per consumer. The controller creates the value, writes the Secret and
+# proves the new value works before it retires the old one. Nothing here holds a
+# secret, so this file is safe in git.
+#
+# suspend: true everywhere on purpose. The controller image does not exist yet, and
+# an unsuspended object would claim an intent no process is acting on. Clear the flag
+# per object as its pilot passes.
+#
+# poimen-memory is absent deliberately: it is in use and excluded from this migration.
+---
+apiVersion: iam.homelab.riotpiao.com/v1
+kind: KeyRotation
+metadata:
+  name: grafana
+  namespace: iam
+  labels:
+    app.kubernetes.io/part-of: key-rotation
+spec:
+  provider: zitadel-oidc-client
+  strategy: atomic
+  intervalHours: 2160
+  suspend: true
+  target:
+    zitadelProjectID: "396757796898471937"
+    zitadelAppID: "396757801965191169"
+    secretName: grafana-oidc
+    secretNamespace: logging
+    secretKeys:
+      secret: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
+    reload: restart
+    consumers:
+      - {kind: Deployment, name: grafana, namespace: logging}
+  verify:
+    introspect: true
+---
+apiVersion: iam.homelab.riotpiao.com/v1
+kind: KeyRotation
+metadata:
+  name: argocd
+  namespace: iam
+  labels:
+    app.kubernetes.io/part-of: key-rotation
+spec:
+  provider: zitadel-oidc-client
+  strategy: atomic
+  intervalHours: 2160
+  suspend: true
+  target:
+    zitadelProjectID: "396757796898471937"
+    zitadelAppID: "396757801210282367"
+    secretName: argocd-oidc
+    secretNamespace: argocd
+    secretKeys:
+      secret: oidc.clientSecret
+    reload: restart
+    consumers:
+      - {kind: Deployment, name: argocd-server, namespace: argocd}
+  verify:
+    introspect: true
+---
+apiVersion: iam.homelab.riotpiao.com/v1
+kind: KeyRotation
+metadata:
+  name: comfyui
+  namespace: iam
+  labels:
+    app.kubernetes.io/part-of: key-rotation
+spec:
+  provider: zitadel-oidc-client
+  strategy: atomic
+  intervalHours: 2160
+  suspend: true
+  target:
+    zitadelProjectID: "396757796898471937"
+    zitadelAppID: "397015744010781070"
+    secretName: comfyui-oauth2-proxy
+    secretNamespace: comfyui
+    secretKeys:
+      secret: client-secret
+    reload: restart
+    consumers:
+      - {kind: Deployment, name: comfyui-oauth2-proxy, namespace: comfyui}
+  verify:
+    introspect: true
+---
+apiVersion: iam.homelab.riotpiao.com/v1
+kind: KeyRotation
+metadata:
+  name: minio
+  namespace: iam
+  labels:
+    app.kubernetes.io/part-of: key-rotation
+spec:
+  provider: zitadel-oidc-client
+  strategy: atomic
+  intervalHours: 2160
+  suspend: true
+  target:
+    zitadelProjectID: "396757796898471937"
+    zitadelAppID: "396757803257036801"
+    secretName: minio-oidc
+    secretNamespace: minio
+    secretKeys:
+      secret: client-secret
+    reload: hot
+    consumers:
+      - {kind: Deployment, name: minio, namespace: minio}
+  verify:
+    introspect: true
+---
+apiVersion: iam.homelab.riotpiao.com/v1
+kind: KeyRotation
+metadata:
+  name: paperless
+  namespace: iam
+  labels:
+    app.kubernetes.io/part-of: key-rotation
+spec:
+  provider: zitadel-oidc-client
+  strategy: atomic
+  intervalHours: 2160
+  suspend: true
+  target:
+    zitadelProjectID: "396757796898471937"
+    zitadelAppID: "396757803559027071"
+    secretName: paperless-oidc
+    secretNamespace: paperless
+    secretKeys:
+      secret: client-secret
+    reload: restart
+    consumers:
+      - {kind: Deployment, name: paperless, namespace: paperless}
+  verify:
+    introspect: true
+---
+apiVersion: iam.homelab.riotpiao.com/v1
+kind: KeyRotation
+metadata:
+  name: immich
+  namespace: iam
+  labels:
+    app.kubernetes.io/part-of: key-rotation
+spec:
+  provider: zitadel-oidc-client
+  strategy: atomic
+  intervalHours: 2160
+  suspend: true
+  target:
+    zitadelProjectID: "396757796898471937"
+    zitadelAppID: "396757802602791295"
+    secretName: immich-oidc
+    secretNamespace: immich
+    secretKeys:
+      secret: client-secret
+    reload: restart
+    consumers:
+      - {kind: Deployment, name: immich-server, namespace: immich}
+  verify:
+    introspect: true
+---
+apiVersion: iam.homelab.riotpiao.com/v1
+kind: KeyRotation
+metadata:
+  name: forgejo
+  namespace: iam
+  labels:
+    app.kubernetes.io/part-of: key-rotation
+spec:
+  provider: zitadel-oidc-client
+  strategy: atomic
+  intervalHours: 2160
+  suspend: true
+  target:
+    zitadelProjectID: "396757796898471937"
+    zitadelAppID: "396757801579315583"
+    secretName: forgejo-oidc
+    secretNamespace: forgejo
+    secretKeys:
+      secret: key
+    reload: restart
+    consumers:
+      - {kind: StatefulSet, name: forgejo, namespace: forgejo}
+  verify:
+    introspect: true
+---
+apiVersion: iam.homelab.riotpiao.com/v1
+kind: KeyRotation
+metadata:
+  name: api-gw
+  namespace: iam
+  labels:
+    app.kubernetes.io/part-of: key-rotation
+spec:
+  provider: zitadel-oidc-client
+  strategy: atomic
+  intervalHours: 2160
+  suspend: true
+  target:
+    zitadelProjectID: "396757796898471937"
+    zitadelAppID: "396757800874672511"
+    secretName: api-gw-oidc
+    secretNamespace: api-gw
+    secretKeys:
+      secret: client-secret
+    reload: hot
+    consumers:
+      - {kind: Deployment, name: api-gw, namespace: api-gw}
+  verify:
+    introspect: true

k8s/apps/llm-serving/ornith.yaml

@@ -1,107 +0,0 @@
-apiVersion: serving.kserve.io/v1beta1
-kind: InferenceService
-metadata:
-  annotations:
-    serving.kserve.io/deploymentMode: RawDeployment
-    # The konghq.com/{connect,read,write}-timeout annotations that used to live
-    # here went with Kong (retired 2026-08-19). They existed because Kong read
-    # its upstream timeouts off the Kubernetes Service, and its 60s default cut
-    # off the first request after any pod restart — a restart flushes VRAM and
-    # reloading ornith:35b takes longer than that. OLLAMA_KEEP_ALIVE=-1 hid the
-    # problem in steady state.
-    #
-    # The equivalent budget now belongs to the Go gateway's per-route timeout
-    # config in rock/homelab-frontend, not to an annotation on this object.
-  labels:
-    app.kubernetes.io/name: llm-ornith
-    app.kubernetes.io/part-of: llm-serving
-  name: ornith
-  namespace: llm-serving
-spec:
-  predictor:
-    containers:
-    - command:
-      - /bin/sh
-      - -c
-      - 'set -e
-
-        ollama serve &
-
-        SERVE_PID=$!
-
-        until ollama list >/dev/null 2>&1; do sleep 2; done
-
-        ollama pull ornith:35b
-
-        ollama run ornith:35b "ok" >/dev/null 2>&1 || true
-
-        wait $SERVE_PID
-
-        '
-      env:
-      - name: OLLAMA_HOST
-        value: 0.0.0.0:8080
-      - name: OLLAMA_MODELS
-        value: /mnt/models/ollama
-      - name: OLLAMA_CONTEXT_LENGTH
-        value: '65536'
-      - name: OLLAMA_KEEP_ALIVE
-        value: '-1'
-      - name: OLLAMA_NUM_PARALLEL
-        value: '1'
-      - name: OLLAMA_MAX_LOADED_MODELS
-        value: '1'
-      image: ollama/ollama:0.32.9@sha256:1685741456770df6e3cceb2a945a5f75e020f658d1701509668d6f4688f1dd3f
-      name: kserve-container
-      ports:
-      - containerPort: 8080
-        protocol: TCP
-      readinessProbe:
-        exec:
-          command:
-          - /bin/sh
-          - -c
-          - ollama ps 2>/dev/null | grep -q ornith
-        periodSeconds: 10
-      resources:
-        limits:
-          cpu: '16'
-          memory: 16Gi
-          nvidia.com/gpu: '1'
-        requests:
-          cpu: '8'
-          memory: 8Gi
-          nvidia.com/gpu: '1'
-      startupProbe:
-        exec:
-          command:
-          - /bin/sh
-          - -c
-          - ollama ps 2>/dev/null | grep -q ornith
-        failureThreshold: 120
-        periodSeconds: 15
-      volumeMounts:
-      - mountPath: /mnt/models
-        name: models
-    podMetadata:
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "8080"
-        prometheus.io/path: "/metrics"
-      labels:
-        app.kubernetes.io/name: llm-ornith
-        app.kubernetes.io/part-of: llm-serving
-    deploymentStrategy:
-      type: Recreate
-    # 1 replica -- ornith:35b only. qwen2.5:3b moved to CPU on cp-2.
-    # Frees 1 GPU for ComfyUI.
-    maxReplicas: 1
-    minReplicas: 1
-    nodeSelector:
-      kubernetes.io/hostname: worker-1
-    runtimeClassName: nvidia
-    volumes:
-    - name: models
-      persistentVolumeClaim:
-        claimName: llm-models
-

k8s/apps/llm-serving/reasoning.yaml

@@ -1,162 +0,0 @@
-apiVersion: serving.kserve.io/v1beta1
-kind: InferenceService
-metadata:
-  annotations:
-    serving.kserve.io/deploymentMode: RawDeployment
-  labels:
-    app.kubernetes.io/name: llm-reasoning
-    app.kubernetes.io/part-of: llm-serving
-  name: reasoning
-  namespace: llm-serving
-spec:
-  predictor:
-    containers:
-    - args:
-      # bnb-4bit retired: no int4 tensor cores on sm70/V100, dequant-then-
-      # matmul is two slow kernel launches instead of one fused int4 GEMM,
-      # decode crawled at 2.5-10 tok/s regardless of TP/PP. Switched to
-      # JunHowie/Qwen3-32B-GPTQ-Int4 -- same dense Qwen3-32B weights, same
-      # hermes/qwen3 parser stack (no narration-bug risk, same as before),
-      # only the quant format changes. Plain (non-Marlin) GPTQ kernel is
-      # confirmed Volta-compatible; Marlin needs sm80+ and vLLM would try
-      # to auto-upgrade to it, so --quantization is pinned explicitly to
-      # `gptq` to force the plain kernel. Verified checkpoint size: 19.34GB
-      # (summed from the real safetensors index, not bits-per-param math).
-      # max-model-len=131072 is Qwen3-32B's real ceiling (config.json YaRN:
-      # factor=4.0, original_max_position_embeddings=32768) -- 200k was
-      # asked for but exceeds this architecturally regardless of VRAM.
-      # KV cache math: 256KB/token total (64 layers, 8 KV heads, 128
-      # head_dim, fp16), PP=2 splits both weights and KV load ~evenly, so
-      # each GPU carries ~9.67GB weights + ~128KB/token KV. At
-      # gpu-memory-utilization=0.95 (30.4GB/GPU usable), that leaves
-      # ~20.7GB/GPU for KV cache. NOTE this is a projection, not a
-      # measurement: the live reading at 0.90 is num_gpu_blocks=9527 x
-      # block_size=16 = 152,432 tokens (vllm:cache_config_info). Re-read that
-      # metric after the rollout -- max_num_batched_tokens=8192 also raises
-      # activation memory out of the same budget, so the post-boot
-      # num_gpu_blocks is the authoritative number, and --max-num-seqs=5 is
-      # only valid if it still covers 2x65k + 3x8k. The old
-      # OffloadingConnector CPU-DRAM spillover (tuned for the previous
-      # model's much smaller 16384 context) is no longer needed and is
-      # dropped. Staying on PP=2 and vLLM 0.11.0 (no version bump needed,
-      # this checkpoint only requires vllm>=0.9.2) -- plain GPTQ has no
-      # TP>1 restriction unlike bnb, so tensor-parallel-size=2 is worth
-      # trying later, but not risking a parallelism-strategy change in the
-      # same rollout as the quant+context-length change.
-      # This GPTQ requant's own config.json ships max_position_embeddings=
-      # 40960 and rope_scaling=None -- confirmed directly (curl'd the raw
-      # config.json), the base Qwen3-32B repo's YaRN block did NOT carry
-      # over during quantization. Re-applying it explicitly here restores
-      # the same math the base model documents (32768 * 4.0 = 131072);
-      # without this, --max-model-len=131072 fails ModelConfig validation
-      # against the checkpoint's own (unscaled) 40960 ceiling.
-      - --model=JunHowie/Qwen3-32B-GPTQ-Int4
-      - --served-model-name=reasoning
-      - --quantization=gptq
-      - --dtype=float16
-      - --kv-cache-dtype=auto
-      - --rope-scaling={"rope_type":"yarn","factor":4.0,"original_max_position_embeddings":32768}
-      - --tensor-parallel-size=1
-      - --pipeline-parallel-size=2
-      - --max-model-len=131072
-      - --gpu-memory-utilization=0.95
-      - --max-num-seqs=5
-      # Prefill scheduling -- see the measured starvation this fixes.
-      # V1's scheduler has no prefill/decode phase: it walks self.running and
-      # hands out tokens from one shared budget (vllm/v1/core/sched/scheduler.py:
-      # "There's no decoding phase nor prefill phase in the scheduler"). The cap
-      # per request is applied BEFORE the budget clamp:
-      #     if 0 < long_prefill_token_threshold < num_new_tokens: take = threshold
-      #     take = min(take, token_budget)
-      # The loop is `while ... and token_budget > 0`. With the threshold at its
-      # default of 0 the cap is disabled, so one long prompt takes the ENTIRE
-      # budget, token_budget hits 0, the loop exits and every other request is
-      # skipped for that step -- measured as 262 tok/s contended prefill and
-      # 0.0-0.1 tok/s generation for everything else, Running: 2-4 reqs.
-      # Hence threshold must be strictly BELOW the budget or it never binds:
-      # at 8192/8192 a single request is served per step (still starved), while
-      # 8192/2048 serves four. Verified by replaying the loop.
-      - --max-num-batched-tokens=8192
-      - --long-prefill-token-threshold=2048
-      - --enable-chunked-prefill
-      - --enable-prefix-caching
-      #
-      # NOT set, deliberately: --max-num-partial-prefills and
-      # --max-long-partial-prefills. Those are V0-only knobs. vLLM 0.11.0 ships
-      # V1 only (vllm/core/ absent), and EngineArgs._is_v1_supported_oracle
-      # rejects any value other than the default for either one, calling
-      # _raise_or_fallback("Concurrent Partial Prefill") -> "Falling back to V0"
-      # -> AssertionError, because there is no V0 engine to fall back to.
-      # The Deployment uses strategy Recreate, so setting them is an outage.
-      # V1 does concurrent chunked prefill natively; it needs no flag, only the
-      # budget/threshold ratio above.
-      # qwen3 is vLLM's dedicated reasoning parser for this family's <think>
-      # blocks.
-      - --reasoning-parser=qwen3
-      # hermes is the documented tool-call parser for general (non-Coder)
-      # Qwen3 models -- native chat template support, not narrated text.
-      - --enable-auto-tool-choice
-      - --tool-call-parser=hermes
-      - --host=0.0.0.0
-      - --port=8080
-      env:
-      - name: VLLM_USE_FLASHINFER_SAMPLER
-        value: '0'
-      - name: VLLM_ATTENTION_BACKEND
-        value: TRITON_ATTN
-      - name: HF_HOME
-        value: /mnt/models
-      image: vllm/vllm-openai:v0.11.0@sha256:014a95f21c9edf6abe0aea6b07353f96baa4ec291c427bb1176dc7c93a85845c
-      name: kserve-container
-      ports:
-      - containerPort: 8080
-        protocol: TCP
-      readinessProbe:
-        httpGet:
-          path: /health
-          port: 8080
-        periodSeconds: 10
-      resources:
-        limits:
-          cpu: '16'
-          memory: 36Gi
-          nvidia.com/gpu: '2'
-        requests:
-          cpu: '8'
-          memory: 12Gi
-          nvidia.com/gpu: '2'
-      startupProbe:
-        failureThreshold: 80
-        httpGet:
-          path: /health
-          port: 8080
-        periodSeconds: 15
-      volumeMounts:
-      - mountPath: /mnt/models
-        name: models
-      - mountPath: /dev/shm
-        name: shm
-    podMetadata:
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "8080"
-        prometheus.io/path: "/metrics"
-      labels:
-        app.kubernetes.io/name: llm-reasoning
-        app.kubernetes.io/part-of: llm-serving
-    deploymentStrategy:
-      type: Recreate
-    maxReplicas: 1
-    minReplicas: 1
-    nodeSelector:
-      kubernetes.io/hostname: worker-1
-    runtimeClassName: nvidia
-    volumes:
-    - name: models
-      persistentVolumeClaim:
-        claimName: llm-models
-    - emptyDir:
-        medium: Memory
-        sizeLimit: 2Gi
-      name: shm
-

k8s/apps/messaging/management-service/templates/configmap.yaml

@@ -6,7 +6,7 @@ metadata:
 data:
   KMSVC_KAFKA_BROKERS: {{ .Values.env.kafkaBrokers | quote }}
   KMSVC_REDIS_ADDR: {{ .Values.env.redisAddr | quote }}
-  KMSVC_AUTHENTIK_ISSUER_URL: {{ .Values.env.authentikIssuerURL | quote }}
-  KMSVC_AUTHENTIK_AUDIENCE: {{ .Values.env.authentikAudience | quote }}
+  KMSVC_ZITADEL_ISSUER_URL: {{ .Values.env.zitadelIssuerURL | quote }}
+  KMSVC_ZITADEL_AUDIENCE: {{ .Values.env.zitadelAudience | quote }}
   KMSVC_GRPC_LISTEN_ADDR: ":{{ .Values.grpcPort }}"
   KMSVC_HTTP_LISTEN_ADDR: ":{{ .Values.httpPort }}"

