fix(ingress): restore the authentik.riotpiao.com route

Commit a02bee5 had both the Ingress rule and the cloudflared tunnel hostname for authentik.riotpiao.com. Both were lost, so the tunnel answered 404 for the hostname and the ingress had no matching rule. The CoreDNS rewrite and the authentik-server Service were still intact; only the two routing entries were missing. Re-add the Ingress (namespace iam, service authentik-server port 80, TLS terminated by the wildcard default-ssl-certificate) and the tunnel hostname.
fix(paperless): use Recreate strategy for paperless-ai RWO PVC deadlock
2026-10-26 03:12:26 -07:00 · 2026-10-26 00:35:59 -07:00 · 2026-10-26 00:28:19 -07:00 · 2026-10-26 00:14:51 -07:00 · 2026-10-26 04:34:51 +00:00 · 2026-10-26 03:24:32 +00:00
26 changed files with 148 additions and 364 deletions
@@ -33,8 +33,6 @@ data:
    ingress:
      - hostname: paperless.riotpiao.com
        service: https://paperless.riotpiao.com
-      - hostname: authentik.riotpiao.com
-        service: https://authentik.riotpiao.com
      - hostname: img.riotpiao.com
        service: https://img.riotpiao.com
      - hostname: riotpiao.com
@@ -55,4 +53,8 @@ data:
      # even though the DNS CNAME points at the tunnel.
      - hostname: zitadel.riotpiao.com
        service: https://zitadel.riotpiao.com
+      # AUTHENTIK. Same reasoning as ZITADEL: a hostname absent from this table
+      # gets 404 from the connector. CoreDNS rewrites the name to ingress-nginx.
+      - hostname: authentik.riotpiao.com
+        service: https://authentik.riotpiao.com
      - service: http_status:404
@@ -26,7 +26,7 @@ spec:
          command:
            - sh
            - -c
-            - (cat /etc/ssl/certs/ca-certificates.crt 2>/dev/null; cat /homelab-ca/homelab-ca.crt) > /merged/ca-bundle.crt
+            - (cat /etc/ssl/certs/ca-certificates.crt 2>/dev/null; cat /homelab-ca/ca.crt) > /merged/ca-bundle.crt
          volumeMounts:
            - name: homelab-ca
              mountPath: /homelab-ca
@@ -1,78 +0,0 @@
-# Homarr landing page with Authentik SSO
-
-# Probe tuning (chart DOES expose these — the old PostSync patch-job was
-# unnecessary and fragile: it only patched one Deployment revision, so any later
-# rollout reverted to the chart's aggressive defaults). Homarr's first-boot icon
-# updater blocks the event loop for ~50s ("icons updater took 49553ms"), during
-# which /api/health/live can't answer within the default 10s×3 window → kubelet
-# SIGTERMs the pod → CrashLoopBackOff (247 restarts, 503 at the ingress). Give
-# liveness a wide window so the icon import can finish without a kill.
-livenessProbe:
-  initialDelaySeconds: 60
-  periodSeconds: 30
-  timeoutSeconds: 5
-  failureThreshold: 10
-readinessProbe:
-  initialDelaySeconds: 30
-  periodSeconds: 15
-  timeoutSeconds: 5
-  failureThreshold: 6
-
-image:
-  repository: ghcr.io/homarr-labs/homarr
-  tag: "latest"
-  pullPolicy: Always
-
-replicaCount: 1
-
-# Configure SSO via environment variables
-# Chart supports these via top-level env dict (not array)
-env:
-  AUTH_PROVIDERS: "oidc,credentials"
-  AUTH_OIDC_ISSUER: "https://authentik.riotpiao.com/application/o/homarr/"
-  # AUTH_OIDC_URI (authorize endpoint) is REQUIRED in addition to ISSUER — homarr
-  # hides the "Sign in with Authentik" button entirely when it's absent (per the
-  # authentik Homarr integration + homarr SSO docs). This was the missing var.
-  AUTH_OIDC_URI: "https://authentik.riotpiao.com/application/o/authorize/"
-  AUTH_OIDC_CLIENT_NAME: "Authentik"
-  AUTH_OIDC_GROUPS_ATTRIBUTE: "groups"
-  AUTH_OIDC_SCOPE_OVERWRITE: "openid email profile groups"
-  AUTH_OIDC_AUTO_LOGIN: "false"
-  # Link the OIDC identity to an existing homarr account with the same email.
-  OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING: "true"
-  # The analytics cron blocked the (single-threaded) Next.js event loop for ~16s
-  # per run ("callback took longer than expected"), compounding CPU pressure.
-  DISABLE_ANALYTICS: "true"
-  BASE_URL: "https://homarr.riotpiao.com"
-  NEXTAUTH_URL: "https://homarr.riotpiao.com"
-
-# Client credentials from homarr-oidc secret
-# Chart doesn't support envFrom, so we add via extraEnv
-extraEnv:
-  - name: AUTH_OIDC_CLIENT_ID
-    valueFrom:
-      secretKeyRef:
-        name: homarr-oidc
-        key: client-id
-  - name: AUTH_OIDC_CLIENT_SECRET
-    valueFrom:
-      secretKeyRef:
-        name: homarr-oidc
-        key: client-secret
-
-tolerations:
-  - key: node-role.kubernetes.io/control-plane
-    operator: Exists
-    effect: NoSchedule
-
-resources:
-  requests:
-    cpu: 250m
-    memory: 384Mi
-  limits:
-    # Next.js 16 + bundled redis + the icon-updater (28k icons) saturated the old
-    # 500m limit; CPU throttling made Next.js abort with exit 134 (SIGABRT) and
-    # self-restart in a loop, so nginx saw no upstream and returned 502. Give it
-    # real CPU headroom.
-    cpu: "2"
-    memory: 1Gi
@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: dashboard
-# Probes are now tuned via homarr-values.yaml (chart-native); the old
-# fix-probes-job PostSync hook is removed. homarr-secrets/auth-oidc/db-encryption
-# Secrets are delivered by the sops-secrets (ksops) Application.
-resources: []
@@ -49,9 +49,9 @@ spec:
              echo "[init] Fetching JWT token from Authentik for paperless-ai-agent..."
              
              # Get JWT token via client_credentials grant
-              TOKEN_RESPONSE=$(curl -s -X POST https://authentik.riotpiao.com/application/o/token/ \
+              TOKEN_RESPONSE=$(curl -s -X POST https://zitadel.riotpiao.com/oauth/v2/token \
                -d "grant_type=client_credentials" \
-                -d "client_id=paperless-ai-agent" \
+                -d "client_id=396757803559027071" \
                -d "client_secret=29skAhE0tBzWn0qrPvmPTQMva0joFjcCr7msDQr_VXQ" \
                -d "scope=openid llm:inference" 2>/dev/null)
              
@@ -9,6 +9,14 @@ metadata:
    app.kubernetes.io/name: paperless-ai
 spec:
  replicas: 1
+  # Recreate, not RollingUpdate: paperless-ai-data is a single RWO PVC. With
+  # RollingUpdate the new pod tries to mount the PVC while the old pod still
+  # holds it -> "Multi-Attach error" / stuck Init:0/1 forever, rollout wedged
+  # at "1 desired, 1 ready, 1 updated, 1 unavailable". Recreate terminates the
+  # old pod first so the PVC detaches before the new one starts. Same pattern
+  # as the Forgejo gitea Deployment.
+  strategy:
+    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: paperless-ai
@@ -43,9 +51,9 @@ spec:
              
