- Add AuthMode::None variant for disassembly/testing
- Returns synthetic JWT claims when auth disabled
- Set MEM_AUTH_MODE=none in config for dev/test
- Allows full API access without Authentik OIDC
- Add k8s/app/config.yaml (ConfigMap) for non-sensitive env vars
- Add k8s/app/auth.enc.yaml (SOPS-encrypted) for AUTHENTIK_ISSUER, AUDIENCE
- Add k8s/app/secret-generator.yaml (KSOPS generator for ArgoCD)
- Deployment uses envFrom instead of inline env vars
- Update Authentik slug from poimen-memory to poimen (404 on OIDC discovery)
- Update OpenSearch JWKS/issuer URLs to match new slug
- Reloader (auto-reload-all=true) triggers rollout on config change
Memory service stores in pgvector, not local files.
PVC was RWO causing multi-node scheduling failures with 2 replicas.
MEM_HOME points to /tmp (emptyDir) for any scratch needs.
- runAsNonRoot, runAsUser 1000, seccompProfile RuntimeDefault
- Drop ALL capabilities, no privilege escalation
- readOnlyRootFilesystem on memory (with /tmp emptyDir)
- git-sync init runs as root with only CHOWN+DAC_OVERRIDE caps
- All pods use their service accounts
sytone/obsidian-remote provides full Obsidian Desktop via noVNC.
Shares vault PVC with obsidian-server (REST API stays for memory system).
UI accessible at obsidian.riotpiao.com
Bearer auth-url was misconfigured (pointed to token endpoint, not
forward-auth). No Authentik outpost deployed yet. Remove for now,
vault.riotpiao.com accessible directly. TODO: add forward-auth
once outpost is set up.
rock
Story Crater Bot