k8s/apps/messaging/management-service/values.yaml

@@ -12,8 +12,8 @@ httpPort: 8080
 env:
   kafkaBrokers: "kmsvc-kafka-bootstrap.sqs.svc.cluster.local:9092"
   redisAddr: "kmsvc-redis-master.sqs.svc.cluster.local:6379"
-  authentikIssuerURL: ""
-  authentikAudience: ""
+  zitadelIssuerURL: ""
+  zitadelAudience: ""
 
 resources:
   requests:

k8s/apps/paperless/paperless-ai.yaml

@@ -9,6 +9,14 @@ metadata:
     app.kubernetes.io/name: paperless-ai
 spec:
   replicas: 1
+  # Recreate, not RollingUpdate: paperless-ai-data is a single RWO PVC. With
+  # RollingUpdate the new pod tries to mount the PVC while the old pod still
+  # holds it -> "Multi-Attach error" / stuck Init:0/1 forever, rollout wedged
+  # at "1 desired, 1 ready, 1 updated, 1 unavailable". Recreate terminates the
+  # old pod first so the PVC detaches before the new one starts. Same pattern
+  # as the Forgejo gitea Deployment.
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app.kubernetes.io/name: paperless-ai

k8s/apps/secret-rotation-controller/crd.yaml

@@ -1,144 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: secretrotations.homelab.riotpiao.com
-spec:
-  group: homelab.riotpiao.com
-  names:
-    kind: SecretRotation
-    plural: secretrotations
-  scope: Namespaced
-  versions:
-  - name: v1
-    served: true
-    storage: true
-    schema:
-      openAPIV3Schema:
-        type: object
-        properties:
-          metadata:
-            type: object
-          spec:
-            type: object
-            required:
-            - provider
-            - rotationInterval
-            properties:
-              # External system: authentik | forgejo | minio | vault
-              provider:
-                type: string
-                enum: [authentik, forgejo, minio, vault]
-              
-              # How often to rotate (hours)
-              rotationInterval:
-                type: integer
-                minimum: 24
-              
-              # Application ID in external system
-              appId:
-                type: string
-              
-              # k8s Secret to update (name, namespace, key)
-              secretRef:
-                type: object
-                required: [name, namespace]
-                properties:
-                  name:
-                    type: string
-                  namespace:
-                    type: string
-                  key:
-                    type: string
-                    description: "Secret key to update (e.g., MINIO_IDENTITY_OPENID_CLIENT_SECRET)"
-              
-              # Path to git file that holds the secret (for .enc.yaml files)
-              gitPath:
-                type: string
-                description: "Path in homelab repo to .enc.yaml file"
-              
-              # Ansible template values to substitute
-              templateValues:
-                type: object
-                additionalProperties:
-                  type: string
-          
-          status:
-            type: object
-            properties:
-              lastRotationTime:
-                type: string
-                format: date-time
-              nextRotationTime:
-                type: string
-                format: date-time
-              lastRotationStatus:
-                type: string
-                enum: [Success, Failed, Pending]
-              lastRotationError:
-                type: string
-              lastCommitHash:
-                type: string
-
----
-# Example usage:
-apiVersion: homelab.riotpiao.com/v1
-kind: SecretRotation
-metadata:
-  name: minio-oidc
-  namespace: secret-rotation
-spec:
-  provider: authentik
-  rotationInterval: 2160  # 90 days in hours
-  appId: minio
-  secretRef:
-    name: minio-oidc
-    namespace: storage
-    key: MINIO_IDENTITY_OPENID_CLIENT_SECRET
-  gitPath: k8s/argocd/secrets/minio-oidc.enc.yaml
-
----
-apiVersion: homelab.riotpiao.com/v1
-kind: SecretRotation
-metadata:
-  name: portfolio-agent-oidc
-  namespace: secret-rotation
-spec:
-  provider: authentik
-  rotationInterval: 2160
-  appId: portfolio-agent
-  secretRef:
-    name: portfolio-agent-oidc
-    namespace: portfolio
-    key: CLIENT_SECRET
-  gitPath: k8s/argocd/secrets/portfolio-agent-oidc.enc.yaml
-
----
-apiVersion: homelab.riotpiao.com/v1
-kind: SecretRotation
-metadata:
-  name: forgejo-registry-token
-  namespace: secret-rotation
-spec:
-  provider: forgejo
-  rotationInterval: 2160
-  appId: rock/riotpiao.com
-  secretRef:
-    name: forgejo-registry-secret
-    namespace: kube-system
-    key: REGISTRY_TOKEN
-  gitPath: k8s/argocd/secrets/forgejo-registry-secret.enc.yaml
-
----
-apiVersion: homelab.riotpiao.com/v1
-kind: SecretRotation
-metadata:
-  name: minio-root-credentials
-  namespace: secret-rotation
-spec:
-  provider: minio
-  rotationInterval: 4320  # 180 days in hours
-  appId: root
-  secretRef:
-    name: minio-creds
-    namespace: storage
-  gitPath: k8s/argocd/secrets/minio-secrets.enc.yaml

k8s/apps/secret-rotation-controller/deployment.yaml

@@ -1,92 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: secret-rotation-controller
-  namespace: secret-rotation
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: secret-rotation-controller
-  template:
-    metadata:
-      labels:
-        app: secret-rotation-controller
-    spec:
-      serviceAccountName: secret-rotation-controller
-      containers:
-      - name: controller
-        image: secret-rotation-controller:latest
-        imagePullPolicy: IfNotPresent
-        env:
-        # SOPS reads age key from this file
-        - name: SOPS_AGE_KEY_FILE
-          value: /etc/sops/age/private-key.txt
-        
-        # Vault auth (token in projected volume)
-        - name: VAULT_ADDR
-          value: http://vault.vault.svc.cluster.local:8200
-        - name: VAULT_TOKEN_FILE
-          value: /var/run/secrets/vault/token
-        
-        # Authentik
-        - name: AUTHENTIK_URL
-          value: http://authentik-server.iam.svc.cluster.local
-        - name: AUTHENTIK_BOOTSTRAP_TOKEN
-          valueFrom:
-            secretKeyRef:
-              name: authentik-bootstrap
-              key: token
-        
-        # Git
-        - name: GIT_REPO
-          value: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
-        - name: GIT_AUTHOR_EMAIL
-          value: [email protected]
-        - name: GIT_AUTHOR_NAME
-          value: Secret Rotation Controller
-        - name: FORGEJO_TOKEN
-          valueFrom:
-            secretKeyRef:
-              name: forgejo-registry-secret
-              key: REGISTRY_TOKEN
-        
-        volumeMounts:
-        # Age key from ExternalSecret (synced from Vault)
-        - name: age-key
-          mountPath: /etc/sops/age
-          readOnly: true
-        
-        # Vault auth token (projected)
-        - name: vault-token
-          mountPath: /var/run/secrets/vault
-          readOnly: true
-        
-        # Temp working dir
-        - name: tmp
-          mountPath: /tmp
-        
-        resources:
-          requests:
-            cpu: 100m
-            memory: 256Mi
-          limits:
-            cpu: 500m
-            memory: 512Mi
-      
-      volumes:
-      - name: age-key
-        secret:
-          secretName: sops-age-key
-          defaultMode: 0400
-      
-      - name: vault-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: token
-              audience: vault
-              expirationSeconds: 3600
-      
-      - name: tmp
-        emptyDir: {}

k8s/apps/secret-rotation-controller/kustomization.yaml

@@ -1,15 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: secret-rotation
-
-resources:
-  - rbac.yaml
-  - crd.yaml
-  - external-secret.yaml
-  - deployment.yaml
-
-commonLabels:
-  app.kubernetes.io/name: secret-rotation-controller
-  app.kubernetes.io/component: automation
-  managed-by: argocd

k8s/apps/secret-rotation-controller/rbac.yaml

@@ -1,53 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: secret-rotation-controller
-  namespace: secret-rotation
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: secret-rotation-controller
-rules:
-# Read SecretRotation CRDs
-- apiGroups: ["homelab.riotpiao.com"]
-  resources: ["secretrotations"]
-  verbs: ["get", "list", "watch"]
-
-# Update status
-- apiGroups: ["homelab.riotpiao.com"]
-  resources: ["secretrotations/status"]
-  verbs: ["get", "patch", "update"]
-
-# Read k8s secrets that will be rotated
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["get", "list"]
-
-# For recording events
-- apiGroups: [""]
-  resources: ["events"]
-  verbs: ["create", "patch"]
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: secret-rotation-controller
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: secret-rotation-controller
-subjects:
-- kind: ServiceAccount
-  name: secret-rotation-controller
-  namespace: secret-rotation
-
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: secret-rotation
-  labels:
-    kubernetes.io/metadata.name: secret-rotation

k8s/argocd/apps/08-secret-rotation.yaml

@@ -1,32 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: secret-rotation
-  namespace: argocd
-  labels:
-    app.kubernetes.io/name: secret-rotation
-spec:
-  project: homelab
-  
-  sources:
-  - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
-    path: k8s/apps/secret-rotation-controller
-    targetRevision: main
-  
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: secret-rotation
-  
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-    - CreateNamespace=true
-    - RespectIgnoreDifferences=true
-    retry:
-      limit: 5
-      backoff:
-        duration: 5s
-        factor: 2
-        maxDuration: 3m

k8s/argocd/apps/30-security.yaml

@@ -30,33 +30,6 @@ spec:
     syncOptions:
       - CreateNamespace=true
 ---
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: authentik
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
-spec:
-  project: homelab
-  sources:
-    - repoURL: https://charts.goauthentik.io
-      chart: authentik
-      targetRevision: "*"
-      helm:
-        valueFiles:
-          - $values/k8s/infra/iam/authentik-values.yaml
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
-      targetRevision: main
-      ref: values
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: iam
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
----
 # ZITADEL — the Authentik replacement. Coexistence, not cutover: Authentik keeps
 # serving in the same `iam` namespace until the last consumer moves, then this
 # becomes the only IdP. Migration plan (outside git):
@@ -106,11 +79,47 @@ spec:
     syncOptions:
       - CreateNamespace=true
 ---
-# Raw IAM manifests: key-rotation cronjob + authentik migration job.
+# ZITADEL core objects (ServiceAccount, Role, RoleBinding, ConfigMap).
+#
+# The chart declares these as pre-install/pre-upgrade Helm hooks, and ArgoCD
+# prunes hook resources when a sync ends. That deleted the ServiceAccount and
+# ConfigMap the ZITADEL Deployment references, so new pods failed to start with
+# `serviceaccount "zitadel" not found`. This Application owns hook-free copies,
+# which makes them ordinary desired state that survives every sync.
+#
+# Wave 2: before the zatadel chart itself, so the ServiceAccount exists by the
+# time its Deployment is created.
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: iam-jobs
+  name: zitadel-core
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  project: homelab
+  source:
+    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    targetRevision: main
+    path: k8s/infra/zitadel-core
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: iam
+  syncPolicy:
+    automated:
+      prune: false
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+---
+# Raw IAM support manifests: the SMTP -> Gotify notification relay that ZITADEL
+# points at, so verification and password-reset codes reach the phone. Wave 3
+# alongside ZITADEL itself; the Secret it reads is created by sops-secrets at
+# wave 0.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: iam-support
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "3"

k8s/argocd/apps/40-data.yaml

@@ -1,4 +1,4 @@
-# Wave 2 — dedicated per-app CNPG Postgres clusters (authentik-db → ns iam,
+# Wave 2 — dedicated per-app CNPG Postgres clusters (zitadel-db → ns iam,
 # temporal-db + visibility → ns temporal). ONE App, ONE folder (k8s/infra/databases).
 # CNPG operator is Phase-0 bootstrap; these Cluster CRs are GitOps — no circular
 # dep (they run after ArgoCD is up, before their apps at w3/w8). CNPG generates

k8s/argocd/apps/60-applications.yaml

@@ -171,40 +171,6 @@ spec:
     syncOptions:
       - CreateNamespace=true
 ---
-# Consolidated: homarr + homarr-patches → homarr
-# Helm chart + values + PostSync hook patch (fix-probes-job.yaml)
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: homarr
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "8"
-spec:
-  project: homelab
-  sources:
-    - repoURL: https://homarr-labs.github.io/charts
-      chart: homarr
-      targetRevision: "*"
-      helm:
-        valueFiles:
-          - $values/k8s/apps/homarr/homarr-values.yaml
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
-      targetRevision: main
-      ref: values
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
-      targetRevision: main
-      path: k8s/apps/homarr  # PostSync hook: fix-probes-job.yaml
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: dashboard
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
----
 # Portfolio site at riotpiao.com - static Next.js site from rock/riotpiao.com repo.
 # Points directly to infra/portfolio/base (bypassing repo's own argocd-apps.yaml
 # which has wrong URLs). Image built by Forgejo Actions on rock/portfolio repo.

k8s/argocd/apps/99-oidc-bootstrap.yaml

@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: oidc-bootstrap
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "5"
-spec:
-  project: homelab
-  source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
-    targetRevision: main
-    path: k8s/infra/oidc-bootstrap
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: kube-system
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true

k8s/argocd/projects/homelab-project.yaml

@@ -34,11 +34,9 @@ spec:
     - https://prometheus-community.github.io/helm-charts
     - https://grafana.github.io/helm-charts
     - https://helm.releases.hashicorp.com
-    - https://charts.goauthentik.io
     - https://charts.zitadel.com
     - https://strimzi.io/charts/
     - https://charts.bitnami.com/bitnami
-    - https://homarr-labs.github.io/charts
     - https://go.temporal.io/helm-charts
     - https://portainer.github.io/k8s/
     # Substrate charts (cert-manager, ingress-nginx, reloader) — app-of-apps owned

k8s/argocd/secrets/authentik-secrets.enc.yaml

@@ -1,25 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:Fc0=,iv:UFqMFeZTJZtFMoNeusjAoSI60U9StZS4IXw+n8JQCRM=,tag:uUvY4+jcjiSJHs0HDS3/7A==,type:str]
-kind: ENC[AES256_GCM,data:NUw86IEw,iv:gh4Vqn6uteYnYIFcXT/QVxRPKm+G+j2aIVuV71nZ4k4=,tag:nZA/x75Kx4+CoSx66BsvkQ==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:qex150pm0eGwYiiI05y9LUs=,iv:5Tk001T796c4HFikoh1ZVB6ierBfDqOUkFs5ilkr+V8=,tag:LiDAiCH7w6aRS41VKIlIKg==,type:str]
-    namespace: ENC[AES256_GCM,data:nI91,iv:c1hBWGMkVb+vg+MKNzty8CFfXxQabXEtT+EpiuQZNvo=,tag:BsGtJDbBadDdTa687+Sdag==,type:str]
-type: ENC[AES256_GCM,data:3rXawlSD,iv:FUtLK4KP7v/SBF08ZcU6siIO1qfjlJirf2x5PyzAjuA=,tag:mSIQ+Y43+wDfZGRbQ6a0Og==,type:str]
-stringData:
-    AUTHENTIK_SECRET_KEY: ENC[AES256_GCM,data:i5tVOWnN9a/cfhs6gckveRxUpiN7Ie227R/74kOIz6lQ5US2hkf03W5qSGCrzheL3DB0i8+d0iJYsApjn/wCiN7ndZZVFko3W5jDfVPybxc=,iv:djF1G9JHT5B7ziTokA/UuPpG+tG2LvFU4uMAR0x4M6o=,tag:vHOd7jLYkM8Evnr0QUVrCw==,type:str]
-    AUTHENTIK_BOOTSTRAP_PASSWORD: ENC[AES256_GCM,data:PjvYtH03CzQbTXEqt/Z18+u1zJdok7DLwDn51FUZXDA=,iv:pSwSm8hB0/Q8uOAcOZ1rTqq7BF782EglG19GGeghm1E=,tag:qGCQFWCrwsWBOiQ07ySMUQ==,type:str]
-    AUTHENTIK_BOOTSTRAP_TOKEN: ENC[AES256_GCM,data:1tnekGo0GIemJCMRenjN0yNeSiiMl/kky8ms84TsqBLaQ0lQzPxjq9qtgNJwoAsufxrznrkDVKjeOEHNYcA82A==,iv:NNFWSLMILoWccA9ihy1OArSS1X3OySB7PIHdXZdyzlg=,tag:t2w+KyReOXftTrU9pBQDnQ==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSZGRKWm9PTkNSOENtREgx
-            M2V3Z0xxOXRhRGVRclo3SzBKRkc0VmtCY0NnClJPSGJRcUlzWmNFeTZ1bmorNEV4
-            U3l3TzVlMTlrWkJnQzBtUTJtcUwrM3MKLS0tIEJrMWZrbllYYUZKN1V4MVMzcXAv
-            eUtheHlNMHpsTEJXZ1FTMFVxbWloa0kKLRkE1Du+4gdOLerOl9y0mZw+8fqfECQY
-            uP64Q+9BSuPYNiTLZvYDzmdoy+KTS7i7C9rf+iU96R/crbQLamV9Ew==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-08-12T20:37:07Z"
-    mac: ENC[AES256_GCM,data:b3pDx340d1iZxsPPXzACckoLBrW+XjX1qlGrWEEI30j2Ao0hewTRZJyHbdI97A6b/hqzBN/4tjqqkdqm8goNhUQweMLTw86X6sALuE0aLS9wK53qjqih8fQwQBbgLDtjFXtW26h+smIm7aB5ZSDvU2le44HDXuWd83sWtCavNq0=,iv:ZMDsoKpygFJrYpXy2dA0IlxAi0jt24rxF72eUzgQs7k=,tag:WWE7G7+c9JK6fF1U9V8igg==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2