              # Get JWT token via client_credentials grant
              # Client secret sourced from environment (injected from paperless-ai-config Secret)
-              TOKEN_RESPONSE=$(curl -s -X POST https://authentik.riotpiao.com/application/o/token/ \
+              TOKEN_RESPONSE=$(curl -s -X POST https://zitadel.riotpiao.com/oauth/v2/token \
                -d "grant_type=client_credentials" \
-                -d "client_id=paperless-ai-agent" \
+                -d "client_id=396757803559027071" \
                -d "client_secret=${LLM_AUTH_CLIENT_SECRET}" \
                -d "scope=openid llm:inference" 2>/dev/null)
              
@@ -171,40 +171,6 @@ spec:
    syncOptions:
      - CreateNamespace=true
 ---
-# Consolidated: homarr + homarr-patches → homarr
-# Helm chart + values + PostSync hook patch (fix-probes-job.yaml)
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: homarr
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "8"
-spec:
-  project: homelab
-  sources:
-    - repoURL: https://homarr-labs.github.io/charts
-      chart: homarr
-      targetRevision: "*"
-      helm:
-        valueFiles:
-          - $values/k8s/apps/homarr/homarr-values.yaml
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
-      targetRevision: main
-      ref: values
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
-      targetRevision: main
-      path: k8s/apps/homarr  # PostSync hook: fix-probes-job.yaml
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: dashboard
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
---
 # Portfolio site at riotpiao.com - static Next.js site from rock/riotpiao.com repo.
 # Points directly to infra/portfolio/base (bypassing repo's own argocd-apps.yaml
 # which has wrong URLs). Image built by Forgejo Actions on rock/portfolio repo.
@@ -38,7 +38,6 @@ spec:
    - https://charts.zitadel.com
    - https://strimzi.io/charts/
    - https://charts.bitnami.com/bitnami
-    - https://homarr-labs.github.io/charts
    - https://go.temporal.io/helm-charts
    - https://portainer.github.io/k8s/
    # Substrate charts (cert-manager, ingress-nginx, reloader) — app-of-apps owned
@@ -5,7 +5,7 @@ metadata:
    namespace: ENC[AES256_GCM,data:ZHnVZyd3wA==,iv:3evUnFTQfRz/ZilUQIl/9dsCba3nsX6o/iQsGXMBfgM=,tag:+9kp+VRu1ksroDTbTGmGPA==,type:str]
 type: ENC[AES256_GCM,data:bHX+Bu9o,iv:8qqNddsuw4YoHAuJfUcPIqjcqNySIh5Ln8OhsfZxuk8=,tag:P7QGUXo9Io2Y19YqlWv5sQ==,type:str]
 stringData:
-    GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:qW2SQSsGD0YupU2SMzRaYwkLRjXAwV1OJBnhATpCJrOHWbEytw6IphOmPPd3VZKfHncekA4agXi4K3rUPHIx0Q==,iv:NCeW/UfIl0RvHV39ubN2mDfFp7GTQNuFv8KiEF+7KOE=,tag:lisx4h4PqUfLwBX8ca9Siw==,type:str]
+    GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:nJz9pqa6w9ZGOjanZ32D38Bolg2YrdHs1crhb2uZkKyaaKDpklVb4FOKZ46K+NS1NXjoS6XDUAlV69CSvm1PeA==,iv:g9F/iLuzNC0WogtDJ/TAb3+97N6iGkbOTlb4SzYzwx8=,tag:4F3kUheGbtW2U6jgOvRO1A==,type:str]
 sops:
    age:
        - enc: |
@@ -17,7 +17,7 @@ sops:
            LS0cIDUhjPFbeu7qUATOrat6vMUi0UREbXSFZ1KyAjNAwJZaUusPMA==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-08-12T18:02:01Z"
-    mac: ENC[AES256_GCM,data:yUBBV7dLEPld9yJacn+YaOT8M1NJ2ploGIxV66aVOH5x4tDAsskcUQJlzApWCQmORuCuMKg6qfpGgLTojfD5msha+ufVVJXHl7ua+STar1/FPJXaHm+z7YyZdsD5j6f3AH8q18DuLy2DYLjXELmPBsp50g7MDJEm3xLhCUXygjQ=,iv:xl0OtA/2umz0YH5b+6QjlAByZWbvfGOmHqomziNjlkw=,tag:xwkQDZx19Lf6QSwU2zPYTQ==,type:str]
+    lastmodified: "2026-10-26T04:03:16Z"
+    mac: ENC[AES256_GCM,data:0cgVNtFMwhbEHBxu7T1XfstcQlgUTxijq9Mz36zC60E7kYXRNwGt2/0KoCaqaE0leypwAdrPn2OjeoDPeCN6x+n0vLRVX2tnli6HazBLbRsPHljDAV0ASF07iNhb0PvgtWay432Mm+sGATkel3ITdAaP0lISNLUYfEe1/TbYHkk=,iv:FZ9Bgtk7LOC3aOSOo1+50zwLGhlcUZYJaUQ9r05cAn0=,tag:tsLQ1frZ7li5l717CCtgoQ==,type:str]
    unencrypted_suffix: _unencrypted
    version: 3.13.2
@@ -1,24 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:uiQ=,iv:vknDc16Zrz/lxS1WG3ksG4SHjhJSTDdklVxxwL8eylA=,tag:1srpVd6QTYQGGGYGXT8Cbw==,type:str]
-kind: ENC[AES256_GCM,data:K6EPYaNE,iv:VWzawfTDNlag+shjBqwSzZGcQQq/TGxeHDqd4fAh5Vc=,tag:ncPqMYjq/73oMzphWhuuFA==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:vaRNQHFYfdUz1hzuYO0JxQ==,iv:W7aUJID5mxoO1NQAcyPDYV1FGtBT8myKVMA3s2WgrPk=,tag:4Ef4GBtTR3dVanscvigRmw==,type:str]
-    namespace: ENC[AES256_GCM,data:HDlmfGwad37/,iv:JFPXxz9xp5vDJRcWy73SYGWDMyHKWQq9Bvy/NJTwTnU=,tag:2ldVXgzKn4xp1rZI/VYgUw==,type:str]
-type: ENC[AES256_GCM,data:UgolDLIV,iv:O4himI90UVwx+OjKJXobu10Zg3a5IoQcjAORsdhaWpg=,tag:xltntRsamhQkPEoBNtMytw==,type:str]
-stringData:
-    oidc-client-id: ENC[AES256_GCM,data:RLdxXY/a,iv:US/fBReK7u8WA4IS6TSzYiHQkte2CuVgugIMpA/pIlA=,tag:QKrHGQrzI9YpfNQD+ts68A==,type:str]
-    oidc-client-secret: ENC[AES256_GCM,data:SS+I92xEkOcJHTfWvZ1AA8hh1bFAtND5adZ6Uh73nIPiqAo958GSag==,iv:9HcmXWrGtflc6WWQe0n/pgB1Xveakofc3hvz5vuE29A=,tag:0emgeyM4GBftVKn/fx7XPg==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCWkR5V0ZYSTBSSU1OTWF1
-            TzFxdnZkUFFIcGJWZ1VUU21ZUnU2cUdob1drCkhVTm02dkZPZ2lNWktOcWZ2c0Vi
-            dG1PSmZBR2M2anA2Z09iYUU0SjVzTlEKLS0tIGF1eVBBUHdhVk9YSzJlQXVwd3RE
-            bUd3UTlwR1NiYjNlcGpweTBhdmk5b0UK8pwUoVCr1uBX9dQ7EGRgFMAPk/z8N9Fg
-            6GRUORFug5h7x5kjXK9sU0yTHjFSekwBi75GLng0IrLEGJxHVM5wVQ==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-08-12T21:07:30Z"
-    mac: ENC[AES256_GCM,data:NupjQWBJHMOo3/VX5n5nRx+RFT14N71XkrjXRC/VCP7i7H8yn3tcRdH9g14usgWunmqg2KKpGMUIZ9bsQ9Vds9sBvUKvLyRkfQnPwPh9+PFCF3ZZLPgzqcT19kg4I3QabmO+LPzQXsZWLKIqgF9/B60EVIgYyKhZmP7XblY5AVo=,iv:r0deq8+txE8TwzdtxOMaIAZbZc2fu+Tp4Jd2HZGbkhM=,tag:qMpZp6LcWjJHYMDp9ecBkA==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2
@@ -1,23 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:FO4=,iv:kKIuJp4uGeX6vECsXk7w43F9S281jObQchmK8r1+kmA=,tag:x5LYd34dzNDLCma/78M4+w==,type:str]
-kind: ENC[AES256_GCM,data:o4RTN8SK,iv:uyOJWjDmHIPuBl9Wc1S/HxUabV2yytWr1bntHW68sTI=,tag:3On0SnQVJ/ICMMryQe+8JQ==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:a89dHmLdSeMHE7ZP0Q==,iv:OWJvJhFqJ7A0UGVJnZILzCJ/4VuVFib9sUDjXuwyqJQ=,tag:1XrIQn1GDh8RQ4vmQAu7+g==,type:str]
-    namespace: ENC[AES256_GCM,data:4wBVpZJgQGM9,iv:3Tn1u/2TP/+SnELu34PDf4Jauf2L4f8+MtgrPIlyKzk=,tag:L3qbKFBjm16g8KX5vUsK6A==,type:str]
-type: ENC[AES256_GCM,data:mdrF9vUb,iv:7ukOgwXlnRf5mpJ/+6YXtyGRonnqehEgT4pJJIafw7c=,tag:90mt7jpNb3N80kCEi+R/rA==,type:str]
-stringData:
-    db-encryption-key: ENC[AES256_GCM,data:NWJryAEd/eUJxbNiu05RzLF/l7GDxIQM7RQe3xKBz6XklgRAFwQxxjakcVd85pePUBaQYz3zttFglWhfJlWhkA==,iv:eUWbcs0B/mIheyAQ2+DyKgcA98CRKQGAVC3O0WIkfU8=,tag:be06X6AQqlohYlxuYoZiTg==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1Ym5yQ1pmWHZjVnYxbUVO
