rock d8ef81e9af fix(paperless-ai): ask for no project audience, so aud names the caller ...

The gateway compares the token audience with its allow-list of client ids. The scope
carried urn:zitadel:iam:org:project🆔<project>:aud, so every token said
aud = [396757796898471937] and the gateway answered

  token validation failed: audience not allowed: [396757796898471937]

With plain openid the audience is the machine user, which is the entry that exists on
the list.

2026-10-28 01:34:23 -07:00

..

apps

fix(paperless-ai): ask for no project audience, so aud names the caller

2026-10-28 01:34:23 -07:00

argocd

chore(iam): retire the minio OIDC credential from sops

2026-10-27 20:00:15 -07:00

bootstrap

chore(iam): retire Authentik

2026-10-26 03:32:18 -07:00

infra

feat(grafana): provision a Gotify contact point

2026-10-27 12:38:29 -07:00