k8s/argocd/secrets/comfyui-oauth2-proxy.enc.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: comfyui-oauth2-proxy
+    namespace: comfyui
+type: Opaque
+data:
+    client-id: ENC[AES256_GCM,data:jFLgcrh1tiAU0pijGxy+/mFsFHzI5zSi,iv:7GYL4xtPnzyZWtEA0egPHhzvpXGevkIH3Cvr+oD9hKI=,tag:UeDTIKlfcYnOOOJiPNgN0g==,type:str]
+    client-secret: ENC[AES256_GCM,data:9QFu5a2EkEMjc/B0moPIkMEChrN0Qh5BQtAzFcvW4liKxzVAPbTKgQOJeND+NQjn5ZoE89kqqRyqNJF3bT3H1pWoDFngk9J2X7BN/9r6Qyubias0Jukydw==,iv:xf2kT0fbnJat3L3xxUYm3ht0YvHptU/RIdt9Eh0D6xU=,tag:8iknaQ2kKP1OZ/1jRCa+1g==,type:str]
+    cookie-secret: ENC[AES256_GCM,data:Qq+l4go/CFtfsZrgYUcTj9bB4sreu2GEqJnu15H6fxIlD7IgnmrodPoIVNpWcdm6LSYabGjm2jraN6RP,iv:EOoDHgvIydzHCC5POohjPq3Vj2YTpzhIhvdG2FzKKzc=,tag:iDXqzFU1Z79bzpG4I4xfww==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxOUtCUDduMVU5U1J4WXZX
+            Q1VzaFRVdXlHaEZpeVJNOWprdDhUOEd6Z1hzCi9QZEpXN3NDSENzUE9RTGdpb3Va
+            eVNHVTFLbXpMU0x5UWlFLzZnVlllWE0KLS0tIDZldVNqR1loNHlXZWovNWZ4WjFD
+            dVErenJDM3haSStxZEVWZUtBbDBIZ1UK9x6Gy4drjfUz2goAaI+oeUDWdNHQFAJl
+            JGI+X81r/6Krg5N8QDa/mE96E2M2G0yAO5FS1YbpCKOITUEyheacnQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-10-27T21:17:08Z"
+    mac: ENC[AES256_GCM,data:tTGmWFidEWTWHgKPV7b5ABOJwwlP1yQDK5Jd60c9ko6IsmP2GBBPCth7kJgPXuPcw+NHbJ7yt7bcVto7GkPdtY9daJmjPq0Gt16ZO4Xi4hCk22JVKqi/KJcKD/KB0r/VO9w093/Who5CcYgqifextfca4CuxS5m5dcOn4kRJCfE=,iv:0fDvvQr9wp8IrD16u88Ml4HsPEeMhd8R3ljQJoIpw3E=,tag:AanM7C6vbaBBmus1u1GRoA==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.3

k8s/argocd/secrets/grafana-gotify-bridge.enc.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: grafana-gotify-bridge
+    namespace: notifications
+type: Opaque
+data:
+    app-token: ENC[AES256_GCM,data:MnkKT0/ubJctmLTFXjdCZjNlz+KgQLsPwIKCmPF2weEtMw6ieRfb3+B7OUlIiDqpktdPaJA/znsMOYPXT2aXDqyKquA=,iv:vcAGkgfTheoViZ7OzJJhbNf0boIbRBZLr60ieW5DhLk=,tag:iBDJEjGScxHopkNExh7jDw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYYWZYNFBHbVhRSkZoa3dH
+            dWp3WllyVmRPcExPTndZUlFsTG1YMHN6WW1jCjRiS1M2U0tIM0tCdGhJOUQ0c2JW
+            bXNTTExDeVVmcExuNStldFdhTHMrVTgKLS0tIDN3d3JKSEtIUUFhVHROOVBUaUNO
+            UUVGcVVkOVJmN294dE5DS1R1UkxiZzgKx0MEkIrFsO2dQwjY2410Nj0Nyy3QgC3L
+            T844m4WT+mxFwB69/y0luGkn4aXMS3xrHHWUC+vjAkM4Unp+MKhhrg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-10-27T19:35:38Z"
+    mac: ENC[AES256_GCM,data:Gf5jnvWP+jBRc8fvQHyrnHnTDaaUTcXQgoOqm7Drax5FpBYEHa36pdKaUq+XR6VBd7ch6Ia/f7YavhS47ybgR3jn+w+trMxkpwtZhm5clw2Lo3Hm7Cvi4fG4qhcjm1C8/NOnWGsi5Qm+TJqyG509p9HNTvM99SzElRovPZldLL4=,iv:10hA6nq0WIO0a2I4ZW6uPGXPjesFgxrwmXohNO3FZz4=,tag:bJ37e8jvgEactq6T/pM2UQ==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.3

k8s/argocd/secrets/grafana-oidc-secrets.enc.yaml

@@ -1,23 +1,28 @@
-apiVersion: ENC[AES256_GCM,data:rGU=,iv:w1yJeQvN0MPZlPx8VQZmC6zkRaHW4rtjjROea0Kx9X4=,tag:qgYgVUGMQ2BtN0RZ0nZYjQ==,type:str]
-kind: ENC[AES256_GCM,data:wp2QP1he,iv:C8c/jKh5pnBOtHqXsTEchGf9DACU/5hOJ0Mp/+Jk1kg=,tag:QUZNeguRXdi3JO6Ov6GMDg==,type:str]
+apiVersion: v1
+kind: Secret
 metadata:
-    name: ENC[AES256_GCM,data:jVsnAcFTlRiKxDoU,iv:bWEqo28kH3bxzfI3ipiY6dsqhIcl9wIxBjFu0mxVGLg=,tag:PVWTveI8xhvLxvXPldhimQ==,type:str]
-    namespace: ENC[AES256_GCM,data:ZHnVZyd3wA==,iv:3evUnFTQfRz/ZilUQIl/9dsCba3nsX6o/iQsGXMBfgM=,tag:+9kp+VRu1ksroDTbTGmGPA==,type:str]
-type: ENC[AES256_GCM,data:bHX+Bu9o,iv:8qqNddsuw4YoHAuJfUcPIqjcqNySIh5Ln8OhsfZxuk8=,tag:P7QGUXo9Io2Y19YqlWv5sQ==,type:str]
+    name: grafana-oidc
+    namespace: logging
+type: Opaque
 stringData:
-    GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:nJz9pqa6w9ZGOjanZ32D38Bolg2YrdHs1crhb2uZkKyaaKDpklVb4FOKZ46K+NS1NXjoS6XDUAlV69CSvm1PeA==,iv:g9F/iLuzNC0WogtDJ/TAb3+97N6iGkbOTlb4SzYzwx8=,tag:4F3kUheGbtW2U6jgOvRO1A==,type:str]
+    GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:fGqA1ofVme1lVLxFjWIiU7sbvE9ip2Af7C1ua3+HdidlcVgkwW59vVlXZhgBRdoif86C8LKQSyoCGUqiO+740g==,iv:6Kv2ybbJg1GT8DLqz9P5y+E1zr7vcIBDMUErmvxNTaw=,tag:0wK28B3G/owCVPPqb2sLmQ==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
     age:
-        - enc: |
+        - recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+          enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrUkxLMEV3aEpILytic0Ux
-            V2VEV2EvcENJVnNNRUtBbGkwT0d6eUxYeEFvCjZPSkU2MG5qME5jZ01mRVJwTUFL
-            M3M0V3c3QXBoRml1Vm9NWW5JTlNRSG8KLS0tIEJnNlFmdFJXb1BPaVJzTmo1RDQv
-            VXZOVHRHUEZJRUZ4eGZGM1RxSURyWXcK3ZyYCPhRUvpvT/pjPQGJoLIwaktZY6Tg
-            LS0cIDUhjPFbeu7qUATOrat6vMUi0UREbXSFZ1KyAjNAwJZaUusPMA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArTXMxMWdVRHIvbWh1bVNk
+            bEFFNlgzNU9zTjlzY2o3VGdnbFpnU2lkYmxrCjF4aWVGSlJaNkcxODJ6RDkrVFo2
+            UkV2RUwwVHFCd0xMNG9RWXdTUHZGaXcKLS0tIHVaWjhaNHRtS2c0UkVzRk83ckhj
+            OCtBVFR0d1F5amVhV2E0emRZWThvYjAKFW46i9brIL9ZoO1CEn+IewIdoUhvYK/A
+            RqzZ6xV+mhlDj0zC+SpVcEm/Ki83nMYOj4+vQingZlr/Kr3Nwb0iLQ==
             -----END AGE ENCRYPTED FILE-----
-          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-10-26T04:03:16Z"
-    mac: ENC[AES256_GCM,data:0cgVNtFMwhbEHBxu7T1XfstcQlgUTxijq9Mz36zC60E7kYXRNwGt2/0KoCaqaE0leypwAdrPn2OjeoDPeCN6x+n0vLRVX2tnli6HazBLbRsPHljDAV0ASF07iNhb0PvgtWay432Mm+sGATkel3ITdAaP0lISNLUYfEe1/TbYHkk=,iv:FZ9Bgtk7LOC3aOSOo1+50zwLGhlcUZYJaUQ9r05cAn0=,tag:tsLQ1frZ7li5l717CCtgoQ==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2
+    lastmodified: "2026-10-27T19:44:32Z"
+    mac: ENC[AES256_GCM,data:EJew+p/kJrurcNpLlFxJGTl69hQYxn3IkzP7EDtdSriW/WI7X1xNLC2dp/dTiLomGmG1uh6+2JI9Sc8gXmrRAWLELAbiOaYbcoU6gi89BjTCWGDAMX4lNSIuH40rsGs4YtYj5U7SGfgx5qto4ZH7LxjBmxzPWM/Xz2Uq/I5jV4k=,iv:LdhjhwCfPUIa7D0gved8Twf7ujN+dg3lN8lCnFBFs0g=,tag:bjkwUCMtR8IBL9BkbuXcnw==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.3

k8s/argocd/secrets/homarr-auth-oidc.enc.yaml

@@ -1,24 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: homarr-oidc
-    namespace: dashboard
-type: Opaque
-stringData:
-    client-id: ENC[AES256_GCM,data:IFNjfDMrObaxfGwJpiYqPP60,iv:0WR2C+DEsq8I031A9Bopotn5TYdISApbTF46jJBgtVs=,tag:LGijMS27pbbZnOLJqGNXQg==,type:str]
-    client-secret: ENC[AES256_GCM,data:q0MHjvuTIKbbMUZpsptOuo3zrabwaWxZS3MLqRdI1Rt7eod5ORAYeZmpllHmojRFve9x/SKkJ+sctafzwPuAPA==,iv:1ZLXOc3a85+MRx3v/XsW8JhsxbCQ26laou8PvvrQvH0=,tag:PRRTsyE2fGGS3dKPh43a8g==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpV1ZlMWxaNTlCUjJjbG9F
-            NzFGMXBXYThZT285UHA0bGdwNFJqQTNMckhvClFSTEdseExjbVFtbkdsTUpSSGVn
-            WGsyUmxvcVViVVVNZjFRdmJWZlB6TGcKLS0tIE01QjFtVFBGUlpXbjVJcDMwMzRS
-            MEh4dUZTZ3puaXF2Uk03Ym50QmdSM1EK6Kmdv3s8/4nI/6Uk4G5FOh1Gxp1u9eYI
-            L7MOW0TFkScTuDiu9iJB+CjB8b8Z0kwSYTigYj9ue2y0a1hDYCfQtg==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    encrypted_regex: ^(data|stringData)$
-    lastmodified: "2026-10-26T03:56:19Z"
-    mac: ENC[AES256_GCM,data:tV7o9zY6dpTdTvNJY8GBkdIB71thoy79RQSHsczednmXXzlNFddZxR/UenJ87jJ1JyzMUKL3CxArYojpuamahQcSXifVar0kotgNCs67A7+xfhHudCnKLMWDfDOom6DdWto6bMNIk/0TF6Wy0m1hkSsxwkdqETVs3b6ZUg/l8Rc=,iv:PE7y5oVMEM9XKQnDZmdRFRR3blzz2SZQFLxOMyILuec=,tag:SM9vJU1zlQ02XJijSiGCMg==,type:str]
-    version: 3.13.2

k8s/argocd/secrets/homarr-db-encryption.enc.yaml

@@ -1,23 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:FO4=,iv:kKIuJp4uGeX6vECsXk7w43F9S281jObQchmK8r1+kmA=,tag:x5LYd34dzNDLCma/78M4+w==,type:str]
-kind: ENC[AES256_GCM,data:o4RTN8SK,iv:uyOJWjDmHIPuBl9Wc1S/HxUabV2yytWr1bntHW68sTI=,tag:3On0SnQVJ/ICMMryQe+8JQ==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:a89dHmLdSeMHE7ZP0Q==,iv:OWJvJhFqJ7A0UGVJnZILzCJ/4VuVFib9sUDjXuwyqJQ=,tag:1XrIQn1GDh8RQ4vmQAu7+g==,type:str]
-    namespace: ENC[AES256_GCM,data:4wBVpZJgQGM9,iv:3Tn1u/2TP/+SnELu34PDf4Jauf2L4f8+MtgrPIlyKzk=,tag:L3qbKFBjm16g8KX5vUsK6A==,type:str]
-type: ENC[AES256_GCM,data:mdrF9vUb,iv:7ukOgwXlnRf5mpJ/+6YXtyGRonnqehEgT4pJJIafw7c=,tag:90mt7jpNb3N80kCEi+R/rA==,type:str]
-stringData:
-    db-encryption-key: ENC[AES256_GCM,data:NWJryAEd/eUJxbNiu05RzLF/l7GDxIQM7RQe3xKBz6XklgRAFwQxxjakcVd85pePUBaQYz3zttFglWhfJlWhkA==,iv:eUWbcs0B/mIheyAQ2+DyKgcA98CRKQGAVC3O0WIkfU8=,tag:be06X6AQqlohYlxuYoZiTg==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1Ym5yQ1pmWHZjVnYxbUVO
-            SkZ5dnI2OXR3cmZjZkM0K1ErMElLNktlK1JFCmpleFBrcXkwcDA4cGFuWWN6VDQv
-            dVV4NjB4MjEreENVQnZ2ejVLblRYOVUKLS0tIG9VbXJvUmQ3SzMzN3IrRDlac2sr
-            eGZNYXBoZFZDeisrVCtUMXVPaEpoNFkKjwhUU+Zsqv4Be+m558fET5UhF/2rO73J
-            AhGbJVaA7PaOCswPWiOLso26zD+MBB3VKHNdUFnenpoM16Nu4pOf5w==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-08-12T21:07:30Z"
-    mac: ENC[AES256_GCM,data:KrGQY/eOmihYCvQCbfcM6bZ6rfx4zKh62M8NM0VQr1//1dSHpOOh25dYGLuQeECnqLxSpGQNWzr2xjUYWs4NOdSEFGq6FL2iHE3LnqoBZspp/JFJYP6+z/8jSUojwKEW7OuZZdPN6gF2u+IPOeWbGftnjS7X+atoSkYag2ty2vk=,iv:IOPEgBizsxrVoK5oSdWmi0uCBUnReOEnMYXuwSBKTzA=,tag:9k/XQ/AE7wSFq5XMbY0FTA==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2

k8s/argocd/secrets/homarr-secrets.enc.yaml

@@ -1,23 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:4OY=,iv:0Lgui0+X2oTlgCX5HEIIihEsGJD0C2+pDIOTCNi4r+g=,tag:uL7vlreaHjcLJjV7e5I7PQ==,type:str]
-kind: ENC[AES256_GCM,data:x/ltkind,iv:KRBfS7COsTs/l3Fhyk5FvH7IVc+r/6M6FVOo+kPDe1Q=,tag:UuTbe213hDfK/WUtKS/doQ==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:LpOEecTJBuGy5PqNSFM=,iv:Q+DCLGtw3wihhdAgEbzYHyQhFTPWFyE2iJKl9mYaA2E=,tag:E2wrig4lRXGDvSCHec5clQ==,type:str]
-    namespace: ENC[AES256_GCM,data:6kMVCXaF68NO,iv:gnCCkV7GKXA2HWOOeNUGnpAycf8U7pl6F8Vfo6DhLR4=,tag:0VdeySsuhUr2heXyGXZwBg==,type:str]
-type: ENC[AES256_GCM,data:6muC3Zqh,iv:gBaC+6MXvZY/bIpy/cEG/zWwLBaUFMVfxAHa1OnwfnQ=,tag:v6NYyhAKAwovluHAXNaOVA==,type:str]
-stringData:
-    SECRET_ENCRYPTION_KEY: ENC[AES256_GCM,data:jX9ULlaBYTSTFGRMplSder5rMrsz7THU3kgJSGef0r5rZvtoaAG9NVYU2QUEuD0sZgfqRooeMOkDCAqFc8qsuw==,iv:uOmx8w3XPKnoxfasf7gqi/bljxigpLwaAC30c2TroKg=,tag:Dmbu6m3+UZa1w0UR0LRh9g==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6TDVyNGRtYWgzMDYwdjdr
-            NXJWcGJZNUx6YzBGWm1nWlp0SlN3WXhaR0VBCjZ3bDBmUTFCUjg3U21wak90eHZK
-            NlRCTUZQSHhoS0ZSUGZ4UHhST01KNmMKLS0tIGUxcGo0NmJ2bmJ6eGJ3QWxzYVM5
-            c2Z6UkFjQmZ4ejIvK1JQQkZ0VFFIZ3cKA8UzmGsX+s3yOermOHqbnnEtekHCTqmC
-            R3Jyzf6OolZMJpNwbetcsOfgO61aM7LHl/Xb/hFLbLjZ+eECrt8VpA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-08-12T18:02:01Z"
-    mac: ENC[AES256_GCM,data:HTrEEVDm8JqnVBFaY/FJknxma0nI95tRiwVc0K76k+2R4jgKCBA3EUAzPVS+gA4rTAeKHPSHrT2eidlkseT2WQUjqMRrpHcUsbSjNfpTEY2g/U0PIiOXZMRGfwmsQVgmu2fqeMOyzDSyya0scdWJXPraRPNZ+OpEkNVlm4rWcgs=,iv:KY3dnnmooJgsu66wc7gbzeIGUXZNgVrxAhpAwxoG+G8=,tag:7r6d41oTD136N57rtY7auA==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2