-            SkZ5dnI2OXR3cmZjZkM0K1ErMElLNktlK1JFCmpleFBrcXkwcDA4cGFuWWN6VDQv
-            dVV4NjB4MjEreENVQnZ2ejVLblRYOVUKLS0tIG9VbXJvUmQ3SzMzN3IrRDlac2sr
-            eGZNYXBoZFZDeisrVCtUMXVPaEpoNFkKjwhUU+Zsqv4Be+m558fET5UhF/2rO73J
-            AhGbJVaA7PaOCswPWiOLso26zD+MBB3VKHNdUFnenpoM16Nu4pOf5w==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-08-12T21:07:30Z"
-    mac: ENC[AES256_GCM,data:KrGQY/eOmihYCvQCbfcM6bZ6rfx4zKh62M8NM0VQr1//1dSHpOOh25dYGLuQeECnqLxSpGQNWzr2xjUYWs4NOdSEFGq6FL2iHE3LnqoBZspp/JFJYP6+z/8jSUojwKEW7OuZZdPN6gF2u+IPOeWbGftnjS7X+atoSkYag2ty2vk=,iv:IOPEgBizsxrVoK5oSdWmi0uCBUnReOEnMYXuwSBKTzA=,tag:9k/XQ/AE7wSFq5XMbY0FTA==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2
@@ -1,23 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:4OY=,iv:0Lgui0+X2oTlgCX5HEIIihEsGJD0C2+pDIOTCNi4r+g=,tag:uL7vlreaHjcLJjV7e5I7PQ==,type:str]
-kind: ENC[AES256_GCM,data:x/ltkind,iv:KRBfS7COsTs/l3Fhyk5FvH7IVc+r/6M6FVOo+kPDe1Q=,tag:UuTbe213hDfK/WUtKS/doQ==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:LpOEecTJBuGy5PqNSFM=,iv:Q+DCLGtw3wihhdAgEbzYHyQhFTPWFyE2iJKl9mYaA2E=,tag:E2wrig4lRXGDvSCHec5clQ==,type:str]
-    namespace: ENC[AES256_GCM,data:6kMVCXaF68NO,iv:gnCCkV7GKXA2HWOOeNUGnpAycf8U7pl6F8Vfo6DhLR4=,tag:0VdeySsuhUr2heXyGXZwBg==,type:str]
-type: ENC[AES256_GCM,data:6muC3Zqh,iv:gBaC+6MXvZY/bIpy/cEG/zWwLBaUFMVfxAHa1OnwfnQ=,tag:v6NYyhAKAwovluHAXNaOVA==,type:str]
-stringData:
-    SECRET_ENCRYPTION_KEY: ENC[AES256_GCM,data:jX9ULlaBYTSTFGRMplSder5rMrsz7THU3kgJSGef0r5rZvtoaAG9NVYU2QUEuD0sZgfqRooeMOkDCAqFc8qsuw==,iv:uOmx8w3XPKnoxfasf7gqi/bljxigpLwaAC30c2TroKg=,tag:Dmbu6m3+UZa1w0UR0LRh9g==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6TDVyNGRtYWgzMDYwdjdr
-            NXJWcGJZNUx6YzBGWm1nWlp0SlN3WXhaR0VBCjZ3bDBmUTFCUjg3U21wak90eHZK
-            NlRCTUZQSHhoS0ZSUGZ4UHhST01KNmMKLS0tIGUxcGo0NmJ2bmJ6eGJ3QWxzYVM5
-            c2Z6UkFjQmZ4ejIvK1JQQkZ0VFFIZ3cKA8UzmGsX+s3yOermOHqbnnEtekHCTqmC
-            R3Jyzf6OolZMJpNwbetcsOfgO61aM7LHl/Xb/hFLbLjZ+eECrt8VpA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-08-12T18:02:01Z"
-    mac: ENC[AES256_GCM,data:HTrEEVDm8JqnVBFaY/FJknxma0nI95tRiwVc0K76k+2R4jgKCBA3EUAzPVS+gA4rTAeKHPSHrT2eidlkseT2WQUjqMRrpHcUsbSjNfpTEY2g/U0PIiOXZMRGfwmsQVgmu2fqeMOyzDSyya0scdWJXPraRPNZ+OpEkNVlm4rWcgs=,iv:KY3dnnmooJgsu66wc7gbzeIGUXZNgVrxAhpAwxoG+G8=,tag:7r6d41oTD136N57rtY7auA==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2
@@ -1,72 +1,72 @@
-apiVersion: ENC[AES256_GCM,data:Mdg=,iv:u/JjNJfdyz7ehk8lHZRh1u9zkNuufHosyXv10Gm+T6E=,tag:pkgZVJid6kpGuy61+oEMlQ==,type:str]
-kind: ENC[AES256_GCM,data:/kWhhqyz,iv:DymezGpBHmKT3BM/CcUKEGIWZw/JXNutReSKfhfmoD4=,tag:DnA+316Z+0eqBWN8YLyv1A==,type:str]
+apiVersion: v1
+kind: Secret
 metadata:
-    name: ENC[AES256_GCM,data:xs1k//nWy1iJ52Q=,iv:NDGvM319FCypxFLWwONcF12osaU/EL0IwD0c2xtqYnU=,tag:6IhfISF08WQbxrUmT49d7g==,type:str]
-    namespace: ENC[AES256_GCM,data:jpUzI7BmZA==,iv:PQrfm67la6RJCRq0H7qpiY8n2hPUjcaK6gmJ/zPQW30=,tag:bp/3GYbRpYOIub5nT0zz/A==,type:str]
-type: ENC[AES256_GCM,data:fndXB4Y1,iv:EXOe0day1ScxvZ7ozn1QyHgaZgnvlPNmvSQG74aw7lM=,tag:quPmKvFTjRqtZoVUEoQAHQ==,type:str]
+    name: minio-creds
+    namespace: storage
+type: Opaque
 stringData:
-    config.env: ENC[AES256_GCM,data:3RIQ1i6NtY1Tv2eJY8JXSgfBEqi9px/9TJVNrPf9+brtGy9Mx3SwjKVnjGXUcA2cYcNZb1JR7temXmznXQdsRfZ9yohe4oc1vL3yPGPY9YfP7AHGYj9E7tghu/rgkHOf93RmfdKv0Rrq6miBcA==,iv:0RQVMi2mMHBRTJ1OX6IDFvq9Qr7zpqgQzt+MPPgBIHA=,tag:HNXLKf5X4P3E+hc7YbDtNQ==,type:str]
+    config.env: ENC[AES256_GCM,data:1yogGyBdwrlg27H8R5Kr9VcPu+xwS5/nPhi7eLcmVYtXmPlNokCsWHA70qnn/+I6i4ODys8GML++VeZ/lmcHiP7RIbY+G6xmw6nfBCXitgE8kQwTPsUUzn9bobOn4Sr1YMBf7FQ/Q0N8aupGJA==,iv:EfCdim4TLkP/FP1u1yoKZCq8YGFzVh7ca4yu1+WzXwE=,tag:rTYe0SIAEsUhh0KHQIEKNw==,type:str]
 sops:
    age:
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtUVJFQ1ErNmkzd1N6b29t
-            L0VWR2tlcEIxeG1CR1hXRkw2cEt0Q2crMWlVClg2UlNhUzdJZGpLZjJtYlAvbk16
-            eHk0ZHZiNzVRTWhyQzlieTU5Y3QraGsKLS0tIHA5UVhvUXhNSDk0QlV0R2RzR1dP
-            azVEQzgvSFNwak9TcW1USFNOb3RvSkUKNLuW3h3cHDSSCZGe9Vyiv5m+wXihtCYX
-            oJtbRK+kJF8oOUo4emI+SLGrCsWq5cG2wN/wgP+ChR1zUgRgfq5oOA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2SStVR0lpOWs0VnN6dkdp
+            RktMUmNRR2diTUtiVk9tRk1wSjVTMnRtVlJBCkk1S0dwNUNHb25RQlZ4ZFRocisv
+            aS9kbmQydWVmN1AxU3VvbFZsS2tmTHcKLS0tICtRY0ZKeFhCTUdaNW5PSFRNZ2dG
+            OERIZ0xMbHBvSVNyaGxCVFpqRzlxa1EKbrjfk/CFlTSyJYgTzQ67W3JyR1fwv8VF
+            dxGeAgLY4EQrf+2PbODtazRFreS+sl7dxq+rKMOVZTsjGHakkqHy9A==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-08-12T18:02:01Z"
-    mac: ENC[AES256_GCM,data:hQfimKuhfiIiZQAyNDZQR25HZ5biU+kaWig3ElVPiqMY3B0LrmKyOEs7ittd3j3meUkPEFSmm1yYSXcdCuf6w7cwSbEiL5DG8t7QKPbnx/aRdyHAJW+1VC0e3Lye43gaHya0iUaWS/YFQcrT01oEbckLIDWPKfvA6pg2bZ4kMZ4=,iv:AydyWMVcjTQu+7Fzw5vtqkvTTeQEMt8y6snESoLUDE8=,tag:SoKklNqa9nH9G6d9+PnolQ==,type:str]
-    unencrypted_suffix: _unencrypted
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-10-26T04:03:16Z"
+    mac: ENC[AES256_GCM,data:gxu4WcJEuFgjtWCfAjose8R8a566/OLrXoiJmKfcvVfTFDTdGM7I4gzQVvpjEfra5Hjyt7kvLlaV2K5bKJ0k6NXbbmgrqAqEOEcPg+cnPy1FtQGAYOo3VzgKqrpLOCs/7wh4YR23XHHsjQlHAcP8BmhrqnpHXR9FMZObrKjnQj8=,iv:KJZfw0n2DOtdZHeVDk6TrpO8q57yD+xdEVt9+hM0D4Q=,tag:rHQaMjvQwaB8Am/AlTKq1g==,type:str]
    version: 3.13.2
 ---
-apiVersion: ENC[AES256_GCM,data:Mdg=,iv:u/JjNJfdyz7ehk8lHZRh1u9zkNuufHosyXv10Gm+T6E=,tag:pkgZVJid6kpGuy61+oEMlQ==,type:str]
-kind: ENC[AES256_GCM,data:/kWhhqyz,iv:DymezGpBHmKT3BM/CcUKEGIWZw/JXNutReSKfhfmoD4=,tag:DnA+316Z+0eqBWN8YLyv1A==,type:str]
+apiVersion: v1
+kind: Secret
 metadata:
-    name: ENC[AES256_GCM,data:XEQHsQqTgwukYw==,iv:wTw2eoooDA9EfB2df3jzb0IWUdtLSwcuKzx8yDBaihQ=,tag:oncXt2gM1k6Qppafpu/D1w==,type:str]
-    namespace: ENC[AES256_GCM,data:jpUzI7BmZA==,iv:PQrfm67la6RJCRq0H7qpiY8n2hPUjcaK6gmJ/zPQW30=,tag:bp/3GYbRpYOIub5nT0zz/A==,type:str]
-type: ENC[AES256_GCM,data:fndXB4Y1,iv:EXOe0day1ScxvZ7ozn1QyHgaZgnvlPNmvSQG74aw7lM=,tag:quPmKvFTjRqtZoVUEoQAHQ==,type:str]
+    name: minio-oidc
+    namespace: storage
+type: Opaque
 stringData:
-    MINIO_IDENTITY_OPENID_CLIENT_SECRET: ENC[AES256_GCM,data:IYBfNW19cTo8WkCGT4zuCljzi2bkbYWJ8DY/yedR2MJNqEO+bMVvjx0OqSqbPp6rnwGyMQOhBN0gXPbEVRDBGg==,iv:I1aGIikbHTKvh//4Inhp7UoNfhjlIXSpcyP4RqljvqM=,tag:Zh3Vh5DQYAsTtiW59D0/QA==,type:str]
+    MINIO_IDENTITY_OPENID_CLIENT_SECRET: ENC[AES256_GCM,data:eFfwW2ZnV+o3/6XHjUvyFsDbaIAdosY2PXOnRdN4Ie49YDIjfJPe+Mg1FsbgoEHEjuB33hfxesb4TWOJQfW8Og==,iv:+kRr9A3auts1XHgZWa+t5b2m4lF0x9dVhiRpB17fzv4=,tag:tH/jszFzLQdqORGr9vfTGw==,type:str]
