homelab

riotpiao-poimen/homelab

Fork 0

Labels Milestones New Issue

API-GW OAuth

OAuth2 Token Exchange (RFC 8693), identity header injection, user-facing auth endpoints for api-gateway.

Dependency chain: P3.2 → P3.7 → P3.1 → P3.3 → P3.4 → P3.5 → P3.6 → P3.8 → P3.9

Issues tracked in rock/homelab-frontend.

Backlog

P3.1: Add /auth/token endpoint (password grant proxy)

#6 opened 2026-09-08 04:40:45 +00:00 by rock

Phase 3: OAuth2 Token Exchange & Identity Propagation

0 / 4

area/auth area/gateway priority/high status/todo type/feature

P3.3: Add /auth/refresh endpoint (token renewal)

#8 opened 2026-09-08 04:41:45 +00:00 by rock

Phase 3: OAuth2 Token Exchange & Identity Propagation

0 / 4

area/auth area/gateway priority/high status/todo type/feature

P3.5: Implement RFC 8693 OAuth2 Token Exchange endpoint

#10 opened 2026-09-08 04:42:06 +00:00 by rock

Phase 3: OAuth2 Token Exchange & Identity Propagation

0 / 7

area/auth area/authentik area/gateway priority/high status/todo type/feature

P3.6: Enforce JWT auth on X-Service adapter dispatch

#11 opened 2026-09-08 04:42:44 +00:00 by rock

Phase 3: OAuth2 Token Exchange & Identity Propagation

0 / 5

area/auth area/gateway priority/medium status/todo type/feature

P3.9: End-to-end integration test — full auth flow

#14 opened 2026-09-08 04:43:06 +00:00 by rock

Phase 3: OAuth2 Token Exchange & Identity Propagation

0 / 5

area/auth priority/medium status/todo type/docs

Todo

P3.2: Enable password grant on local-llm Authentik provider

#7 by rock was closed 2026-09-08 22:50:28 +00:00

Phase 3: OAuth2 Token Exchange & Identity Propagation

0 / 4

area/authentik priority/high status/todo type/infra

P3.7: Wire auth config (tokenUrl, clientId, clientSecret) into gateway deployment

#12 opened 2026-09-08 04:42:55 +00:00 by rock

Phase 3: OAuth2 Token Exchange & Identity Propagation

0 / 4

area/gateway priority/high status/todo type/infra

P3.4: Inject X-Forwarded-User identity headers after JWT validation

#9 by rock was closed 2026-09-08 23:09:24 +00:00

Phase 3: OAuth2 Token Exchange & Identity Propagation

0 / 7

area/auth area/gateway priority/high status/todo type/feature

In Progress

In Review

P3.8: Audit NetworkPolicy — downstream must only accept gateway traffic

#13 by rock was closed 2026-09-08 22:50:37 +00:00

Phase 3: OAuth2 Token Exchange & Identity Propagation

P3.8: Restrict llm-serving ingress to api-gateway only #15

0 / 6

area/downstream priority/medium status/review status/todo type/infra

Done