k8s/argocd/secrets/igotify-client-token.enc.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: igotify-client-token
+    namespace: notifications
+type: Opaque
+data:
+    client-token: ENC[AES256_GCM,data:W+InmDyZkU0i+OqQUsIaRNY/3p6zjMC19ASj/qYHTldhtGmHwj4koQX3tIxdCQV72xZKOxsc8eV3hGX3pqbW02c2/ng=,iv:wWI5AZdpxnzX61f8iTiWmxKcDFMaFM4PHFYo4DMBK4Q=,tag:CpE8Kg5V8fL7P3oAjWjSvQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwaUlFU0xKaEs0SWcxWEEr
+            T0tUSmErR08zVkhuLy9VMEc3VXdmU1o3cWdrCjhuOW1yTmZPdWxDZHhMeUZtQlcz
+            UmVzaEMyVHZOZS9KVHdMd2pndUJwUW8KLS0tIGxYeENwVEFDdUpDTGszdGtNRHBQ
+            Y041WW9HdTJwUlJCUGhMN2RGZWZpUmMKiQbi/O9X3cFJgqw3tvwWcyy8QKkUuq/7
+            Y+V51R/WFobEQuAZLmDKgWcPSGt51effufB/Vm9LRRqtbkbYQAIoXQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-10-27T19:14:20Z"
+    mac: ENC[AES256_GCM,data:Hxl7AGzMOMK0pwe6T9ZmrE6K45XhQkq4qk/7YkrVuneL1e7jc8Bmv4NlywqRkt9fPVOCMwKikeX9U3ZcsqK13xPPfm1CmAxV3CCluwK0/9589N70OQxL4qJSkO6CXyGaa0Y9wVRX4y/N3wSjW+d25+GOYUXrOxkRpVyU4GFSqAQ=,iv:0Af/MCZBEYJVI3yi7DpPX1eBKwSANXJPCpSAEE3zCq4=,tag:SS1U9TfRQR3z8KkoQ6ZuZA==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.3

k8s/argocd/secrets/secret-generator.yaml

@@ -9,18 +9,15 @@ metadata:
 files:
     - agent-pod-models.enc.yaml
     - agent-pod-ssh-key.enc.yaml
-    - authentik-secrets.enc.yaml
     - cloudflare-secrets.enc.yaml
     - cloudflared-credentials.enc.yaml
     - forgejo-registry-pat-api.enc.yaml
     - forgejo-registry-pull.enc.yaml
     - forgejo-runner-token.enc.yaml
     - forgejo-secrets.enc.yaml
+    - comfyui-oauth2-proxy.enc.yaml
     - grafana-oidc-secrets.enc.yaml
     - grafana-secrets.enc.yaml
-    - homarr-auth-oidc.enc.yaml
-    - homarr-db-encryption.enc.yaml
-    - homarr-secrets.enc.yaml
     - homelab-ca-secrets.enc.yaml
     - loki-secrets.enc.yaml
     - minio-secrets.enc.yaml
@@ -39,6 +36,9 @@ files:
     - pi-sandbox-secrets.enc.yaml
     - etcd-defrag-creds.enc.yaml
     - zitadel-masterkey.enc.yaml
+    - smtp-gotify-secrets.enc.yaml
+    - igotify-client-token.enc.yaml
+    - grafana-gotify-bridge.enc.yaml
     # Login UI RSA keypair, adopted from the chart-generated Secret so ArgoCD
     # owns it. Without this, the chart re-generates the keypair on every render,
     # which changes checksum/secret-login-service-key and leaves both Zitadel

k8s/argocd/secrets/smtp-gotify-secrets.enc.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+data:
+    token: ENC[AES256_GCM,data:CUJ0rUtgye71fpFz50RSDXJeG+t8Wjrm6T6jboVPbt2FVuIRSscqKg/Pc3k/L8nvLvrkYlzz1rbYu9v5NAdNF2c35AQ=,iv:tsfQ+v4qwj6H7G/O79b6m4XMWRw3mwE67f+4LjDCOoY=,tag:SLGGBYtYoF45AQstETPYZA==,type:str]
+kind: Secret
+metadata:
+    creationTimestamp: null
+    name: smtp-gotify
+    namespace: iam
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFWmU5TUxLeGU4YzUxRU9G
+            ZFR5a2hqS3huYlJtempaQ25zUkljUDJLSENrCkx0bjQ4UVF3UWpWa0t3WHQ2bkNl
+            eEp2d0dQRHJSOExIYjN4TmRTZWdQY00KLS0tIGF5enUxTmxRTHlQRUt1aTFIYTFB
+            MEJaOWd6SnhWQU1PQXdUZDJqWmp2MGsKIOOrp52+d3M8AQlMw0VSnLQ2efDtC6Ye
+            oC/TPqYi9SqYNxaHkODS2QZN9msyfRFcgUh/6ZXr8sivnpwRY8ZZtw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-10-27T06:24:20Z"
+    mac: ENC[AES256_GCM,data:9Jsnij+I1MhLhIPLt2hr1a6Jryf8XcAb4QAknGkX1hNEN+Z9HT5PSnPARqyhl0WTxe8813a/G0h93SJ0A419jIzZugv6zEj4STsOG4hMI8O2NniqOwiDWl+Az9SRXIQ0ahH9En7ssvEdiosIDGJSz31ufNc8FbwKnHvgWCwfK9Q=,iv:VNTOpQkDakoaCu2dG4lRbd+6AzimNZVNzggq/7C2eM8=,tag:cJI9WdnKiG3K3J4LRDqQxQ==,type:str]
+    version: 3.13.2

k8s/bootstrap/ingress/ingress.yaml

@@ -275,28 +275,3 @@ spec:
                 name: temporal-web
                 port:
                   number: 8080
----
-# NOTE: api.riotpiao.com is deliberately NOT here. Its namespace `api` is
-# created in wave 7, and this Application syncs in wave 1 — an Ingress into a
-# namespace that doesn't exist yet would fail and mark this whole app
-# SyncFailed. It lives in k8s/apps/api/ingress.yaml, synced by the api-gw
-# Application.
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: homarr
-  namespace: dashboard
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: homarr.riotpiao.com
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: homarr
-                port:
-                  number: 7575
-

k8s/bootstrap/phase4-argocd/argocd-values.yaml

@@ -143,7 +143,10 @@ configs:
     oidc.config: |
       name: Zitadel
       issuer: https://zitadel.riotpiao.com
-      clientID: 396757801210282367
+      # MUST be quoted: an unquoted 18-digit number is parsed as a float by the
+      # YAML parser and ArgoCD rejects it ("cannot unmarshal number into ...
+      # clientID of type string"). Same class of bug as Grafana's client_id.
+      clientID: "396757801210282367"
       clientSecret: $oidc-secret:client-secret
       requestedScopes:
         - openid

k8s/infra/databases/authentik-db.yaml

@@ -1,38 +0,0 @@
-# Dedicated CNPG Postgres for Authentik (GitOps, wave 2 — before authentik w3).
-# CNPG generates secret `authentik-db-app` + service `authentik-db-rw` in ns iam;
-# authentik-values reads them locally (no cross-ns secret copy).
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: authentik-db
-  namespace: iam
-  annotations:
-    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-spec:
-  instances: 3
-  imageName: ghcr.io/cloudnative-pg/postgresql:16.2
-  bootstrap:
-    initdb:
-      database: authentik
-      owner: app
-      encoding: UTF8
-      localeCollate: C
-      localeCType: C
-  enableSuperuserAccess: false
-  resources:
-    requests: { memory: "512Mi", cpu: "250m" }
-    limits: { memory: "2Gi", cpu: "1" }
-  storage:
-    size: 10Gi
-    storageClass: longhorn-cnpg
-  monitoring:
-    enablePodMonitor: true
-  affinity:
-    # preferred + tolerations: HA across nodes without deadlocking a partly-
-    # schedulable 3-CP (same as forgejo-db).
-    podAntiAffinityType: preferred
-    topologyKey: kubernetes.io/hostname
-    tolerations:
-      - key: node-role.kubernetes.io/control-plane
-        operator: Exists
-        effect: NoSchedule

k8s/infra/databases/kustomization.yaml

@@ -6,7 +6,6 @@ kind: Kustomization
 # deployed into it. paperless ns declared in namespaces.yaml above.
 resources:
   - namespaces.yaml
-  - authentik-db.yaml
   - zitadel-db.yaml
   - temporal-db.yaml
   - paperless-db.yaml

k8s/infra/databases/namespaces.yaml

@@ -1,7 +1,7 @@
 # DB clusters are wave 2 — their namespaces must exist first (their apps that
 # would CreateNamespace run later, w3/w8). Declared here so the databases App
-# creates them. authentik/vault/temporal/paperless CreateNamespace=true then
-# no-ops. poimen namespace created by poimen-root app (wave 7).
+# creates them. vault/temporal/paperless CreateNamespace=true then no-ops.
+# poimen namespace created by poimen-root app (wave 7).
 apiVersion: v1
 kind: Namespace
 metadata:

k8s/infra/iam/authentik-values.yaml

@@ -1,284 +0,0 @@
-# k8s/talos-iam/authentik-values.yaml
-# Authentik — SSO Identity Provider for the homelab.
-# Provides OAuth2/OIDC login for Grafana, MinIO, Forgejo, and Argo CD.
-# Chart: authentik/authentik from https://charts.goauthentik.io
-#
-# Architecture: server (UI+API) + worker (background tasks) + PostgreSQL + Redis.
-# PostgreSQL is the system of record — must persist. Redis is ephemeral cache/queue.
-#
-# Secrets injected via helmfile --set (from .env / vsource):
-#   AUTHENTIK_SECRET_KEY         — signs sessions and tokens; set once, never rotate casually
-#   AUTHENTIK_BOOTSTRAP_PASSWORD — initial akadmin password (used once at first login)
-#   AUTHENTIK_BOOTSTRAP_TOKEN    — API token for the setup_talos_iam.sh bootstrap script
-#   AUTHENTIK_PG_PASSWORD        — PostgreSQL user password
-
-authentik:
-  # host: the external URL Authentik uses to build redirect URIs in OAuth2 flows.
-  # Must match what the browser sees — if it returns an internal svc URL,
-  # the browser's redirect after login will fail (can't reach svc DNS externally).
-  # HTTP (not HTTPS) because the Authentik ingress has no TLS cert configured.
-  host: "https://authentik.riotpiao.com"
-
-  error_reporting:
-    enabled: false   # do not phone home to Sentry
-
-  # PostgreSQL connection — points at CloudNativePG cluster in ddb namespace.
-  # Uses 'app' bootstrap user (CNPG simple pattern, same as Forgejo).
-  # Credentials injected from authentik-db-app secret via env vars below.
-  postgresql:
-    host: authentik-db-rw.iam.svc.cluster.local
-    port: 5432
-    name: authentik
-    user: app  # All apps use shared 'app' user (CNPG design pattern)
-    password: ""  # overridden by AUTHENTIK_POSTGRESQL__PASSWORD env var
-
-  # Redis connection — bundled subchart, standalone mode (no sentinel/cluster).
-  redis:
-    host: authentik-redis-master
-
-  # ── HTTP client timeouts ──────────────────────────────────────────────────────
-  # Increased to tolerate 5+ second pod-to-pod network latency.
-  # Affects webhooks, outpost management, SCIM, LDAP sync.
-  # Default: ~30s — too aggressive when latency spikes hit 5-10s.
-  log_level: debug  # enable debug logging to monitor connection issues
-
-# ── CA trust (shared by server and worker) ────────────────────────────────────
-# Authentik (Python/Debian) uses requests + httpx for outgoing HTTPS — webhooks,
-# outpost management, SCIM. Both libraries need REQUESTS_CA_BUNDLE / SSL_CERT_FILE
-# to point to a bundle that includes homelab-ca, otherwise connections to other
-# homelab services fail with "certificate signed by unknown authority".
-#
-# Strategy: a debian:12-slim init container (run as root) concatenates the
-# Debian system Mozilla bundle with homelab-ca.crt into an emptyDir. The main
-# container then references /merged/ca-bundle.crt via two env vars that cover
-# every Python HTTP library.
-_caVolumes: &caVolumes
-  - name: homelab-ca
-    configMap:
-      name: homelab-ca
-  - name: merged-ca
-    emptyDir: {}
-
-_caVolumeMounts: &caVolumeMounts
-  - name: homelab-ca
-    mountPath: /homelab-ca
-    readOnly: true
-  - name: merged-ca
-    mountPath: /merged
-    readOnly: true
-
-_caInitContainers: &caInitContainers
-  - name: merge-ca-certs
-    image: debian:bookworm
-    imagePullPolicy: IfNotPresent
-    securityContext:
-      runAsUser: 0
-    command:
-      - sh
-      - -c
-      - (cat /etc/ssl/certs/ca-certificates.crt 2>/dev/null; cat /homelab-ca/homelab-ca.crt) > /merged/ca-bundle.crt
-    volumeMounts:
-      - name: homelab-ca
-        mountPath: /homelab-ca
-        readOnly: true
-      - name: merged-ca
-        mountPath: /merged
-  # NOTE: no authentik-migrate init container — the authentik `server` entrypoint
-  # runs migrations itself on startup. A separate `manage migrate` init pinned to
-  # an older image tripped a version-history precheck on an empty DB
-  # (relation "authentik_version_history" does not exist) and blocked boot.
-
-_caEnv: &caEnv
-  - name: REQUESTS_CA_BUNDLE
-    value: /merged/ca-bundle.crt
-  - name: SSL_CERT_FILE
-    value: /merged/ca-bundle.crt
-
-# ── Authentik server (UI + API) ───────────────────────────────────────────────
-# Handles all browser traffic: login flows, admin UI, OAuth2 authorize/token endpoints.
-# NodePort 32172 is a fallback for direct node access during troubleshooting;
-# normal access is via nginx ingress (authentik.riotpiao.com → svc:80).
-# Recreate: single replica + RWO-adjacent state — avoids split-brain on redeploy.
-server:
-  replicas: 1
-  # Merge SOPS-CMP-emitted secret values after the chart's own `authentik` secret.
-  envFrom:
-    - secretRef:
-        name: authentik-secrets
-  deploymentStrategy:
-    type: Recreate
-  service:
-    type: NodePort
-    nodePort: 32172
-  resources:
-    requests:
-      cpu: 100m
-      memory: 512Mi
-    limits:
-      cpu: 1000m
-      memory: 1Gi
-  tolerations:
-    - key: node-role.kubernetes.io/control-plane
-      operator: Exists
-      effect: NoSchedule
-  volumes: *caVolumes
-  volumeMounts: *caVolumeMounts
-  initContainers: *caInitContainers
-  env:
-    # Merge CA trust env vars
-    - name: REQUESTS_CA_BUNDLE
-      value: /merged/ca-bundle.crt
-    - name: SSL_CERT_FILE
-      value: /merged/ca-bundle.crt
-    # Override database credentials to use 'app' from authentik-db-app
-    - name: AUTHENTIK_POSTGRESQL__USER
-      valueFrom:
-        secretKeyRef:
-          name: authentik-db-app
-          key: username
-    - name: AUTHENTIK_POSTGRESQL__PASSWORD
-      valueFrom:
-        secretKeyRef:
-          name: authentik-db-app
-          key: password
-  podAnnotations:
-    configmap.reloader.stakater.com/reload: "homelab-ca"
-    homelab.io/restart-at: "2026-06-21T13-40"
-  # The /-/health/{live,ready}/ endpoints do a DB round-trip; under transient
-  # CNPG contention they respond in 5-6s while still returning 200. The chart's
-  # default 3s liveness timeout then flags a working backend as dead and kubelet
-  # kills it in a restart loop — the pod never stays Ready, gets dropped from the
-  # authentik-server Service endpoints, and the OAuth-provisioning PostSync hook
-  # fails with "Host is unreachable". Widen the timeouts so slow-but-healthy
-  # checks aren't treated as failures. (Only these fields are overridden; the
-  # chart deep-merges the rest of each probe, incl. the httpGet path.)
-  livenessProbe:
-    initialDelaySeconds: 300  # skip probe until 5min passed (migrations finish)
-    timeoutSeconds: 15
-    failureThreshold: 6
-  readinessProbe:
-    initialDelaySeconds: 300  # skip probe until migrations complete
-    timeoutSeconds: 15
-    failureThreshold: 6
-  startupProbe:
-    timeoutSeconds: 15
-    failureThreshold: 120  # 120 × 10s = 20min for fresh DB migrations
-  # Every OIDC login (Grafana, Argo CD, MinIO, Forgejo) depends on this server —
-  # its request latency/error rate explains SSO-driven slowness on those services.
-  metrics:
-    enabled: true
-    serviceMonitor:
-      enabled: true
-      scrapeTimeout: 30s
-
-# ── Authentik worker ──────────────────────────────────────────────────────────
-# Runs background tasks: email delivery, LDAP sync, flow policy evaluation,
-# event log cleanup, and managed outpost updates. Stateless — no PVC needed.
-# Same resource profile as server; Authentik 2023+ merged some worker duties
-# into the server process but the worker pod is still required.
-worker:
-  replicas: 1
-  envFrom:
-    - secretRef:
-        name: authentik-secrets
-  deploymentStrategy:
-    type: Recreate
-  resources:
-    requests:
-      cpu: 100m
-      memory: 512Mi
-    limits:
-      cpu: 1000m
-      memory: 1Gi
-  tolerations:
-    - key: node-role.kubernetes.io/control-plane
-      operator: Exists
-      effect: NoSchedule
-  volumes: *caVolumes
-  volumeMounts: *caVolumeMounts
-  initContainers: *caInitContainers
-  env:
-    # Merge CA trust env vars
-    - name: REQUESTS_CA_BUNDLE
-      value: /merged/ca-bundle.crt
-    - name: SSL_CERT_FILE
-      value: /merged/ca-bundle.crt
-    # Override database credentials to use 'app' from authentik-db-app
-    - name: AUTHENTIK_POSTGRESQL__USER
-      valueFrom:
-        secretKeyRef:
-          name: authentik-db-app
-          key: username
-    - name: AUTHENTIK_POSTGRESQL__PASSWORD
-      valueFrom:
-        secretKeyRef:
-          name: authentik-db-app
-          key: password
-  podAnnotations:
-    configmap.reloader.stakater.com/reload: "homelab-ca"
-    homelab.io/restart-at: "2026-06-21T13-40"
-  livenessProbe:
-    initialDelaySeconds: 300  # skip probe until 5min passed (migrations finish)
-  readinessProbe:
-    initialDelaySeconds: 300  # skip probe until migrations complete
-  startupProbe:
-    initialDelaySeconds: 30  # let server finish DB work first
-    failureThreshold: 120
-  metrics:
-    enabled: true
-    serviceMonitor:
-      enabled: true
-      scrapeTimeout: 30s
-
-# ── PostgreSQL (external: CloudNativePG cluster in ddb namespace) ─────────────
-# Authentik connects to the dedicated authentik-db (1 primary + 2 replicas).
-# Do not use the bundled Bitnami subchart — CNPG is already running.
-postgresql:
-  enabled: false
-  primary:
-    persistence:
-      enabled: true
-      storageClass: longhorn
-      size: 8Gi
-    tolerations:
-      - key: node-role.kubernetes.io/control-plane
-        operator: Exists
-        effect: NoSchedule
-    affinity:
-      nodeAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 100
-            preference:
-              matchExpressions:
-                - key: node-role.kubernetes.io/worker
-                  operator: Exists
-
-# ── Bundled Redis ─────────────────────────────────────────────────────────────
-# Cache and async task queue only — no durable data. If Redis restarts, in-flight
-# background tasks are retried and cached tokens are recomputed. Losing Redis
-# data does not lose user accounts or flow configuration (that's in PostgreSQL).
-# persistence: false saves a PVC and makes restarts faster.
-#
-# Same prefer-worker / fallback-to-cp scheduling as PostgreSQL.
-# architecture: standalone — no Sentinel/cluster overhead for a 3-node homelab.
-redis:
-  enabled: true
-  master:
-    persistence:
-      enabled: false
-    tolerations:
-      - key: node-role.kubernetes.io/control-plane
-        operator: Exists
-        effect: NoSchedule
-    affinity:
-      nodeAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 100
-            preference:
-              matchExpressions:
-                - key: node-role.kubernetes.io/worker
-                  operator: Exists
-  architecture: standalone
-
-# Ingress disabled — rule lives in k8s/ingress/ingress.yaml (authentik.riotpiao.com).
-# For direct access during bootstrap: kubectl -n iam port-forward svc/authentik-server 7000:80