 sops:
    age:
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtUVJFQ1ErNmkzd1N6b29t
-            L0VWR2tlcEIxeG1CR1hXRkw2cEt0Q2crMWlVClg2UlNhUzdJZGpLZjJtYlAvbk16
-            eHk0ZHZiNzVRTWhyQzlieTU5Y3QraGsKLS0tIHA5UVhvUXhNSDk0QlV0R2RzR1dP
-            azVEQzgvSFNwak9TcW1USFNOb3RvSkUKNLuW3h3cHDSSCZGe9Vyiv5m+wXihtCYX
-            oJtbRK+kJF8oOUo4emI+SLGrCsWq5cG2wN/wgP+ChR1zUgRgfq5oOA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2SStVR0lpOWs0VnN6dkdp
+            RktMUmNRR2diTUtiVk9tRk1wSjVTMnRtVlJBCkk1S0dwNUNHb25RQlZ4ZFRocisv
+            aS9kbmQydWVmN1AxU3VvbFZsS2tmTHcKLS0tICtRY0ZKeFhCTUdaNW5PSFRNZ2dG
+            OERIZ0xMbHBvSVNyaGxCVFpqRzlxa1EKbrjfk/CFlTSyJYgTzQ67W3JyR1fwv8VF
+            dxGeAgLY4EQrf+2PbODtazRFreS+sl7dxq+rKMOVZTsjGHakkqHy9A==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-08-12T18:02:01Z"
-    mac: ENC[AES256_GCM,data:hQfimKuhfiIiZQAyNDZQR25HZ5biU+kaWig3ElVPiqMY3B0LrmKyOEs7ittd3j3meUkPEFSmm1yYSXcdCuf6w7cwSbEiL5DG8t7QKPbnx/aRdyHAJW+1VC0e3Lye43gaHya0iUaWS/YFQcrT01oEbckLIDWPKfvA6pg2bZ4kMZ4=,iv:AydyWMVcjTQu+7Fzw5vtqkvTTeQEMt8y6snESoLUDE8=,tag:SoKklNqa9nH9G6d9+PnolQ==,type:str]
-    unencrypted_suffix: _unencrypted
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-10-26T04:03:16Z"
+    mac: ENC[AES256_GCM,data:gxu4WcJEuFgjtWCfAjose8R8a566/OLrXoiJmKfcvVfTFDTdGM7I4gzQVvpjEfra5Hjyt7kvLlaV2K5bKJ0k6NXbbmgrqAqEOEcPg+cnPy1FtQGAYOo3VzgKqrpLOCs/7wh4YR23XHHsjQlHAcP8BmhrqnpHXR9FMZObrKjnQj8=,iv:KJZfw0n2DOtdZHeVDk6TrpO8q57yD+xdEVt9+hM0D4Q=,tag:rHQaMjvQwaB8Am/AlTKq1g==,type:str]
    version: 3.13.2
 ---
-apiVersion: ENC[AES256_GCM,data:Mdg=,iv:u/JjNJfdyz7ehk8lHZRh1u9zkNuufHosyXv10Gm+T6E=,tag:pkgZVJid6kpGuy61+oEMlQ==,type:str]
-kind: ENC[AES256_GCM,data:/kWhhqyz,iv:DymezGpBHmKT3BM/CcUKEGIWZw/JXNutReSKfhfmoD4=,tag:DnA+316Z+0eqBWN8YLyv1A==,type:str]
+apiVersion: v1
+kind: Secret
 metadata:
-    name: ENC[AES256_GCM,data:rYX7nN6SYoG5HycaNNrprDM=,iv:4uX7+Sl1UzgsImBH+qm9p8DlOfJu0i0W3bpoE7cFxXg=,tag:RROCnYBVKVwPBNSGgV30FQ==,type:str]
-    namespace: ENC[AES256_GCM,data:jpUzI7BmZA==,iv:PQrfm67la6RJCRq0H7qpiY8n2hPUjcaK6gmJ/zPQW30=,tag:bp/3GYbRpYOIub5nT0zz/A==,type:str]
-type: ENC[AES256_GCM,data:fndXB4Y1,iv:EXOe0day1ScxvZ7ozn1QyHgaZgnvlPNmvSQG74aw7lM=,tag:quPmKvFTjRqtZoVUEoQAHQ==,type:str]
+    name: minio-user-ollama
+    namespace: storage
+type: Opaque
 stringData:
-    CONSOLE_ACCESS_KEY: ENC[AES256_GCM,data:FhXl6yqTIzHsbJO6P96KQrA=,iv:gGTaSKxk721GwMQWWyymqUPZlGLidrBzWCWdRtnlOr0=,tag:IaVl8GQqPstBuUjD4N6JTQ==,type:str]
-    CONSOLE_SECRET_KEY: ENC[AES256_GCM,data:s22GOXY4B/m+S7tgDw8P2gU2F15vdn1tqAp53FWzFTI=,iv:GXBhHQ8YiaVjRRMw2yG4FxdulVOuOurkLXXC0u/SFRA=,tag:pvHcD9+4qaxnvhOSkNxoHA==,type:str]
+    CONSOLE_ACCESS_KEY: ENC[AES256_GCM,data:Zxr/Nj0SUKSJbBD1cFjt3GE=,iv:r/B9ULn68hsXdH8uRQkKAoQTJIJIYKMoJuWOZfxS2I8=,tag:Xo4i+IVxuqrp+qDpYQysPw==,type:str]
+    CONSOLE_SECRET_KEY: ENC[AES256_GCM,data:PoIDNZ+Xs6BdhGm10y1HdL5jy47EVHfHHIJhGy/KX6Q=,iv:voAv32GoTKi9s9/4MQy2yT6i9VY4/igA5XXzehwUqRQ=,tag:DmPyk5biVvlxHjeyDyrLbQ==,type:str]
 sops:
    age:
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtUVJFQ1ErNmkzd1N6b29t
-            L0VWR2tlcEIxeG1CR1hXRkw2cEt0Q2crMWlVClg2UlNhUzdJZGpLZjJtYlAvbk16
-            eHk0ZHZiNzVRTWhyQzlieTU5Y3QraGsKLS0tIHA5UVhvUXhNSDk0QlV0R2RzR1dP
-            azVEQzgvSFNwak9TcW1USFNOb3RvSkUKNLuW3h3cHDSSCZGe9Vyiv5m+wXihtCYX
-            oJtbRK+kJF8oOUo4emI+SLGrCsWq5cG2wN/wgP+ChR1zUgRgfq5oOA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2SStVR0lpOWs0VnN6dkdp
+            RktMUmNRR2diTUtiVk9tRk1wSjVTMnRtVlJBCkk1S0dwNUNHb25RQlZ4ZFRocisv
+            aS9kbmQydWVmN1AxU3VvbFZsS2tmTHcKLS0tICtRY0ZKeFhCTUdaNW5PSFRNZ2dG
+            OERIZ0xMbHBvSVNyaGxCVFpqRzlxa1EKbrjfk/CFlTSyJYgTzQ67W3JyR1fwv8VF
+            dxGeAgLY4EQrf+2PbODtazRFreS+sl7dxq+rKMOVZTsjGHakkqHy9A==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-08-12T18:02:01Z"
-    mac: ENC[AES256_GCM,data:hQfimKuhfiIiZQAyNDZQR25HZ5biU+kaWig3ElVPiqMY3B0LrmKyOEs7ittd3j3meUkPEFSmm1yYSXcdCuf6w7cwSbEiL5DG8t7QKPbnx/aRdyHAJW+1VC0e3Lye43gaHya0iUaWS/YFQcrT01oEbckLIDWPKfvA6pg2bZ4kMZ4=,iv:AydyWMVcjTQu+7Fzw5vtqkvTTeQEMt8y6snESoLUDE8=,tag:SoKklNqa9nH9G6d9+PnolQ==,type:str]
-    unencrypted_suffix: _unencrypted
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-10-26T04:03:16Z"
+    mac: ENC[AES256_GCM,data:gxu4WcJEuFgjtWCfAjose8R8a566/OLrXoiJmKfcvVfTFDTdGM7I4gzQVvpjEfra5Hjyt7kvLlaV2K5bKJ0k6NXbbmgrqAqEOEcPg+cnPy1FtQGAYOo3VzgKqrpLOCs/7wh4YR23XHHsjQlHAcP8BmhrqnpHXR9FMZObrKjnQj8=,iv:KJZfw0n2DOtdZHeVDk6TrpO8q57yD+xdEVt9+hM0D4Q=,tag:rHQaMjvQwaB8Am/AlTKq1g==,type:str]
    version: 3.13.2
@@ -6,7 +6,7 @@ metadata:
 type: Opaque
 stringData:
    PAPERLESS_API_TOKEN: ENC[AES256_GCM,data:wlBC85ep6zioWLhfhNczkKfTMR8tmciN+4r3of8GpQoJmKyE2r7pOg==,iv:Rem/UJl5wUNi8G+uEV7f2eCLabaY26sZ7+AsKYiOZ4I=,tag:bGS1fu13Mwsrr+5NUEzzLw==,type:str]
-    LLM_AUTH_CLIENT_SECRET: ENC[AES256_GCM,data:co7FfmRXKgrz9fNgR10KtlHL/iG4F5WKJgjcKem1H5hF5FviVi4+CQNekA==,iv:ADtBHiI6BtrkuH1iIfKV3I5odNLMQe5y/9GGTJrPNN0=,tag:j6wX6zO5VhKoLzdr7BQZCw==,type:str]
+    LLM_AUTH_CLIENT_SECRET: ENC[AES256_GCM,data:OEZqGgJ4cpMsWr/PJH50lsQKvk6sjVNPCFcZP3yQ/7nvlKP3giPlLmW9XgWr1ELq2hwWDs61+f3fAyENt4ln+Q==,iv:W0Tii/nvgm9ZMIEtfzgO5pj4Li+6fpxfd3zFtQhj874=,tag:tsM/fGeduMOEfMZsDZ6lrQ==,type:str]
 sops:
    age:
        - enc: |
@@ -19,6 +19,6 @@ sops:
            -----END AGE ENCRYPTED FILE-----
          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
    encrypted_regex: ^(data|stringData)$
-    lastmodified: "2026-09-14T14:19:39Z"
-    mac: ENC[AES256_GCM,data:jDdmiFg6uB1za7sAjO1CnGHdRPyUnmWCMJxqHrE3BO82pNbtm8yLOf+W6CfFKAjfZYqEE2mdKhABm7zeJgJlub3eXJbAirAFrp5jrbfHw0qsFo85Gj/BsrSDB401Aky6PxvRomz66FyX5zDDXIGAMEMlyNEadMplTfrZQQ9hQWM=,iv:UTSF72ofUyWs1LXGKQwBP60hK64UxhqTFM8QTVozGoo=,tag:OKivMDAqwWgrX+kNjvQrPg==,type:str]
+    lastmodified: "2026-10-26T04:03:16Z"
+    mac: ENC[AES256_GCM,data:gOrqy2fPX+77303L+E1EypaTU8mdUXYjbRZnTIJtoRpZhEmHsVvS/Ho8bVcl5KiTPN7UoFNmGyDz8fpyQ/rLTbeCiUYmyxvH7ym9DT4oWvRxITpOqBxz83pWv1BB++HJvqNQ5FllqpnAz60/bAVyxOdOXk4J3lDnuJibNOpxhW8=,iv:suV68u1Uiejl0NNJ3WlAHshgdrSL+aTwUxUBeMXlfWs=,tag:5wug4NeDZ+qclvFGPiEviQ==,type:str]
    version: 3.13.2
@@ -18,9 +18,6 @@ files:
    - forgejo-secrets.enc.yaml
    - grafana-oidc-secrets.enc.yaml
    - grafana-secrets.enc.yaml
-    - homarr-auth-oidc.enc.yaml
-    - homarr-db-encryption.enc.yaml
-    - homarr-secrets.enc.yaml
    - homelab-ca-secrets.enc.yaml
    - loki-secrets.enc.yaml
    - minio-secrets.enc.yaml
@@ -49,30 +49,6 @@ spec:
                port:
                  number: 3100

