7 Commits

Include renames

Author	SHA1	Message	Date
rock	16e3ff16f1	feat: authentik jwt + sops encryption for prod secrets & llm auth ... SECURITY: - Add authentik_jwt.rs: OAuth2 client credentials flow with caching - SOPS encrypt secrets with age key (SOPS_AGE_KEY_FILE) - JWT tokens for LLM gateway, S3, and API gateway access - Token auto-refresh when expired (60s before expiry) - No hardcoded credentials in code or config ENTITY EXTRACTION: - LlmEntityExtractor now uses Authentik JWT instead of mock - Fallback to env var if Authentik not configured - Reflection verification still enabled - WikiLink extraction as Stage 0 (always active) DEPLOYMENT: - ConfigMap: LLM_ENDPOINT, LLM_MODEL, timeouts - Secret: AUTHENTIK_ISSUER, CLIENT_ID, CLIENT_SECRET, S3 keys - envFrom mounts both ConfigMap and Secret - KSOPS plugin for ArgoCD auto-decryption DOCUMENTATION: - docs/AUTHENTIK_SOPS_SETUP.md: Complete integration guide - Service account creation in Authentik - SOPS encryption/decryption workflow - JWT token exchange flow - Troubleshooting guide FILES: - crates/mem-ingest/src/authentik_jwt.rs (new, 180 LOC) - crates/mem-ingest/src/entity_extractor.rs (updated, JWT auth) - crates/mem-ingest/Cargo.toml (add reqwest) - k8s/app/poimen-memory-secrets.yaml (new, unencrypted template) - k8s/app/deployment.yaml (add secrets envFrom) - k8s/app/config.yaml (add LLM config) - k8s/.sops.yaml (encryption rules) - docs/AUTHENTIK_SOPS_SETUP.md (new, 350 LOC) NEXT: 1. Create Authentik service account (manual) 2. Encrypt secrets with SOPS 3. Deploy to poimen namespace 4. Test JWT token exchange with LLM endpoint	2026-09-08 13:58:39 -07:00
rock	83e3206dcd	fix: update deployment image to new riotpiao-poimen org path	2026-09-08 09:04:59 -07:00
rock	5fc9101888	fix: extract auth config to ConfigMap + SOPS, update Authentik slug (#40) ... ## Problem JWT validation failing with `error decoding response body: expected value at line 6 column 1`. Root cause: `AUTHENTIK_ISSUER` pointed to slug `poimen-memory` which returns 404 on OIDC discovery. Slug was renamed to `poimen` in Authentik. Secondary issue: auth env vars were set via `kubectl set env` (not in git), so every ArgoCD sync reverted them. ## Changes - **k8s/app/config.yaml** — ConfigMap for non-sensitive env (auth mode, rate limits, OpenSearch/Obsidian URLs) - **k8s/app/auth.enc.yaml** — SOPS-encrypted Secret with `AUTHENTIK_ISSUER`, `AUTHENTIK_AUDIENCE`, `JWT_CACHE_TTL_SECS` - **k8s/app/secret-generator.yaml** — KSOPS generator for ArgoCD decryption - **k8s/app/deployment.yaml** — `envFrom` referencing ConfigMap + Secret - **k8s/app/kustomization.yaml** — Added config.yaml + KSOPS generator - **k8s/app/opensearch-deployment.yaml** — Updated JWKS/issuer URLs to `poimen` slug ## Rollout Reloader (`--auto-reload-all=true`) triggers rolling restart when ConfigMap/Secret change. Merge and ArgoCD sync handles everything.Reviewed-on: rock/poimen-memory#40 Co-authored-by: rock <[email protected]>	2026-09-08 05:34:17 +00:00
rock	92458e643c	fix: remove unused vault PVC from memory deployment ... Memory service stores in pgvector, not local files. PVC was RWO causing multi-node scheduling failures with 2 replicas. MEM_HOME points to /tmp (emptyDir) for any scratch needs.	2026-08-30 07:23:18 -07:00
rock	2501a68528	fix: add PodSecurity contexts to all poimen deployments ... - runAsNonRoot, runAsUser 1000, seccompProfile RuntimeDefault - Drop ALL capabilities, no privilege escalation - readOnlyRootFilesystem on memory (with /tmp emptyDir) - git-sync init runs as root with only CHOWN+DAC_OVERRIDE caps - All pods use their service accounts	2026-08-30 07:20:08 -07:00
rock	46d993824f	feat: add Obsidian vault projection with Longhorn storage (#13)	2026-08-24 01:58:39 +00:00
Story Crater Bot	eaed7fc42a	Add K8s app deployment, Dockerfile, and CI workflow (Option A)	2026-08-23 00:01:30 -07:00