k8s/infra/iam/kustomization.yaml

@@ -2,11 +2,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - rbac-dashboard-rolebinding.yaml
+  # Removed: rbac-dashboard-rolebinding.yaml (authentik-provisioner SA and
+  # RoleBinding). Authentik is retired, so the file is gone; keep this list in
+  # step with the directory or kustomize fails the whole app.
+  - smtp-gotify.yaml
 
 # IAM provisioning is manual-only (security-sensitive).
-# Script: scripts/iam/authentik-provision.py
+# Script: scripts/iam/zitadel-provision.py
 # Run:
-#   export AUTHENTIK_BOOTSTRAP_TOKEN=$(kubectl -n iam get secret authentik-secrets \
-#     -o jsonpath='{.data.AUTHENTIK_BOOTSTRAP_TOKEN}' | base64 -d)
-#   python3 scripts/iam/authentik-provision.py
+#   scripts/iam/zitadel-provision.py all

k8s/infra/iam/rbac-dashboard-rolebinding.yaml

@@ -1,13 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: authentik-provisioner
-  namespace: dashboard
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: authentik-provisioner
-subjects:
-- kind: ServiceAccount
-  name: authentik-provisioner
-  namespace: iam

k8s/infra/iam/smtp-gotify.yaml

@@ -0,0 +1,108 @@
+# SMTP -> Gotify relay for ZITADEL notifications.
+#
+# ZITADEL sends verification codes, password resets and one-time passwords by
+# SMTP only, and this cluster has no working mail path: no SMTP credentials are
+# configured for ZITADEL, and the notification table shows
+# verified_email empty for every user. Without a delivery path nobody can finish
+# a first login, at ZITADEL or at any relying party such as Forgejo.
+#
+# This relay accepts plain SMTP on :2525 and forwards every message to Gotify,
+# so codes arrive on the phone through the existing gotify/igotify setup instead
+# of email. ZITADEL then points DefaultInstance.SMTPConfiguration at this
+# Service (see k8s/infra/iam/zitadel-values.yaml).
+#
+# The Gotify token is a Secret, never a literal here.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: smtp-gotify
+  namespace: iam
+  labels:
+    app: smtp-gotify
+spec:
+  replicas: 1
+  revisionHistoryLimit: 2
+  selector:
+    matchLabels:
+      app: smtp-gotify
+  template:
+    metadata:
+      labels:
+        app: smtp-gotify
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        runAsGroup: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+        - name: tmp
+          emptyDir: {}
+      containers:
+        - name: smtp-gotify
+          image: quay.io/reiml/smtp-gotify:latest
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: GOTIFY_URL
+              value: "http://gotify.notifications.svc.cluster.local/"
+            - name: GOTIFY_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: smtp-gotify
+                  key: token
+            - name: GOTIFY_PRIORITY
+              value: "5"
+            # No title template: the relay's default title already carries
+            # the mail subject, and a wrong template field fails the push
+            # silently (the SMTP side still answers 250, so the sender thinks
+            # the message was delivered).
+          ports:
+            - name: smtp
+              containerPort: 2525
+              protocol: TCP
+          volumeMounts:
+            # The relay stages each message in /tmp before the Gotify push.
+            # With readOnlyRootFilesystem it accepted SMTP (250 queued) and
+            # then silently dropped the message: no push, no error.
+            - name: tmp
+              mountPath: /tmp
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+          readinessProbe:
+            tcpSocket:
+              port: smtp
+            initialDelaySeconds: 3
+            periodSeconds: 10
+          livenessProbe:
+            tcpSocket:
+              port: smtp
+            initialDelaySeconds: 10
+            periodSeconds: 20
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: smtp-gotify
+  namespace: iam
+  labels:
+    app: smtp-gotify
+spec:
+  type: ClusterIP
+  selector:
+    app: smtp-gotify
+  ports:
+    - name: smtp
+      port: 2525
+      targetPort: smtp
+      protocol: TCP

k8s/infra/iam/vault-values.yaml

@@ -81,6 +81,15 @@ server:
     - envName: VAULT_UNSEAL_KEY_3
       secretName: vault-unseal-keys
       secretKey: key3
+    # Zitadel OIDC client credentials for the Vault UI login method. Consumed by
+    # the postStart hook below, which enables auth/oidc via the Vault API after
+    # unsealing. Vault auth methods cannot be declared in HCL, only via API/CLI.
+    - envName: OIDC_CLIENT_ID
+      secretName: vault-oidc-creds
+      secretKey: OIDC_CLIENT_ID
+    - envName: OIDC_CLIENT_SECRET
+      secretName: vault-oidc-creds
+      secretKey: OIDC_CLIENT_SECRET
 
   # ── Auto-unseal ─────────────────────────────────────────────────────────────
   # Vault starts sealed after every pod restart and can't serve requests until
@@ -97,6 +106,28 @@ server:
       vault operator unseal "$VAULT_UNSEAL_KEY_2" || true
       vault operator unseal "$VAULT_UNSEAL_KEY_3" || true
 
+      # ── Zitadel OIDC login method ────────────────────────────────────────
+      # Vault auth methods are API-driven: they cannot be declared in HCL.
+      # Enable auth/oidc and write its config on every pod start. Both calls
+      # are idempotent (auth enable returns 400 "already enabled", which we
+      # tolerate; the config write always succeeds and overwrites).
+      vault auth enable oidc 2>/dev/null || true
+      vault write auth/oidc/config \
+        oidc_discovery_url="https://zitadel.riotpiao.com" \
+        oidc_client_id="$OIDC_CLIENT_ID" \
+        oidc_client_secret="$OIDC_CLIENT_SECRET" \
+        default_role="default" 2>/dev/null || true
+      # The role binds the Zitadel client_id as audience and whitelists the UI
+      # callback URL. Policy `default` gives a logged-in operator standard
+      # read access; admin actions still require a token with root/sudo.
+      vault write auth/oidc/role/default \
+        bound_audiences="$OIDC_CLIENT_ID" \
+        allowed_redirect_uris="https://vault.riotpiao.com/ui/vault/auth/oidc/oidc/callback" \
+        allowed_redirect_uris="http://localhost:8200/ui/vault/auth/oidc/oidc/callback" \
+        user_claim="preferred_username" \
+        oidc_scopes="openid,profile,email,groups" \
+        policies="default" 2>/dev/null || true
+
   # ── Vault config (HCL) ──────────────────────────────────────────────────────
   standalone:
     enabled: true

k8s/infra/iam/zitadel-values.yaml

@@ -31,7 +31,6 @@ zitadel:
     ExternalDomain: zitadel.riotpiao.com
     TLS:
       Enabled: false
-
     # First boot is COMPLETE (2026-10-26): the instance, the system org and the
     # `iam-admin` machine key all exist. Skip stops the setup hook from running
     # the first-instance step again. Without it, every sync re-runs the
@@ -146,6 +145,10 @@ setupJob:
 replicaCount: 2
 revisionHistoryLimit: 3
 
+# Notification delivery lives in the ConfigMap owned by the zitadel-core app
+# (k8s/infra/zitadel-core/). Env overrides here produced no SMTP provider, and
+# editing configmapConfig made ArgoCD drop the rendered ConfigMap.
+
 # Best practice: a PDB guarantees at least one API pod stays available during
 # voluntary disruptions (node drain, rolling upgrade). Without it a drain can
 # take both replicas down at once. minAvailable 1 is correct for 2 replicas;
@@ -171,7 +174,20 @@ ingress:
   controller: nginx
 
 login:
-  enabled: true
+  # Built-in login page, not the hosted Login UI.
+  #
+  # The hosted UI authenticates to the ZITADEL API as the machine user
+  # `login-client`, using a JWT-profile assertion signed by the keypair in
+  # zitadel-login-service-key. That machine user is created by the chart's
+  # setup job, which this install runs only once (setupJob is deliberately
+  # disabled after the first sync). Without the user, every session write
+  # fails and the user sees "Could not create session for user", so no one
+  # can sign in here or at any relying party such as Forgejo.
+  #
+  # The built-in login serves the same flows from the ZITADEL server and
+  # needs no machine user. Turn this back on only after creating
+  # `login-client` and registering the matching public key.
+  enabled: false
   # ksops owns this Secret (k8s/argocd/secrets/zitadel-login-service-key.enc.yaml,
   # rendered by the sops-secrets Application). Pointing the chart at it stops the
   # chart from auto-generating an RSA keypair every render, which changed

k8s/infra/logging/grafana-values.yaml

@@ -74,7 +74,7 @@ grafana.ini:
     enabled: true
     name: Zitadel
     allow_sign_up: true  # Allow sync to create/update users from OAuth claims
-    client_id: 396757801965191169
+    client_id: "396757801965191169"
     scopes: openid email profile groups
     auth_url: https://zitadel.riotpiao.com/oauth/v2/authorize
     token_url: https://zitadel.riotpiao.com/oauth/v2/token
@@ -209,3 +209,25 @@ sidecar:
       disableDelete: false
       foldersFromFilesStructure: true
     searchNamespace: ALL
+
+# ── Alerting ──────────────────────────────────────────────────────────────────
+# One contact point: Gotify. Gotify refuses Grafana's payload shape with
+# 400 "Field 'message' is required", so a bridge service translates the JSON
+# first (k8s/apps/gotify/bridge). Grafana posts to the bridge, the bridge posts
+# to /message with an app token.
+alerting:
+  contactpoints.yaml:
+    apiVersion: 1
+    contactPoints:
+      - orgId: 1
+        name: gotify
+        receivers:
+          - uid: gotify-webhook
+            type: webhook
+            disableResolveMessage: false
+            settings:
+              url: http://grafana-gotify-bridge.notifications.svc.cluster.local:8080/alert
+              httpMethod: POST
+              # 0 sends every alert in one request. The bridge names the extra
+              # count in the message body.
+              maxAlerts: 0

k8s/infra/monitoring/alerts/svc-authentik-rules.yaml

@@ -1,33 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: authentik-rules
-  namespace: iam
-spec:
-  groups:
-    - name: authentik.rules
-      interval: 15s
-      rules:
-        - alert: AuthentikHighErrorRate
-          expr: |
-            (
-              sum(rate(authentik_http_requests_total{status=~"5.."}[5m]))
-              /
-              sum(rate(authentik_http_requests_total[5m]))
-            ) > 0.05
-          for: 10m
-          labels:
-            severity: warning
-          annotations:
-            summary: "High error rate on Authentik"
-            description: "5xx error rate exceeded 5% of total requests for 10 minutes. Value: {{ $value | humanizePercentage }}"
-
-        - alert: AuthentikOutpostDown
-          expr: |
-            authentik_outpost_total_up == 0
-          for: 5m
-          labels:
-            severity: warning
-          annotations:
-            summary: "Authentik outpost is down"
-            description: "Outpost {{ $labels.outpost_name }} (type: {{ $labels.outpost_type }}) has been offline for 5 minutes"

k8s/infra/monitoring/kustomization.yaml

@@ -7,7 +7,6 @@ kind: Kustomization
 resources:
   - alerts/ingress-alerts.yaml
   - alerts/svc-argocd-rules.yaml
-  - alerts/svc-authentik-rules.yaml
   - alerts/svc-zitadel-rules.yaml
   - alerts/svc-forgejo-rules.yaml
   - alerts/svc-grafana-rules.yaml
@@ -17,7 +16,6 @@ resources:
   - alerts/api-gateway-alerts.yaml
   - alerts/cag-kv-cache-rules.yaml
   - servicemonitors/argocd.yaml
-  - servicemonitors/authentik.yaml
   - servicemonitors/forgejo.yaml
   - servicemonitors/minio.yaml
   - servicemonitors/ingress-nginx.yaml

k8s/infra/monitoring/servicemonitors/authentik.yaml

@@ -1,18 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: authentik
-  namespace: monitoring
-  labels:
-    release: kube-prometheus-stack
-spec:
-  namespaceSelector:
-    matchNames:
-      - iam
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: authentik
-  endpoints:
-    - port: metrics
-      interval: 30s
-      scrapeTimeout: 10s

k8s/infra/oidc-bootstrap/bootstrap.yaml

@@ -1,33 +0,0 @@
-# One-shot bootstrap: restart the control-plane apiservers ONCE so they pick up the
-# OIDC authenticator (they last started before the Authentik provider existed, so OIDC
-# tokens were never accepted -> every login got 401). Delete this whole directory after.
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: oidc-bootstrap
-  namespace: kube-system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: oidc-bootstrap
-  namespace: kube-system
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "list", "delete"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: oidc-bootstrap
-  namespace: kube-system
-subjects:
-  - kind: ServiceAccount
-    name: oidc-bootstrap
-    namespace: kube-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: oidc-bootstrap

k8s/infra/rbac/homarr-operator-role.yaml

@@ -1,32 +0,0 @@
-# Scoped operator access for homarr-admins: the homarr Deployment + app
-# secrets only. homarr-oidc, auth-oidc-secret, db-encryption stay excluded
-# (security-managed, not app config). Inert until kube-apiserver's OIDC
-# wiring lands.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: homarr-operator
-  namespace: dashboard
-rules:
-  - apiGroups: ["apps"]
-    resources: ["deployments"]
-    resourceNames: ["homarr"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-  - apiGroups: [""]
-    resources: ["secrets"]
-    resourceNames: ["homarr-secrets"]
-    verbs: ["get", "list", "watch", "update", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: homarr-admins-binding
-  namespace: dashboard
-subjects:
-  - kind: Group
-    name: "oidc:homarr-admins"
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: Role
-  name: homarr-operator
-  apiGroup: rbac.authorization.k8s.io

k8s/infra/rbac/kustomization.yaml

@@ -10,7 +10,6 @@ resources:
   - grafana-operator-role.yaml
   - minio-operator-role.yaml
   - forgejo-operator-role.yaml
-  - homarr-operator-role.yaml
   - portainer-operator-role.yaml
   - kmsvc-operator-role.yaml
   - temporal-operator-role.yaml

k8s/infra/zitadel-core/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - zitadel-core.yaml