---
-# ── Authentik ─────────────────────────────────────────────────────────────────
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: authentik
-  namespace: iam
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: authentik.riotpiao.com
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: authentik-server
-                port:
-                  number: 80
-
 ---
 # ── Vault ─────────────────────────────────────────────────────────────────────
 apiVersion: networking.k8s.io/v1
@@ -299,28 +275,31 @@ spec:
                name: temporal-web
                port:
                  number: 8080
+
 ---
-# NOTE: api.riotpiao.com is deliberately NOT here. Its namespace `api` is
-# created in wave 7, and this Application syncs in wave 1 — an Ingress into a
-# namespace that doesn't exist yet would fail and mark this whole app
-# SyncFailed. It lives in k8s/apps/api/ingress.yaml, synced by the api-gw
-# Application.
+# ── Authentik (identity provider) ─────────────────────────────────────────────
+# The chart's ingress is disabled in k8s/infra/iam/authentik-values.yaml; the
+# rule lives here so ingress-config owns every hostname. TLS terminates at
+# nginx via the wildcard default-ssl-certificate, so the backend stays HTTP.
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: homarr
-  namespace: dashboard
+  name: authentik
+  namespace: iam
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: "16m"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
 spec:
  ingressClassName: nginx
  rules:
-    - host: homarr.riotpiao.com
+    - host: authentik.riotpiao.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
-                name: homarr
+                name: authentik-server
                port:
-                  number: 7575
-
+                  number: 80
@@ -138,12 +138,15 @@ configs:
    #   cicd  — automation-only; apiKey (token) for the CD pipeline, no UI login.
    accounts.rock: apiKey,login
    accounts.cicd: apiKey
-    # Authentik OIDC. clientSecret pulled from the argocd `oidc-secret` Secret
-    # (created by authentik-provision). The groups claim drives RBAC below.
+    # Zitadel OIDC. clientSecret pulled from the argocd `oidc-secret` Secret.
+    # The groups claim drives RBAC below.
    oidc.config: |
-      name: Authentik
-      issuer: https://authentik.riotpiao.com/application/o/argocd/
-      clientID: argocd
+      name: Zitadel
+      issuer: https://zitadel.riotpiao.com
+      # MUST be quoted: an unquoted 18-digit number is parsed as a float by the
+      # YAML parser and ArgoCD rejects it ("cannot unmarshal number into ...
+      # clientID of type string"). Same class of bug as Grafana's client_id.
+      clientID: "396757801210282367"
      clientSecret: $oidc-secret:client-secret
      requestedScopes:
        - openid
@@ -158,7 +161,7 @@ configs:
    server.insecure: false

