chore: initial commit of Go API gateway

Baseline for the Kong replacement on api.riotpiao.com. Brings the working tree under version control for the first time: gateway source, the task board that drives the agent runs, test fixtures, and K8s manifests. Anchor the gateway ignore rule to the repo root. Unanchored, "gateway" also matched the cmd/gateway/ source directory, so the program entrypoint was excluded from every commit. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
2026-08-19 20:54:34 -07:00
commit 058f11cf2b
109 changed files with 8992 additions and 0 deletions
@@ -0,0 +1,37 @@
+# 3.6 — Migrate pi to Bearer and one provider (REFACTOR)
+
+Phase: 3 — Authentication
+Stage: REFACTOR
+Depends on: [2.2](2.2-body-based-dispatch.md), [3.3](3.3-authentik-service-account.md), [3.4](3.4-flag-gated-rollout.md)
+
+- [ ] `~/.pi/agent/models.json` no longer contains a `customHeaders: {apikey: ...}` block anywhere
+- [ ] pi authenticates with `Authorization: Bearer` carrying an Authentik-issued token
+- [ ] The three provider entries `homelab-reasoning`, `homelab-ornith` and `homelab-qwen` collapse into ONE provider entry
+- [ ] That single provider's base URL is the canonical OpenAI base, and the three models are listed under it — body-based dispatch makes per-model base URLs unnecessary
+- [ ] pi reaches all three models through `POST /v1/chat/completions` with `model` set to `reasoning`, `ornith:35b`, and `qwen2.5:3b-instruct`
+- [ ] Streaming still works from pi, and interrupting a generation cancels it upstream rather than leaving it running
+- [ ] The old config is captured before editing, so a revert is one file restore
+- [ ] Verified with auth ON, because that is the state the migration exists to survive
+
+The `apikey` header exists only because Kong OSS `key-auth` rejected
+`Authorization: Bearer`. Once this lands, nothing depends on the legacy aliases in
+[2.4](2.4-legacy-path-aliases.md) and they can be removed.
+
+## Verify
+
+```bash
+grep -c apikey ~/.pi/agent/models.json     # expected: 0
+grep -c '"homelab' ~/.pi/agent/models.json # expected: 1 provider entry, not 3
+
+for m in reasoning ornith:35b qwen2.5:3b-instruct; do
+  curl -s -o /dev/null -w "$m %{http_code}\n" https://api.riotpiao.com/v1/chat/completions \
+    -H "authorization: Bearer $ACCESS_TOKEN" -H 'content-type: application/json' \
+    -d "{\"model\":\"$m\",\"messages\":[{\"role\":\"user\",\"content\":\"hi\"}]}"
+done
+# expected: 200 for all three, with auth enabled
+
+curl -N -s https://api.riotpiao.com/v1/chat/completions -H "authorization: Bearer $ACCESS_TOKEN" \
+  -H 'content-type: application/json' \
+  -d '{"model":"reasoning","stream":true,"messages":[{"role":"user","content":"hi"}]}'
+# expected: text/event-stream chunks arriving incrementally; reasoning_content and content both present
+```