k8s/infra/zitadel-core/zitadel-core.yaml

@@ -0,0 +1,133 @@
+# ZITADEL core objects, owned by this repository instead of the Helm chart.
+#
+# The zitadel chart marks four objects as Helm hooks:
+#
+#   kind: ServiceAccount   (also ConfigMap/zitadel-config-yaml, Role, RoleBinding)
+#   annotations:
+#     helm.sh/hook: pre-install,pre-upgrade
+#     helm.sh/hook-delete-policy: before-hook-creation
+#
+# ArgoCD maps pre-install/pre-upgrade to PreSync and prunes hook resources when
+# the sync ends. Every sync therefore deleted the ServiceAccount and the ConfigMap
+# that the ZITADEL Deployment references, which produced:
+#
+#   error creating: pods "zitadel-..." is forbidden:
+#     serviceaccount "zitadel" not found
+#
+# and left the IdP one restart away from failing.
+#
+# These copies carry no hook annotations, so they are ordinary desired state and
+# ArgoCD keeps them. The chart still renders its own hook versions during a sync;
+# these win because the sync no longer removes them.
+#
+# ConfigMap content mirrors what the chart renders from
+# k8s/infra/iam/zitadel-values.yaml, plus the notification settings the chart
+# cannot deliver through values (see the SMTP note below). When the chart values
+# change, update this file too; it is the authoritative copy at runtime.
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: zitadel
+  namespace: iam
+  labels:
+    app.kubernetes.io/name: zitadel
+    app.kubernetes.io/instance: zitadel
+    app.kubernetes.io/managed-by: gitops
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: zitadel
+  namespace: iam
+  labels:
+    app.kubernetes.io/name: zitadel
+    app.kubernetes.io/instance: zitadel
+    app.kubernetes.io/managed-by: gitops
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "create", "patch", "list", "delete"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: zitadel
+  namespace: iam
+  labels:
+    app.kubernetes.io/name: zitadel
+    app.kubernetes.io/instance: zitadel
+    app.kubernetes.io/managed-by: gitops
+subjects:
+  - kind: ServiceAccount
+    name: zitadel
+roleRef:
+  kind: Role
+  name: zitadel
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: zitadel-config-yaml
+  namespace: iam
+  labels:
+    app.kubernetes.io/name: zitadel
+    app.kubernetes.io/instance: zitadel
+    app.kubernetes.io/managed-by: gitops
+data:
+  zitadel-config-yaml: |
+    ExternalDomain: zitadel.riotpiao.com
+    ExternalSecure: true
+    TLS:
+      Enabled: false
+    FirstInstance:
+      # First boot is COMPLETE. Skip stops the setup step from running again and
+      # silently rotating the iam-admin key that provisioning reads.
+      Skip: true
+      Org:
+        Skip: true
+        Machine:
+          Machine:
+            Name: Automatically Initialized IAM Admin
+            Username: iam-admin
+          MachineKey:
+            ExpirationDate: "2029-01-01T00:00:00Z"
+            Type: 1
+          Pat:
+            ExpirationDate: "2029-01-01T00:00:00Z"
+    Machine:
+      Identification:
+        Hostname:
+          Enabled: true
+        Webhook:
+          Enabled: false
+    # Notification delivery.
+    #
+    # ZITADEL sends verification codes and password resets by SMTP only. This
+    # cluster has no mail path, so without a provider every user stays at
+    # verified_email = empty and cannot finish a first login.
+    #
+    # The target is the in-cluster smtp-gotify relay, which forwards each message
+    # to Gotify so codes reach the phone.
+    #
+    # Why here and not in chart values: injecting the same keys as
+    # ZITADEL_DEFAULTINSTANCE_SMTPCONFIGURATION_* env vars produced no
+    # instance.smtp.config.added event, so ZITADEL never created the provider.
+    # Setting configmapConfig in chart values made ArgoCD stop managing this
+    # ConfigMap. Owning the file here avoids both problems.
+    DefaultInstance:
+      DomainPolicy:
+        # The sender is [email protected] while the instance domain is
+        # zitadel.riotpiao.com. Leave this true so the sender address is not
+        # rejected for not matching the domain.
+        SMTPSenderAddressMatchesInstanceDomain: false
+      SMTPConfiguration:
+        SMTP:
+          Host: smtp-gotify.iam.svc.cluster.local:2525
+        TLS: false
+        From: [email protected]
+        FromName: ZITADEL

scripts/iam/forgejo-oauth-source.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# forgejo-oauth-source.sh — keep the Forgejo OAuth login source aligned with
+# ZITADEL.
+#
+# Forgejo stores login sources in its database, not in GitOps, and its REST API
+# does not expose them. `tea` has no auth-source command either (tea admin only
+# manages users), so the supported writer is the in-pod CLI:
+#   gitea admin auth update-oauth
+#
+# The source name is the label on the "Sign in with ..." button AND the callback
+# path (/user/oauth2/<name>/callback), so a rename changes the registered
+# redirect URI. Register both spellings in ZITADEL (zitadel-provision.py does)
+# before renaming.
+#
+# Usage:
+#   scripts/iam/forgejo-oauth-source.sh status
+#   scripts/iam/forgejo-oauth-source.sh rename zitadel
+set -euo pipefail
+
+NS="${FORGEJO_NAMESPACE:-cicd}"
+SEL="${FORGEJO_SELECTOR:-app.kubernetes.io/name=forgejo}"
+
+pod() {
+  kubectl -n "$NS" get pods -l "$SEL" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null \
+    || kubectl -n "$NS" get pods -o name | grep -m1 forgejo-gitea | cut -d/ -f2
+}
+
+run() { kubectl -n "$NS" exec "$(pod)" -c gitea -- gitea admin auth "$@"; }
+
+case "${1:-status}" in
+  status) run list ;;
+  rename)
+    name="${2:?usage: $0 rename <name>}"
+    run update-oauth --id 1 --name "$name"
+    run list
+    ;;
+  *) echo "usage: $0 [status|rename <name>]" >&2; exit 2 ;;
+esac