  # RBAC. local `admin` + `rock` + the `cicd` pipeline account all get role:admin;
-  # the Authentik `homelab-admins` group (rock is a member) maps to admin so SSO
+  # the Zitadel `homelab-admins` role (rock is a member) maps to admin so SSO
  # logins are admin too.
  rbac:
    policy.default: role:readonly
@@ -81,6 +81,15 @@ server:
    - envName: VAULT_UNSEAL_KEY_3
      secretName: vault-unseal-keys
      secretKey: key3
+    # Zitadel OIDC client credentials for the Vault UI login method. Consumed by
+    # the postStart hook below, which enables auth/oidc via the Vault API after
+    # unsealing. Vault auth methods cannot be declared in HCL, only via API/CLI.
+    - envName: OIDC_CLIENT_ID
+      secretName: vault-oidc-creds
+      secretKey: OIDC_CLIENT_ID
+    - envName: OIDC_CLIENT_SECRET
+      secretName: vault-oidc-creds
+      secretKey: OIDC_CLIENT_SECRET

  # ── Auto-unseal ─────────────────────────────────────────────────────────────
  # Vault starts sealed after every pod restart and can't serve requests until
@@ -97,6 +106,28 @@ server:
      vault operator unseal "$VAULT_UNSEAL_KEY_2" || true
      vault operator unseal "$VAULT_UNSEAL_KEY_3" || true

+      # ── Zitadel OIDC login method ────────────────────────────────────────
+      # Vault auth methods are API-driven: they cannot be declared in HCL.
+      # Enable auth/oidc and write its config on every pod start. Both calls
+      # are idempotent (auth enable returns 400 "already enabled", which we
+      # tolerate; the config write always succeeds and overwrites).
+      vault auth enable oidc 2>/dev/null || true
+      vault write auth/oidc/config \
+        oidc_discovery_url="https://zitadel.riotpiao.com" \
+        oidc_client_id="$OIDC_CLIENT_ID" \
+        oidc_client_secret="$OIDC_CLIENT_SECRET" \
+        default_role="default" 2>/dev/null || true
+      # The role binds the Zitadel client_id as audience and whitelists the UI
+      # callback URL. Policy `default` gives a logged-in operator standard
+      # read access; admin actions still require a token with root/sudo.
+      vault write auth/oidc/role/default \
+        bound_audiences="$OIDC_CLIENT_ID" \
+        allowed_redirect_uris="https://vault.riotpiao.com/ui/vault/auth/oidc/oidc/callback" \
+        allowed_redirect_uris="http://localhost:8200/ui/vault/auth/oidc/oidc/callback" \
+        user_claim="preferred_username" \
+        oidc_scopes="openid,profile,email,groups" \
+        policies="default" 2>/dev/null || true
+
  # ── Vault config (HCL) ──────────────────────────────────────────────────────
  standalone:
    enabled: true
@@ -60,28 +60,28 @@ grafana.ini:
  database:
    wal: true

-  # ── Authentik OIDC (generic OAuth2) ───────────────────────────────────────
+  # ── ZITADEL OIDC (generic OAuth2) ────────────────────────────────────────
  # Grafana v10+ supports OIDC auto-discovery; we wire it manually here because
-  # Authentik's discovery endpoint is internal-only (no external DNS for iam.svc).
+  # ZITADEL's discovery endpoint is internal-only (no external DNS for iam.svc).
  # All URLs use the external hostname so CoreDNS rewrites them to
-  # authentik-server.iam.svc — this keeps the Host header correct so Authentik
+  # zitadel.iam.svc — this keeps the Host header correct so ZITADEL
  # doesn't return localhost redirects in its token responses.
  #
  # role_attribute_path: JMESPath expression evaluated against the userinfo
  # response. akadmin gets GrafanaAdmin (server admin, can impersonate);
-  # homelab-admins members get Admin (org admin); everyone else Viewer.
+  # homelab-admins role members get Admin (org admin); everyone else Viewer.
  auth.generic_oauth:
    enabled: true
-    name: Authentik
+    name: Zitadel
    allow_sign_up: true  # Allow sync to create/update users from OAuth claims
-    client_id: grafana
+    client_id: "396757801965191169"
    scopes: openid email profile groups
-    auth_url: https://authentik.riotpiao.com/application/o/authorize/
-    token_url: https://authentik.riotpiao.com/application/o/token/
-    api_url: https://authentik.riotpiao.com/application/o/userinfo/
+    auth_url: https://zitadel.riotpiao.com/oauth/v2/authorize
+    token_url: https://zitadel.riotpiao.com/oauth/v2/token
+    api_url: https://zitadel.riotpiao.com/oidc/v1/userinfo
    # Read identity straight from the userinfo/id_token claims. Without these,
    # Grafana falls back to the GitHub-style "<api_url>/emails" call, which
-    # Authentik doesn't serve — request 404s with "Error getting email address"
+    # ZITADEL doesn't serve — request 404s with "Error getting email address"
    # and the whole OAuth login fails.
    email_attribute_path: email
    login_attribute_path: preferred_username  # Use preferred_username — OpenID standard claim, always present
@@ -91,10 +91,10 @@ grafana.ini:
    use_pkce: false
    use_refresh_token: false
    skip_org_role_sync: false  # Sync org roles from OAuth groups
-    tls_skip_verify_insecure: true   # Authentik uses self-signed cert; verify in prod
+    tls_skip_verify_insecure: true   # In-cluster cert; verify in prod

 # GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET is injected from the grafana-oidc K8s
-# Secret (created by k8s/talos-iam/setup_talos_iam.sh). envFromSecret mounts
+# Secret (k8s/argocd/secrets/grafana-oidc-secrets.enc.yaml). envFromSecret mounts
 # every key in that secret as an environment variable — keeps secrets out of
 # values files and out of git.
 envFromSecret: grafana-oidc
@@ -103,17 +103,17 @@ spec:
        - https://minio-api.riotpiao.com
      console: https://minio.riotpiao.com