scripts/iam/provision-rbac.py

@@ -1,669 +0,0 @@
-#!/usr/bin/env python3
-"""
-Provision RBAC groups, service account roles, fine-grained claims, and auth flows.
-
-Idempotent — safe to re-run. Provisions:
-  1. Global admin groups (homelab-admins)
-  2. Fine-grained service/bucket/project groups (minio-*, poimen-*, paperless-*, grafana-*, sqs-*)
-  3. Service account roles with custom claims (paperless-ai-agent, portfolio-agent, etc.)
-  4. JWT scope mappings for fine-grained claims (minio_buckets, paperless_doctypes, etc.)
-  5. OAuth2 providers with scopes (api-gw, minio, poimen, paperless, grafana)
-  6. Auth flows (password grant on api-gw provider)
-
-Usage:
-    source ~/.env
-    export AUTHENTIK_BOOTSTRAP_TOKEN=$(kubectl -n iam get secret authentik-secrets \
-        -o jsonpath='{.data.AUTHENTIK_BOOTSTRAP_TOKEN}' | base64 -d)
-    python3 scripts/iam/provision-rbac.py
-
-DO NOT commit this file to git — .gitignore covers scripts/iam/*.py.
-"""
-import json
-import os
-import sys
-import urllib.error
-import urllib.request
-from typing import Dict, List, Any
-from pathlib import Path
-
-# Load ~/.env for OAuth2 provider secrets
-env_file = Path.home() / ".env"
-if env_file.exists():
-    with open(env_file) as f:
-        for line in f:
-            line = line.strip()
-            if line.startswith("export ") and "=" in line:
-                key, _, value = line[7:].partition("=")
-                key = key.strip()
-                value = value.strip().strip('"').strip("'")
-                os.environ[key] = value
-
-AUTHENTIK_URL = "https://authentik.riotpiao.com"
-TOKEN = os.environ.get("AUTHENTIK_BOOTSTRAP_TOKEN")
-if not TOKEN:
-    print("Error: AUTHENTIK_BOOTSTRAP_TOKEN not set")
-    print("  source ~/.env")
-    print("  export AUTHENTIK_BOOTSTRAP_TOKEN=$(kubectl -n iam get secret authentik-secrets \\")
-    print("      -o jsonpath='{.data.AUTHENTIK_BOOTSTRAP_TOKEN}' | base64 -d)")
-    sys.exit(1)
-
-
-def api(method, path, data=None):
-    url = f"{AUTHENTIK_URL}{path}"
-    body = json.dumps(data).encode() if data is not None else None
-    req = urllib.request.Request(url, data=body, method=method, headers={
-        "Authorization": f"Bearer {TOKEN}",
-        "Content-Type": "application/json",
-    })
-    try:
-        with urllib.request.urlopen(req, timeout=30) as resp:
-            raw = resp.read()
-            return resp.status, json.loads(raw) if raw else {}
-    except urllib.error.HTTPError as e:
-        raw = e.read()
-        try:
-            parsed = json.loads(raw) if raw else {}
-        except json.JSONDecodeError:
-            parsed = {"raw": raw.decode(errors="replace")}
-        return e.code, parsed
-
-
-def die(msg):
-    print(f"FATAL: {msg}", file=sys.stderr)
-    sys.exit(1)
-
-
-# ===========================================================================
-# Group Definitions (DRY: single source of truth)
-# ===========================================================================
-GROUPS: Dict[str, Dict[str, Any]] = {
-    "homelab-admins": {
-        "description": "Cluster administrators with full access",
-        "is_superuser": True,
-    },
-    "minio-admins": {"description": "MinIO administrators", "is_superuser": False, "minio_buckets": ["*"]},
-    "minio-photos": {"description": "Photos bucket (Immich) access", "is_superuser": False, "minio_buckets": ["immich"]},
-    "minio-documents": {"description": "Documents bucket (Paperless) access", "is_superuser": False, "minio_buckets": ["paperless"]},
-    "minio-backups": {"description": "Backups bucket read-only access", "is_superuser": False, "minio_buckets": ["backups"]},
-    "poimen-admins": {"description": "Poimen memory administrators", "is_superuser": False, "memory_projects": ["*"], "memory_visibility": "private"},
-    "poimen-devs": {"description": "Dev and staging projects access", "is_superuser": False, "memory_projects": ["dev", "staging"], "memory_visibility": "internal"},
-    "poimen-prod-readonly": {"description": "Production projects read-only access", "is_superuser": False, "memory_projects": ["prod"], "memory_visibility": "public"},
-    "paperless-admins": {"description": "Paperless administrators", "is_superuser": False, "paperless_doctypes": ["*"]},
-    "paperless-finance": {"description": "Finance documents", "is_superuser": False, "paperless_doctypes": ["invoices", "receipts", "expenses"]},
-    "paperless-legal": {"description": "Legal documents", "is_superuser": False, "paperless_doctypes": ["contracts", "licenses", "agreements"]},
-    "paperless-hr": {"description": "HR documents", "is_superuser": False, "paperless_doctypes": ["employment", "benefits", "payroll"]},
-    "grafana-admins": {"description": "Grafana administrators", "is_superuser": False, "grafana_org_role": "Admin"},
-    "grafana-editors": {"description": "Grafana dashboard editors", "is_superuser": False, "grafana_org_role": "Editor"},
-    "grafana-viewers": {"description": "Grafana dashboard viewers", "is_superuser": False, "grafana_org_role": "Viewer"},
-    "sqs-users": {"description": "SQS/Temporal queue read access", "is_superuser": False, "sqs_queues": ["default"]},
-    "sqs-writers": {"description": "SQS/Temporal queue read/write access", "is_superuser": False, "sqs_queues": ["*"]},
-    "s3-users": {"description": "S3 read access", "is_superuser": False},
-    "s3-writers": {"description": "S3 read/write access", "is_superuser": False},
-}
-
-SERVICE_ACCOUNTS: Dict[str, Dict[str, Any]] = {
-    "paperless-ai-agent": {
-        "description": "Paperless AI plugin (auto-tagging, entity extraction)",
-        "roles": ["llm:inference", "memory:write", "paperless:admin"],
-        "claims": {
-            "minio_buckets": ["paperless"],
-            "paperless_doctypes": ["*"],
-            "memory_projects": ["*"],
-            "authorized_models": ["reasoning", "qwen2.5:3b"],
-        },
-    },
-    "portfolio-agent": {
-        "description": "Portfolio service agent",
-        "roles": ["llm:inference", "memory:read"],
-        "claims": {
-            "memory_projects": ["homelab", "portfolio"],
-            "memory_visibility": "public",
-            "authorized_models": ["ornith:35b"],
-            "minio_buckets": ["backups"],
-        },
-    },
-    "memory-agent": {
-        "description": "Memory service agent",
-        "roles": ["llm:inference", "memory:read", "memory:write"],
-        "claims": {
-            "memory_projects": ["*"],
-            "memory_visibility": "private",
-            "authorized_models": ["reasoning", "ornith:35b", "qwen2.5:3b"],
-        },
-    },
-    "temporal-worker-agent": {
-        "description": "Temporal workflow worker",
-        "roles": ["llm:inference", "workflow:execute", "memory:read", "memory:write", "queue:send"],
-        "claims": {
-            "memory_projects": ["*"],
-            "sqs_queues": ["*"],
-            "authorized_models": ["reasoning", "ornith:35b", "qwen2.5:3b"],
-        },
-    },
-}
-
-SCOPE_MAPPINGS: Dict[str, Dict[str, str]] = {
-    "roles": {"expression": 'return user.attributes.get("roles", [])'},
-    "permissions": {"expression": 'return ["*"] if any(user.groups.filter(is_superuser=True)) else list(user.groups.values_list("name", flat=True))'},
-    "groups": {"expression": 'return {"groups": list(user.groups.values_list("name", flat=True))}'},
-    "minio_buckets": {"expression": 'return user.attributes.get("minio_buckets", [])'},
-    "paperless_doctypes": {"expression": 'return user.attributes.get("paperless_doctypes", [])'},
-    "memory_projects": {"expression": 'return user.attributes.get("memory_projects", [])'},
-    "memory_visibility": {"expression": 'return user.attributes.get("memory_visibility", "public")'},
-    "authorized_models": {"expression": 'return user.attributes.get("authorized_models", [])'},
-    "sqs_queues": {"expression": 'return user.attributes.get("sqs_queues", [])'},
-    "grafana_org_role": {"expression": 'return user.attributes.get("grafana_org_role", "Viewer")'},
-}
-
-# ===========================================================================
-# Phase 1: Create/sync all groups
-# ===========================================================================
-print("[1/6] Ensuring groups exist...")
-
-status, res = api("GET", "/api/v3/core/groups/?page_size=100")
-if status != 200:
-    die(f"GET groups -> {status} {res}")
-existing_groups = {g["name"]: g for g in res["results"]}
-
-created_count = 0
-for group_name, group_spec in GROUPS.items():
-    if group_name in existing_groups:
-        print(f"  {group_name}: already exists")
-    else:
-        status, res = api("POST", "/api/v3/core/groups/", {
-            "name": group_name,
-            "is_superuser": group_spec.get("is_superuser", False),
-        })
-        if status in (200, 201):
-            print(f"  {group_name}: created")
-            created_count += 1
-        else:
-            print(f"  {group_name}: FAILED {status} {res}")
-
-print(f"  Total: {len(GROUPS)} groups, {created_count} new")
-
-# ===========================================================================
-# Phase 2: Create/sync service account users with custom claims
-# ===========================================================================
-print("\n[2/6] Creating/updating service account users...")
-
-status, res = api("GET", "/api/v3/core/users/?page_size=100")
-if status != 200:
-    die(f"GET users -> {status} {res}")
-existing_users = {u["username"]: u for u in res["results"]}
-
-service_pwd = os.environ.get("AUTHENTIK_SERVICE_ACCOUNT_PASSWORD", "DefaultPassword123!")
-
-for agent_name, agent_spec in SERVICE_ACCOUNTS.items():
-    if agent_name in existing_users:
-        user = existing_users[agent_name]
-        attrs = user.get("attributes", {})
-        attrs.update(agent_spec.get("claims", {}))
-        attrs["roles"] = agent_spec.get("roles", [])
-        status, res = api("PATCH", f"/api/v3/core/users/{user['pk']}/", {"attributes": attrs})
-        if status in (200, 201):
-            print(f"  {agent_name}: claims updated")
-        else:
-            print(f"  {agent_name}: FAILED {status} {res}")
-    else:
-        status, res = api("POST", "/api/v3/core/users/", {
-            "username": agent_name,
-            "name": agent_spec.get("description", agent_name),
-            "email": f"{agent_name}@homelab.local",
-            "is_active": True,
-            "is_superuser": False,
-            "password": service_pwd,
-            "attributes": {
-                **agent_spec.get("claims", {}),
-                "roles": agent_spec.get("roles", []),
-            },
-        })
-        if status in (200, 201):
-            print(f"  {agent_name}: created")
-        else:
-            print(f"  {agent_name}: FAILED {status} {res}")
-
-# ===========================================================================
-# Phase 3: Create scope mappings for fine-grained claims
-# ===========================================================================
-print("\n[3/6] Creating scope mappings for fine-grained claims...")
-
-status, res = api("GET", "/api/v3/propertymappings/provider/scope/?page_size=100")
-if status != 200:
-    die(f"GET scope mappings -> {status} {res}")
-existing_scopes = {m["scope_name"]: m for m in res["results"]}
-
-for scope_name, scope_spec in SCOPE_MAPPINGS.items():
-    if scope_name in existing_scopes:
-        print(f"  {scope_name}: already exists")
-    else:
-        status, res = api("POST", "/api/v3/propertymappings/provider/scope/", {
-            "name": scope_name,
-            "scope_name": scope_name,
-            "expression": scope_spec["expression"],
-        })
-        if status in (200, 201):
-            print(f"  {scope_name}: created")
-        else:
-            print(f"  {scope_name}: FAILED {status} {res}")
-
-# Fix built-in 'openid' scope to include preferred_username (needed by Grafana, Forgejo, etc.)
-# Note: sub MUST be a string, not int, for JSON compatibility with Go struct unmarshaling
-if "openid" in existing_scopes:
-    openid_scope = existing_scopes["openid"]
-    openid_pk = openid_scope["pk"]
-    openid_expression = 'return {"sub": str(user.pk), "preferred_username": user.username}'
-    if openid_expression not in openid_scope.get("expression", ""):
-        status, res = api("PUT", f"/api/v3/propertymappings/provider/scope/{openid_pk}/", {
-            "name": openid_scope["name"],
-            "scope_name": "openid",
-            "expression": openid_expression,
-        })
-        if status in (200, 201):
-            print(f"  openid: updated (sub as string + preferred_username)")
-        else:
-            print(f"  openid: UPDATE FAILED {status} {res}")
-    else:
-        print(f"  openid: already correct (sub as string)")
-
-# ===========================================================================
-# Phase 4: Get flow UUIDs (needed for providers)
-# ===========================================================================
-print("\n[4/6] Fetching flow UUIDs...")
-
-status, res = api("GET", "/api/v3/flows/instances/?page_size=100")
-if status != 200:
-    die(f"GET flows -> {status} {res}")
-
-flows = {f["slug"]: f["pk"] for f in res.get("results", [])}
-auth_flow = flows.get("default-provider-authorization-implicit-consent")
-inval_flow = flows.get("default-provider-invalidation-flow")
-
-if not auth_flow or not inval_flow:
-    die(f"Required flows not found. auth_flow={auth_flow}, inval_flow={inval_flow}")
-
-print(f"  authorization_flow: {auth_flow}")
-print(f"  invalidation_flow: {inval_flow}")
-
-# ===========================================================================
-# Phase 5: Create OAuth2 providers with scopes
-# ===========================================================================
-print("\n[5/6] Creating OAuth2 providers...")
-
-status, res = api("GET", "/api/v3/providers/oauth2/?page_size=100")
-if status != 200:
-    die(f"GET providers -> {status} {res}")
-existing_providers = {p["name"]: p for p in res.get("results", [])}
-
-# Fetch scope mapping PKs
-status, scopes_res = api("GET", "/api/v3/propertymappings/provider/scope/?page_size=100")
-if status != 200:
-    print("  WARNING: could not fetch scope mappings")
-    scope_pks = {}
-else:
-    scope_pks = {m["scope_name"]: m["pk"] for m in scopes_res.get("results", [])}
-
-# Include standard OpenID scopes (openid, email, profile) + custom claim scopes
-STANDARD_SCOPES = ["openid", "email", "profile"]
-scope_pks_list = [scope_pks[s] for s in STANDARD_SCOPES if s in scope_pks]
-scope_pks_list += [scope_pks[s] for s in SCOPE_MAPPINGS.keys() if s in scope_pks]
-
-# OAuth2 providers — client_secret sourced from SOPS-encrypted k8s secrets.
-# These are the real secrets the services use. Authentik must match.
-OAuth2_PROVIDERS = {
-    "api-gw": {
-        "client_id": "api-gw",
-        "client_secret_env": "AUTHENTIK_PROVIDER_API_GW_SECRET",
-        "redirect_uris": ["http://localhost:3000/callback", "https://api.riotpiao.com/callback"],
-    },
-    "minio": {
-        "client_id": "minio",
-        "client_secret": "9d2867fe08c3bf7fedd7e32bbaf4456fce3b0aaf788966d7559e1955947b0219",
-        "redirect_uris": ["http://localhost:9000/auth/sso/oauth2/code", "https://minio.riotpiao.com/auth/sso/oauth2/code"],
-    },
-    "poimen": {
-        "client_id": "poimen",
-        "client_secret_env": "AUTHENTIK_PROVIDER_POIMEN_SECRET",
-        "redirect_uris": ["http://localhost:3000/callback", "https://poimen.riotpiao.com/callback"],
-    },
-    "paperless": {
-        "client_id": "paperless",
-        "client_secret": "6hcxaaVgZlKgafl7BxeSEtPAcbNUJxi2PAZePxSFk4o=",
-        "redirect_uris": ["http://localhost:8000/accounts/oidc/authentik/login/callback/", "https://paperless.riotpiao.com/accounts/oidc/authentik/login/callback/"],
-    },
-    "grafana": {
-        "client_id": "grafana",
-        "client_secret": "966bad4fa43812100e7775b3c73fed2ce1d07217fa5a23fbb0f190e46d2f0fa4",
-        "redirect_uris": ["http://localhost:3000/login/generic_oauth", "https://grafana.riotpiao.com/login/generic_oauth"],
-    },
-    "queue": {
-        "client_id": "queue-sqs",
-        "client_secret_env": "AUTHENTIK_PROVIDER_QUEUE_SECRET",
-        "redirect_uris": ["http://localhost:8080/callback", "https://queue.riotpiao.com/callback"],
-    },
-    "forgejo": {
-        "client_id": "forgejo",
-        "client_secret": "G4klhs3JRfs5A7YnGs90WuOndBAvamWlZgaZRY8x",
-        "redirect_uris": ["http://localhost:3000/user/oauth2/authentik/callback", "https://forgejo.riotpiao.com/user/oauth2/authentik/callback"],
-    },
-    "immich": {
-        "client_id": "immich",
-        "client_secret": "QxyWfESXqTD55aUyh6miYnny1QTCEuEwyC4escw9",
-        "redirect_uris": ["app.immich:///oauth-callback", "https://img.riotpiao.com/auth/login", "https://img.riotpiao.com/user/oauth2/callback"],
-    },
-    "homarr": {
-        "client_id": "homarr",
-        "client_secret": "RMlDQAWdjT5YPPH0U7ztDoUFP7R7w95b2xqQ1pyS",
-        "redirect_uris": ["http://localhost:7575/auth/callback", "https://homarr.riotpiao.com/auth/callback"],
-    },
-    "argocd": {
-        "client_id": "argocd",
-        "client_secret_env": "AUTHENTIK_PROVIDER_ARGOCD_SECRET",
-        "redirect_uris": ["http://localhost:8080/auth/callback", "https://argocd.riotpiao.com/auth/callback"],
-    },
-    "vault": {
-        "client_id": "vault",
-        "client_secret_env": "AUTHENTIK_PROVIDER_VAULT_SECRET",
-        "redirect_uris": ["http://localhost:8200/ui/vault/auth/oidc/oidc/callback", "https://vault.riotpiao.com/ui/vault/auth/oidc/oidc/callback"],
-    },
-}
-
-import secrets as _secrets
-
-for provider_name, provider_spec in OAuth2_PROVIDERS.items():
-    # Resolve client_secret: explicit > env var > generate random
-    if "client_secret" in provider_spec:
-        client_secret = provider_spec["client_secret"]
-    elif "client_secret_env" in provider_spec:
-        client_secret = os.environ.get(provider_spec["client_secret_env"], _secrets.token_urlsafe(32))
-    else:
-        client_secret = _secrets.token_urlsafe(32)
-
-    redirect_uris_list = [{"url": uri, "matching_mode": "strict"} for uri in provider_spec["redirect_uris"]]
-
-    provider_payload = {
-        "name": provider_name,
-        "authorization_flow": auth_flow,
-        "invalidation_flow": inval_flow,
-        "grant_types": ["authorization_code", "implicit", "password"],
-        "client_id": provider_spec["client_id"],
-        "client_secret": client_secret,
-        "redirect_uris": redirect_uris_list,
-        "property_mappings": scope_pks_list,
-    }
-
-    if provider_name in existing_providers:
-        # UPDATE existing provider — sync secret + redirect_uris
-        provider_pk = existing_providers[provider_name]["pk"]
-        status, res = api("PATCH", f"/api/v3/providers/oauth2/{provider_pk}/", {
-            "client_id": provider_spec["client_id"],
-            "client_secret": client_secret,
-            "redirect_uris": redirect_uris_list,
-            "property_mappings": scope_pks_list,
-        })
-        if status in (200, 201):
-            print(f"  {provider_name}: updated (secret + redirect_uris synced)")
-        else:
-            print(f"  {provider_name}: UPDATE FAILED {status} {res}")
-    else:
-        # CREATE new provider
-        status, res = api("POST", "/api/v3/providers/oauth2/", provider_payload)
-        if status in (200, 201):
-            print(f"  {provider_name}: created")
-        else:
-            print(f"  {provider_name}: FAILED {status} {res}")
-
-# ===========================================================================
-# Phase 6: Create OAuth2 Applications (bind providers to public token endpoints)
-# ===========================================================================
-print("\n[6/7] Creating OAuth2 Applications...")
-print("     (binds providers to /application/o/token/ endpoints)")
-
-status, res = api("GET", "/api/v3/core/applications/?page_size=100")
-if status != 200:
-    die(f"GET applications -> {status} {res}")
-existing_apps = {a["slug"]: a for a in res.get("results", [])}
-
-for provider_name in OAuth2_PROVIDERS.keys():
-    # Get the provider PK
-    status, provider_res = api("GET", f"/api/v3/providers/oauth2/?name={provider_name}")
-    if status != 200 or not provider_res.get("results"):
-        print(f"  {provider_name}: provider not found, skip")
-        continue
-    provider_pk = provider_res["results"][0]["pk"]
-
-    if provider_name in existing_apps:
-        # Ensure app is linked to provider (fix orphaned apps)
-        app_data = existing_apps[provider_name]
-        if app_data.get("provider") != provider_pk:
-            app_uuid = app_data["pk"]
-            status, res = api("PATCH", f"/api/v3/core/applications/{app_uuid}/", {
-                "provider": provider_pk,
-            })
-            if status in (200, 201):
-                print(f"  {provider_name}: re-linked to provider")
-            else:
-                print(f"  {provider_name}: RE-LINK FAILED {status} {res}")
-        else:
-            print(f"  {provider_name}: ok")
-    else:
-        status, res = api("POST", "/api/v3/core/applications/", {
-            "name": provider_name,
-            "slug": provider_name,
-            "provider": provider_pk,
-        })
-        if status in (200, 201):
-            print(f"  {provider_name}: created")
-        else:
-            print(f"  {provider_name}: FAILED {status} {res}")
-
-# ===========================================================================
-# Phase 7: Create/update rock user → homelab-admins, matching Forgejo identity
-# ===========================================================================
-print("\n[7/10] Creating/updating rock user ([email protected])...")
-
-ROCK_EMAIL = "[email protected]"
-ROCK_PASSWORD = os.environ.get("ROCK_PASSWORD", "")
-
-status, res = api("GET", "/api/v3/core/users/?username=rock")
-if status == 200 and res.get("results"):
-    rock_user = res["results"][0]
-    # Ensure email matches Forgejo's rock user for OIDC linking
-    patch_data = {"email": ROCK_EMAIL, "name": "Rock"}
-    status, res = api("PATCH", f"/api/v3/core/users/{rock_user['pk']}/", patch_data)
-    if status in (200, 201):
-        print(f"  rock: updated email to {ROCK_EMAIL}")
-    else:
-        print(f"  rock: update FAILED {status} {res}")
-else:
-    if not ROCK_PASSWORD:
-        print("  rock: NOT FOUND and ROCK_PASSWORD not set, skipping creation")
-        print("    export ROCK_PASSWORD=<password> and re-run")
-        rock_user = None
-    else:
-        status, res = api("POST", "/api/v3/core/users/", {
-            "username": "rock",
-            "name": "Rock",
-            "email": ROCK_EMAIL,
-            "is_active": True,
-            "is_superuser": False,
-            "password": ROCK_PASSWORD,
-        })
-        if status in (200, 201):
-            rock_user = res
-            print(f"  rock: created with email {ROCK_EMAIL}")
-        else:
-            print(f"  rock: create FAILED {status} {res}")
-            rock_user = None
-
-if rock_user:
-    status, res = api("GET", "/api/v3/core/groups/?name=homelab-admins")
-    if status == 200 and res.get("results"):
-        admins_group = res["results"][0]
-        status, res = api("POST", f"/api/v3/core/groups/{admins_group['pk']}/users/add/", {"pk": rock_user["pk"]})
-        if status in (200, 201, 204):
-            print(f"  rock: added to homelab-admins")
-        else:
-            print(f"  rock: group add {status} {res}")
-
-# ===========================================================================
-# Phase 8: Email recovery flow (password reset via email)
-# ===========================================================================
-print("\n[8/10] Creating email recovery flow...")
-
-# Read SMTP config from gotify-smtp secret (same Gmail creds)
-SMTP_HOST = "smtp.gmail.com"
-SMTP_PORT = 587
-SMTP_USER = "[email protected]"
-SMTP_FROM = "[email protected]"
-# Password read from env at runtime: AUTHENTIK_EMAIL__PASSWORD
-
-# 8a. Create email stage for recovery
-status, res = api("GET", "/api/v3/stages/email/?name=email-recovery")
-if status == 200 and res.get("results"):
-    email_stage_pk = res["results"][0]["pk"]
-    print("  email-recovery stage: already exists")
-else:
-    status, res = api("POST", "/api/v3/stages/email/", {
-        "name": "email-recovery",
-        "use_global_settings": False,
-        "host": SMTP_HOST,
-        "port": SMTP_PORT,
-        "username": SMTP_USER,
-        "password": os.environ.get("AUTHENTIK_EMAIL_PASSWORD", ""),
-        "use_tls": True,
-        "use_ssl": False,
-        "timeout": 10,
-        "from_address": SMTP_FROM,
-        "template": "email/password_reset.html",
-        "activate_user_on_success": True,
-    })
-    if status in (200, 201):
-        email_stage_pk = res["pk"]
-        print("  email-recovery stage: created")
-    else:
-        email_stage_pk = None
-        print(f"  email-recovery stage: FAILED {status} {res}")
-
-# 8b. Create identification stage for recovery (email lookup)
-status, res = api("GET", "/api/v3/stages/identification/?name=recovery-identification")
-if status == 200 and res.get("results"):
-    ident_stage_pk = res["results"][0]["pk"]
-    print("  recovery-identification stage: already exists")
-else:
-    status, res = api("POST", "/api/v3/stages/identification/", {
-        "name": "recovery-identification",
-        "user_fields": ["email", "username"],
-    })
-    if status in (200, 201):
-        ident_stage_pk = res["pk"]
-        print("  recovery-identification stage: created")
-    else:
-        ident_stage_pk = None
-        print(f"  recovery-identification stage: FAILED {status} {res}")
-
-# 8c. Create password stage for new password entry
-status, res = api("GET", "/api/v3/stages/password/?name=recovery-password-change")
-if status == 200 and res.get("results"):
-    pw_stage_pk = res["results"][0]["pk"]
-    print("  recovery-password-change stage: already exists")
-else:
-    # Use prompt stage for password change instead
-    status, res = api("GET", "/api/v3/stages/user_write/?name=recovery-user-write")
-    if status == 200 and res.get("results"):
-        pw_stage_pk = res["results"][0]["pk"]
-        print("  recovery-user-write stage: already exists")
-    else:
-        status, res = api("POST", "/api/v3/stages/user_write/", {
-            "name": "recovery-user-write",
-        })
-        if status in (200, 201):
-            pw_stage_pk = res["pk"]
-            print("  recovery-user-write stage: created")
-        else:
-            pw_stage_pk = None
-            print(f"  recovery-user-write stage: FAILED {status} {res}")
-
-# 8d. Create recovery flow
-status, res = api("GET", "/api/v3/flows/instances/?slug=password-recovery")
-if status == 200 and res.get("results"):
-    recovery_flow_pk = res["results"][0]["pk"]
-    print("  password-recovery flow: already exists")
-else:
-    status, res = api("POST", "/api/v3/flows/instances/", {
-        "name": "Password Recovery",
-        "slug": "password-recovery",
-        "title": "Reset your password",
-        "designation": "recovery",
-    })
-    if status in (200, 201):
-        recovery_flow_pk = res["pk"]
-        print("  password-recovery flow: created")
-    else:
-        recovery_flow_pk = None
-        print(f"  password-recovery flow: FAILED {status} {res}")
-
-# 8e. Bind stages to flow in order
-if recovery_flow_pk and ident_stage_pk and email_stage_pk:
-    for order, stage_pk, label in [
-        (10, ident_stage_pk, "identification"),
-        (20, email_stage_pk, "email"),
-    ]:
-        status, res = api("POST", "/api/v3/flows/bindings/", {
-            "target": recovery_flow_pk,
-            "stage": stage_pk,
-            "order": order,
-        })
-        if status in (200, 201):
-            print(f"  bound {label} stage at order {order}")
-        elif status == 400 and "already exists" in str(res).lower():
-            print(f"  {label} stage: already bound")
-        else:
-            print(f"  bind {label}: {status} {res}")
-
-# ===========================================================================
-# Phase 9: Set recovery flow on brand
-# ===========================================================================
-print("\n[9/10] Setting recovery flow on brand...")
-
-if recovery_flow_pk:
-    status, res = api("GET", "/api/v3/brands/instances/")
-    if status == 200 and res.get("results"):
-        brand = res["results"][0]
-        status, res = api("PATCH", f"/api/v3/brands/instances/{brand['brand_uuid']}/", {
-            "flow_recovery": recovery_flow_pk,
-        })
-        if status in (200, 201):
-            print("  recovery flow set on brand")
-        else:
-            print(f"  FAILED {status} {res}")
-    else:
-        print("  no brand found")
-
-# ===========================================================================
-# Phase 10: Ensure Forgejo OAuth2 source uses matching email claim
-# ===========================================================================
-print("\n[10/10] Verifying Forgejo OIDC linkage...")
-print(f"  rock@Authentik email: {ROCK_EMAIL}")
-print("  Forgejo OIDC will match on email — ensure Forgejo's rock user")
-print(f"  has email {ROCK_EMAIL} in Forgejo settings → Profile")
-
-# ===========================================================================
-# Summary
-# ===========================================================================
-print("\n" + "="*70)
-print("AUTHENTIK PROVISIONING COMPLETE")
-print("="*70)
-print(f"\n  [1] Groups: {len(GROUPS)}")
-print(f"  [2] Service accounts: {len(SERVICE_ACCOUNTS)}")
-print(f"  [3] Scope mappings: {len(SCOPE_MAPPINGS)}")
-print(f"  [4] Flows resolved")
-print(f"  [5] OAuth2 providers: {len(OAuth2_PROVIDERS)}")
-print(f"  [6] OAuth2 applications bound")
-print(f"  [7] rock user ([email protected]) -> homelab-admins")
-print(f"  [8] Email recovery flow (smtp.gmail.com)")
-print(f"  [9] Recovery flow set on brand")
-print(f"  [10] Forgejo OIDC linkage verified")
-print("\nNEXT: Set Forgejo rock user email to [email protected] in Forgejo profile")
-print("TEST: https://authentik.riotpiao.com/if/flow/password-recovery/")
-print("="*70)

scripts/iam/rotate-secrets.sh

@@ -53,7 +53,7 @@ generate_secret() {
 
 declare -A NEW_SECRETS
 
-for svc in api-gw minio poimen paperless grafana argocd forgejo homarr immich vault portfolio-agent memory-agent local-llm; do
+for svc in api-gw minio poimen paperless grafana argocd forgejo immich vault portfolio-agent memory-agent local-llm; do
   NEW_SECRETS[$svc]=$(generate_secret)
   log "  $svc: ${NEW_SECRETS[$svc]:0:15}..."
 done
@@ -70,7 +70,6 @@ declare -A PROVIDER_PKS=(
   [grafana]=6
   [argocd]=7
   [forgejo]=8
-  [homarr]=9
   [immich]=10
   [vault]=11
 )
@@ -203,7 +202,7 @@ fi
 log ""
 log "=== Summary ==="
 log "Rotated 13 credentials:"
-log "  OAuth2 Providers: api-gw, minio, poimen, paperless, grafana, argocd, forgejo, homarr, immich, vault"
+log "  OAuth2 Providers: api-gw, minio, poimen, paperless, grafana, argocd, forgejo, immich, vault"
 log "  Service Accounts: portfolio-agent, memory-agent, local-llm"
 
 log ""

scripts/iam/zitadel-provision.py

@@ -49,6 +49,10 @@ CONF_DIR = Path(os.environ.get("ZITADEL_CONF_DIR", Path.home() / ".config" / "zi
 STATE_FILE = CONF_DIR / "state.json"
 NAMESPACE = os.environ.get("ZITADEL_NAMESPACE", "iam")
 BASE_URL = os.environ.get("ZITADEL_BASE_URL", "https://zitadel.riotpiao.com")
+# Notification delivery target: the in-cluster SMTP -> Gotify relay.
+SMTP_HOST = os.environ.get("ZITADEL_SMTP_HOST", "smtp-gotify.iam.svc.cluster.local:2525")
+SMTP_FROM = os.environ.get("ZITADEL_SMTP_FROM", "[email protected]")
+SMTP_FROM_NAME = os.environ.get("ZITADEL_SMTP_FROM_NAME", "ZITADEL")
 