-  # ── OIDC via Authentik (server-side env, valid in v2 schema) ────────────────
-  # Use in-cluster URL for config fetch (pod→authentik); browser redirects use
-  # public URLs embedded in the OIDC metadata response (issuer stays public).
+  # ── OIDC via ZITADEL (server-side env, valid in v2 schema) ──────────────────
+  # Use external URL for config fetch (hairpins through ingress-nginx); browser
+  # redirects use public URLs embedded in the OIDC metadata response.
  env:
    - name: MINIO_IDENTITY_OPENID_CONFIG_URL
      # Must use external URL — well-known response contains external issuer/jwks_uri.
      # MinIO validates issuer in JWT matches well-known issuer. Internal URL = mismatch.
      # Hairpins through ingress-nginx but stays in-cluster.
-      value: "https://authentik.riotpiao.com/application/o/minio/.well-known/openid-configuration"
+      value: "https://zitadel.riotpiao.com/.well-known/openid-configuration"
    - name: MINIO_IDENTITY_OPENID_CLIENT_ID
-      value: "minio"
+      value: "396757803257036801"
    - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET
      valueFrom:
        secretKeyRef:
@@ -126,7 +126,7 @@ spec:
    - name: MINIO_IDENTITY_OPENID_REDIRECT_URI
      value: "https://minio.riotpiao.com/oauth_callback"
    - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME
-      value: "Authentik"
+      value: "Zitadel"
    - name: MINIO_IDENTITY_OPENID_SCOPES
      value: "openid,profile,email,groups"
    - name: MINIO_BROWSER_LOGIN_ANIMATION
@@ -43,8 +43,8 @@ serviceMonitor:
      url: https://grafana.riotpiao.com/
    - name: loki
      url: https://loki.riotpiao.com/ready
-    - name: authentik
-      url: https://authentik.riotpiao.com/-/health/ready/
+    - name: zitadel
+      url: https://zitadel.riotpiao.com/debug/ready
    - name: vault
      url: https://vault.riotpiao.com/v1/sys/health
    - name: minio-console
@@ -1,32 +0,0 @@
-# Scoped operator access for homarr-admins: the homarr Deployment + app
-# secrets only. homarr-oidc, auth-oidc-secret, db-encryption stay excluded
-# (security-managed, not app config). Inert until kube-apiserver's OIDC
-# wiring lands.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: homarr-operator
-  namespace: dashboard
-rules:
-  - apiGroups: ["apps"]
-    resources: ["deployments"]
-    resourceNames: ["homarr"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-  - apiGroups: [""]
-    resources: ["secrets"]
-    resourceNames: ["homarr-secrets"]
-    verbs: ["get", "list", "watch", "update", "patch"]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: homarr-admins-binding
-  namespace: dashboard
-subjects:
-  - kind: Group
-    name: "oidc:homarr-admins"
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: Role
-  name: homarr-operator
-  apiGroup: rbac.authorization.k8s.io
@@ -10,7 +10,6 @@ resources:
  - grafana-operator-role.yaml
  - minio-operator-role.yaml
  - forgejo-operator-role.yaml
-  - homarr-operator-role.yaml
  - portainer-operator-role.yaml
  - kmsvc-operator-role.yaml
  - temporal-operator-role.yaml
@@ -351,11 +351,6 @@ OAuth2_PROVIDERS = {
        "client_secret": "QxyWfESXqTD55aUyh6miYnny1QTCEuEwyC4escw9",
        "redirect_uris": ["app.immich:///oauth-callback", "https://img.riotpiao.com/auth/login", "https://img.riotpiao.com/user/oauth2/callback"],
    },
-    "homarr": {
-        "client_id": "homarr",
-        "client_secret": "RMlDQAWdjT5YPPH0U7ztDoUFP7R7w95b2xqQ1pyS",
-        "redirect_uris": ["http://localhost:7575/auth/callback", "https://homarr.riotpiao.com/auth/callback"],
-    },
    "argocd": {
        "client_id": "argocd",
        "client_secret_env": "AUTHENTIK_PROVIDER_ARGOCD_SECRET",
@@ -53,7 +53,7 @@ generate_secret() {

 declare -A NEW_SECRETS

-for svc in api-gw minio poimen paperless grafana argocd forgejo homarr immich vault portfolio-agent memory-agent local-llm; do
+for svc in api-gw minio poimen paperless grafana argocd forgejo immich vault portfolio-agent memory-agent local-llm; do
  NEW_SECRETS[$svc]=$(generate_secret)
  log "  $svc: ${NEW_SECRETS[$svc]:0:15}..."
 done
@@ -70,7 +70,6 @@ declare -A PROVIDER_PKS=(
  [grafana]=6
  [argocd]=7
  [forgejo]=8
-  [homarr]=9
  [immich]=10
  [vault]=11
 )
@@ -203,7 +202,7 @@ fi
 log ""
 log "=== Summary ==="
 log "Rotated 13 credentials:"
-log "  OAuth2 Providers: api-gw, minio, poimen, paperless, grafana, argocd, forgejo, homarr, immich, vault"
+log "  OAuth2 Providers: api-gw, minio, poimen, paperless, grafana, argocd, forgejo, immich, vault"
 log "  Service Accounts: portfolio-agent, memory-agent, local-llm"

 log ""
@@ -98,9 +98,6 @@ OIDC_APPS = {
    "grafana": {**_WEB, "redirect_uris": [
        "http://localhost:3000/login/generic_oauth",
        "https://grafana.riotpiao.com/login/generic_oauth"]},
-    "homarr": {**_WEB, "redirect_uris": [
-        "http://localhost:7575/auth/callback",
-        "https://homarr.riotpiao.com/auth/callback"]},
    "immich": {**_WEB, "app_type_id": "OIDC_APP_TYPE_NATIVE", "redirect_uris": [
        "app.immich:///oauth-callback", "https://img.riotpiao.com/auth/login",
        "https://img.riotpiao.com/user/oauth2/callback"]},
@@ -364,8 +361,8 @@ SECRET_MAP = {
                 "GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET", "secret")],
    "minio": [("minio-secrets.enc.yaml", "minio-oidc",
               "MINIO_IDENTITY_OPENID_CLIENT_SECRET", "secret")],
-    "paperless-ai-agent": [("paperless-ai-secrets.enc.yaml", "paperless-ai-config",
-                            "LLM_AUTH_CLIENT_SECRET", "secret")],
+    "paperless": [("paperless-ai-secrets.enc.yaml", "paperless-ai-config",
+                   "LLM_AUTH_CLIENT_SECRET", "secret")],
 }

 # Clients whose client_id lives in a plain (unencrypted) manifest. They need the
@@ -375,18 +372,14 @@ CLIENT_ID_MAP = {
    "grafana": ("k8s/infra/logging/grafana-values.yaml",
                r"(?m)^(\s*client_id:\s*)\S+\s*$", r"\g<1>{value}"),
    "minio": ("k8s/infra/minio/minio-tenant.yaml",
-              r"(?m)^(\s*value:\s*)\"minio\"\s*$", r'\g<1>"{value}"'),
-    "paperless-ai-agent": ("k8s/apps/paperless/paperless-ai.yaml",
-                           r"client_id=paperless-ai-agent", "client_id={value}"),
+              r'(?m)^(\s*value:\s*)"(?:minio|\d+)"\s*$', r'\g<1>"{value}"'),
+    "paperless": ("k8s/apps/paperless/paperless-ai.yaml",
+                  r"client_id=(?:paperless-ai-agent|\d+)", "client_id={value}"),
 }

 # Secrets that a live workload mounts but no SOPS file in git defines. The phase
 # cannot re-point them safely, so it names them.
-MANUAL_ONLY = {
-    "homarr": "Secret homarr-oidc (keys client-id, client-secret) has no SOPS file in git — "
-              "adopt it first, then add it to SECRET_MAP. The repo also carries an orphan "
-              "homarr-auth-oidc.enc.yaml that nothing consumes.",
-}
+MANUAL_ONLY: dict[str, str] = {}


 def state_outputs() -> dict:
Author	SHA1	Message	Date
rock	7f96da880f	fix(ingress): restore the authentik.riotpiao.com route Commit `a02bee5` had both the Ingress rule and the cloudflared tunnel hostname for authentik.riotpiao.com. Both were lost, so the tunnel answered 404 for the hostname and the ingress had no matching rule. The CoreDNS rewrite and the authentik-server Service were still intact; only the two routing entries were missing. Re-add the Ingress (namespace iam, service authentik-server port 80, TLS terminated by the wildcard default-ssl-certificate) and the tunnel hostname.	2026-10-26 03:12:26 -07:00
rock	f37e5f32cb	fix(paperless): use Recreate strategy for paperless-ai RWO PVC deadlock	2026-10-26 00:35:59 -07:00
rock	8c4a900b40	feat(vault): wire Zitadel OIDC login via postStart auth/oidc config	2026-10-26 00:28:19 -07:00
rock	e6ba83cd38	feat(iam): wire all 9 consumer manifests to Zitadel OIDC	2026-10-26 00:14:51 -07:00
rock	a02bee50e2	feat(iam): wire all 9 consumer manifests to Zitadel OIDC Co-authored-by: rock <[email protected]>	2026-10-26 04:34:51 +00:00
rock	f9af686c36	Merge pull request 'integration: merge minio-client fix, local-path backend, and local cloudflared ingress' (#70 ) from integration/merge-56-58-69 into main integration: merge minio-client fix, local-path backend, and local cloudflared ingress (#70)	2026-10-26 03:24:32 +00:00