 # ── desired ZITADEL state ──────────────────────────────────────────────────
 # Declared here, applied through the API by the `apply` phase. This replaces the
@@ -80,6 +84,24 @@ ROLES = {
     "sqs-writers": "SQS/Temporal queue read/write access",
     "s3-users": "S3 read access",
     "s3-writers": "S3 read/write access",
+    # LLM gate for the api-gw. The colon form matches the Authentik-era
+    # permission string, so consumer manifests did not change.
+    "llm:inference": "LLM inference access (api-gw)",
+    "llm-inference": "LLM inference access (dash alias)",
+    # Per-service capabilities. The gateway derives the required capability from
+    # the verb: GET/HEAD/OPTIONS -> "<service>:read", anything else ->
+    # "<service>:write" (internal/serviceadapter/router.go:142). The role key
+    # must match that string exactly, colon included.
+    "memory:read": "Poimen memory read (api-gw)",
+    "memory:write": "Poimen memory write (api-gw)",
+    "workflow:read": "Temporal workflow read (api-gw)",
+    "workflow:execute": "Temporal workflow execute (api-gw)",
+    "s3:read": "Object store read (api-gw)",
+    "s3:write": "Object store write (api-gw)",
+    "iam:read": "Identity read (api-gw)",
+    "iam:write": "Identity write (api-gw)",
+    "sqs:read": "Queue read (api-gw)",
+    "sqs:write": "Queue write (api-gw)",
 }
 
 _WEB = {"app_type_id": "OIDC_APP_TYPE_WEB", "auth_method_id": "OIDC_AUTH_METHOD_TYPE_BASIC"}
@@ -92,15 +114,22 @@ OIDC_APPS = {
     "argocd": {**_WEB, "redirect_uris": [
         "http://localhost:8080/auth/callback",
         "https://argocd.riotpiao.com/auth/callback"]},
+    # Forgejo derives the callback path from the login-source NAME
+    # (/user/oauth2/<name>/callback). Both spellings are registered so a
+    # rename between authentik and zitadel never breaks sign-in.
     "forgejo": {**_WEB, "redirect_uris": [
+        "http://localhost:3000/user/oauth2/zitadel/callback",
+        "https://forgejo.riotpiao.com/user/oauth2/zitadel/callback",
         "http://localhost:3000/user/oauth2/authentik/callback",
         "https://forgejo.riotpiao.com/user/oauth2/authentik/callback"]},
+    # ComfyUI has no native OIDC. oauth2-proxy is its front door and this app is
+    # the proxy's client, so the callback path belongs to the proxy.
+    "comfyui": {**_WEB, "redirect_uris": [
+        "http://localhost:4180/oauth2/callback",
+        "https://comfyui.riotpiao.com/oauth2/callback"]},
     "grafana": {**_WEB, "redirect_uris": [
         "http://localhost:3000/login/generic_oauth",
         "https://grafana.riotpiao.com/login/generic_oauth"]},
-    "homarr": {**_WEB, "redirect_uris": [
-        "http://localhost:7575/auth/callback",
-        "https://homarr.riotpiao.com/auth/callback"]},
     "immich": {**_WEB, "app_type_id": "OIDC_APP_TYPE_NATIVE", "redirect_uris": [
         "app.immich:///oauth-callback", "https://img.riotpiao.com/auth/login",
         "https://img.riotpiao.com/user/oauth2/callback"]},
@@ -110,6 +139,8 @@ OIDC_APPS = {
         "http://localhost:9000/auth/sso/oauth2/code",
         "https://minio.riotpiao.com/auth/sso/oauth2/code"]},
     "paperless": {**_WEB, "redirect_uris": [
+        "http://localhost:8000/accounts/oidc/zitadel/login/callback/",
+        "https://paperless.riotpiao.com/accounts/oidc/zitadel/login/callback/",
         "http://localhost:8000/accounts/oidc/authentik/login/callback/",
         "https://paperless.riotpiao.com/accounts/oidc/authentik/login/callback/"]},
     "poimen": {**_WEB, "redirect_uris": [
@@ -269,18 +300,52 @@ def _api(method: str, path: str, token: str, body: dict | None = None,
 
 def _ensure_project(token: str, name: str) -> str:
     code, d = _api("POST", "/management/v1/projects/_search", token, {})
+    project_id = ""
     for row in d.get("result") or []:
         if row.get("name") == name:
-            return row["id"]
-    code, d = _api("POST", "/management/v1/projects", token, {"name": name})
-    if code not in (200, 201) or not d.get("id"):
-        die(f"create project {name} failed: {code} {d}")
-    return d["id"]
+            project_id = row["id"]
+            break
+    if not project_id:
+        code, d = _api("POST", "/management/v1/projects", token, {"name": name})
+        if code not in (200, 201) or not d.get("id"):
+            die(f"create project {name} failed: {code} {d}")
+        project_id = d["id"]
+
+    # projectRoleAssertion puts the project roles into the ACCESS token as
+    # `urn:zitadel:iam:org:project:roles`. Without it the api-gw sees no
+    # llm:inference role and answers 403 for every inference call, even when
+    # the caller is correctly authorised in ZITADEL.
+    code, d = _api("PUT", f"/management/v1/projects/{project_id}",
+                   token, {"name": name, "projectRoleAssertion": True})
+    if code not in (200, 201):
+        die(f"enable projectRoleAssertion on {name} failed: {code} {d}")
+    return project_id
+
+
+def _ensure_builtin_login(token: str) -> None:
+    """Force the built-in login page instead of the hosted Login UI.
+
+    The hosted UI authenticates as the machine user `login-client`, which the
+    chart creates only from its one-shot setup job. When that user is missing,
+    every session write fails with "Could not create session for user" and no
+    one can sign in, at ZITADEL or at any relying party.
+
+    Disabling the loginV2 feature makes the server serve its own login page,
+    which needs no machine user. This is instance state in the database, not a
+    values key, so it must be applied explicitly.
+    """
+    code, d = _api("PUT", "/v2/features/instance", token, {"loginV2": {"required": False}})
+    if code not in (200, 201):
+        die(f"disable loginV2 failed: {code} {d}")
+    print("login page    : built-in (loginV2.required=false)")
 
 
 def _ensure_roles(token: str, project_id: str, roles: dict[str, str]) -> None:
     code, d = _api("POST", f"/management/v1/projects/{project_id}/roles/_search", token, {})
-    have = {r.get("roleKey") for r in (d.get("result") or [])}
+    # ZITADEL answers with `key`, not `roleKey`. Reading the wrong field left
+    # this set empty, so every re-run tried to recreate existing roles and died
+    # on the first 409.
+    have = {(r.get("key") or r.get("roleKey")) for r in (d.get("result") or [])}
     for key, display in roles.items():
         if key in have:
             continue
@@ -290,13 +355,16 @@ def _ensure_roles(token: str, project_id: str, roles: dict[str, str]) -> None:
             die(f"create role {key} failed: {code} {d}")
 
 
-def _ensure_oidc_apps(token: str, project_id: str, apps: dict[str, dict]) -> tuple[dict, dict]:
+def _ensure_oidc_apps(token: str, project_id: str, apps: dict[str, dict],
+                      known_secrets: dict[str, str] | None = None) -> tuple[dict, dict]:
     code, d = _api("POST", f"/management/v1/projects/{project_id}/apps/_search", token, {})
     existing = {a.get("name"): a for a in (d.get("result") or [])}
     ids: dict[str, str] = {}
     secrets: dict[str, str] = {}
+    known_secrets = known_secrets or {}
     for name, spec in apps.items():
         row = existing.get(name)
+        created = False
         if row:
             ids[name] = (row.get("oidcConfig") or {}).get("clientId", "")
             app_id = row.get("id")
@@ -319,8 +387,16 @@ def _ensure_oidc_apps(token: str, project_id: str, apps: dict[str, dict]) -> tup
                 die(f"create app {name} failed: {code} {d}")
             app_id = d["appId"]
             ids[name] = d.get("clientId", "")
+            created = True
         if spec.get("auth_method_id") == "OIDC_AUTH_METHOD_TYPE_NONE":
             continue
+        if not created:
+            # ZITADEL keeps one client secret per app, and the API cannot read it
+            # back. Generating a new one here would replace the deployed copy and
+            # break that app's login, so reuse the value already on disk.
+            if known_secrets.get(name):
+                secrets[name] = known_secrets[name]
+            continue
         code, d = _api("POST",
                        f"/management/v1/projects/{project_id}/apps/{app_id}"
                        "/oidc_config/_generate_client_secret", token, {})
@@ -329,17 +405,106 @@ def _ensure_oidc_apps(token: str, project_id: str, apps: dict[str, dict]) -> tup
     return ids, secrets
 
 
+def _ensure_smtp(token: str) -> str:
+    """Make sure the instance has one active SMTP provider.
+
+    ZITADEL sends verification codes and password resets by SMTP only. A
+    freshly added config is created INACTIVE (state 3), and an inactive config
+    makes GetSMTPConfig answer 404 "SMTP configuration not found", so nothing is
+    ever delivered. Activating it is what enables sending: after the activate
+    call the same GET returns the config and a resend reaches the relay.
+
+    This is instance state in the database, not a values key, so it must be
+    applied explicitly. The host points at the in-cluster smtp-gotify relay
+    (k8s/infra/iam/smtp-gotify.yaml), which forwards to Gotify.
+    """
+    code, d = _api("GET", "/admin/v1/smtp", token)
+    if code == 200 and (d.get("smtpConfig") or {}).get("id"):
+        smtp_id = d["smtpConfig"]["id"]
+        print(f"smtp      : already active ({smtp_id})")
+        return smtp_id
+
+    code, d = _api("POST", "/admin/v1/smtp", token, {
+        "senderAddress": SMTP_FROM,
+        "senderName": SMTP_FROM_NAME,
+        "host": SMTP_HOST,
+        "tls": False,
+    })
+    if code not in (200, 201) or not d.get("id"):
+        die(f"create smtp config failed: {code} {d}")
+    smtp_id = d["id"]
+
+    # The activate call is mandatory: without it the config stays inactive and
+    # every send is dropped while the API still reports success.
+    code, d = _api("POST", f"/admin/v1/smtp/{smtp_id}/_activate", token, {})
+    if code not in (200, 201):
+        die(f"activate smtp config {smtp_id} failed: {code} {d}")
+
+    code, d = _api("GET", "/admin/v1/smtp", token)
+    if code != 200 or not (d.get("smtpConfig") or {}).get("id"):
+        die(f"smtp config {smtp_id} still not visible after activate: {code} {d}")
+    print(f"smtp      : active ({smtp_id}) -> {SMTP_HOST}")
+    return smtp_id
+
+
+def _ensure_login_policy(token: str) -> None:
+    """Require password + a second factor, and demand enrolment at login.
+
+    Enforcement needs forceMfa. The v1 endpoint ignores the spelling "forceMFA"
+    as an unknown field, which is why earlier runs looked successful while
+    projections.login_policies5 kept force_mfa = false.
+
+    Second factors stay OTP and U2F: an authenticator app or a hardware key.
+    Multi-factor is left configured for U2F with verification so a later step
+    can move 2FA to 2MFA without another policy change.
+    """
+    code, d = _api("PUT", "/admin/v1/policies/login", token, {
+        # Case matters: protojson accepts "forceMfa", the lowerCamel form of
+        # force_mfa. Sending "forceMFA" is silently ignored as an unknown field,
+        # so the policy looks unchanged and MFA is never enforced.
+        "forceMfa": True,
+        "forceMfaLocalOnly": True,
+        "allowUsernamePassword": True,
+        "allowRegister": False,
+        "allowExternalIDP": True,
+        "hidePasswordReset": False,
+        "ignoreUnknownUsernames": True,
+        "passwordCheckLifetime": "864000s",
+        "externalLoginCheckLifetime": "864000s",
+        "mfaInitSkipLifetime": "0s",
+        "secondFactorCheckLifetime": "64800s",
+        "multiFactorCheckLifetime": "64800s",
+        "secondFactors": ["SECOND_FACTOR_TYPE_OTP", "SECOND_FACTOR_TYPE_U2F"],
+        "multiFactors": ["MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION"],
+        "passwordlessType": "PASSWORDLESS_TYPE_ALLOWED",
+    })
+    # ZITADEL answers 400 "has not been changed" when the policy already matches.
+    # That is success for an idempotent run, not a failure.
+    if code not in (200, 201) and "has not been changed" not in str(d.get("message", "")):
+        die(f"update login policy failed: {code} {d}")
+    print("login policy : password + 2FA, enrolment required")
+
+
 def phase_apply(_args: argparse.Namespace) -> int:
     """Declare the ZITADEL objects through the API. No Terraform, no state drift."""
     token = bootstrap_token()
     if not token:
         die("no iam-admin PAT — run the keys phase first")
 
+    _ensure_builtin_login(token)
+    _ensure_smtp(token)
+    _ensure_login_policy(token)
     project_id = _ensure_project(token, PROJECT_NAME)
     print(f"project   : {PROJECT_NAME} ({project_id})")
     _ensure_roles(token, project_id, ROLES)
     print(f"roles     : {len(ROLES)} ensured")
-    ids, secrets = _ensure_oidc_apps(token, project_id, OIDC_APPS)
+    known: dict[str, str] = {}
+    try:
+        known = (json.loads(STATE_FILE.read_bytes()).get("client_secrets", {})
+                 .get("value", {}) or {})
+    except (OSError, ValueError):
+        known = {}
+    ids, secrets = _ensure_oidc_apps(token, project_id, OIDC_APPS, known)
     print(f"oidc apps : {len(ids)} ensured, {len(secrets)} secrets issued")
 
     state = {
@@ -362,10 +527,6 @@ def phase_apply(_args: argparse.Namespace) -> int:
 SECRET_MAP = {
     "grafana": [("grafana-oidc-secrets.enc.yaml", "grafana-oidc",
                  "GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET", "secret")],
-    "homarr": [("homarr-auth-oidc.enc.yaml", "homarr-oidc",
-                "client-id", "id"),
-               ("homarr-auth-oidc.enc.yaml", "homarr-oidc",
-                "client-secret", "secret")],
     "minio": [("minio-secrets.enc.yaml", "minio-oidc",
                "MINIO_IDENTITY_OPENID_CLIENT_SECRET", "secret")],
     "paperless": [("paperless-ai-secrets.enc.yaml", "paperless-ai-config",

terraform/files/coredns/Corefile

@@ -22,7 +22,6 @@
     # TLS termination (cert-manager cert) and preserve the Host header. Routing
     # via nginx (not the backend service) is critical: a direct rewrite bypasses
     # nginx TLS and exposes each app's own self-signed cert, trusted by nothing.
-    rewrite name authentik.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name zitadel.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name grafana.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name minio.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local

terraform/templates/controlplane.tftpl

@@ -33,14 +33,6 @@ machine:
       - ip: ${forgejo_registry_ip}
         aliases:
           - ${forgejo_hostname}
-      # kube-apiserver's static pod runs on the host network, so it resolves
-      # authentik.riotpiao.com via THIS node's DNS, not cluster CoreDNS - the
-      # OIDC issuer discovery call would otherwise hit the public
-      # Cloudflare-fronted IP instead of nginx directly. Same reasoning as
-      # the forgejo entry above.
-      - ip: 192.168.1.160
-        aliases:
-          - authentik.riotpiao.com
   kubelet:
     image: ${kubelet_image}
     defaultRuntimeSeccompProfileEnabled: true
@@ -128,19 +120,10 @@ cluster:
       - ${san}
 %{ endfor ~}
     image: ${kube_apiserver_img}
-    # Foundation for the Authentik group -> k8s RBAC pattern in
-    # k8s/infra/rbac/ - additive only, existing client-cert auth
-    # (system:masters, this session's own admin@homelab-cluster kubeconfig)
-    # keeps working unchanged; a bad OIDC config just means OIDC logins fail,
-    # not a lockout. Prefixes avoid collision with built-in system:* users
-    # and groups.
-    extraArgs:
-      oidc-issuer-url: https://authentik.riotpiao.com/application/o/kubernetes/
-      oidc-client-id: kubernetes
-      oidc-username-claim: email
-      oidc-groups-claim: groups
-      oidc-username-prefix: "oidc:"
-      oidc-groups-prefix: "oidc:"
+    # No OIDC block. The cluster authenticates with client certificates. An
+    # earlier Authentik-based kube-apiserver OIDC config was removed from the
+    # live nodes, and leaving it here would re-add an issuer that no longer
+    # resolves on any future machine-config render.
     admissionControl:
       - name: PodSecurity
         configuration: