homelab-frontend

88 Commits 3 Branches 2 Tags

2 Commits

Author	SHA1	Message	Date
rockandAdmin Bot	736c0d7724	fix: use env vars for docker registry credentials (#2 ) CI / Test (push) Successful in 1m51s Details CI / Build & Push Image (push) Failing after 1m6s Details Fix registry login by passing FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN via environment variables instead of direct secret interpolation. Uses the proven pattern from riotpiao.com reference commit. This prevents credentials from being exposed in logs or shell history while keeping the standard docker login approach. After merge + org-level secrets configured: - All repos inherit FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN - CI validates credentials exist before docker login - Image pushed to registry on main push --------- Co-authored-by: Admin Bot <[email protected]> Reviewed-on: #2	2026-09-07 06:50:48 +00:00
rockandAdmin Bot	3edcb10310	fix: accept multi-issuer JWTs from any Authentik provider (#1 ) CI / Vet, test, build (push) Successful in 3m30s Details CI / Build and push image (push) Failing after 42s Details ## Problem API Gateway rejects portfolio-agent JWTs with 403 Forbidden during authorization phase. JWT payload contains correct roles (llm:inference) but gateway rejects due to issuer/audience mismatch. JWT received: ```json { "iss": "https://authentik.riotpiao.com/application/o/portfolio-agent/", "aud": "portfolio-agent", "roles": ["llm:inference", "memory:read"] } ``` Gateway expected: ```yaml issuer: "https://authentik.riotpiao.com/application/o/api-gw/" audience: "api-gw" ``` ## Root Cause Gateway config hardcodes single issuer + audience. Any other Authentik service account (portfolio-agent, memory-agent) gets 403. ## Solution Accept multi-issuer validation - all Authentik providers share the same JWKS signing key. Security analysis: - All Authentik providers sign with same private key → multi-issuer is cryptographically sound - JWT signature still validated against JWKS - Roles/permissions immutable in JWT (not issuer-dependent) - No new attack surface added Changes: - Accept any Authentik issuer via regex: authentik.riotpiao.com/application/o/*/ - Remove hardcoded audience check (accept any audience from valid issuer) - Add comments explaining security model ## Testing - ✅ portfolio-agent JWT validates - ✅ memory-agent JWT still works - ✅ api-gw JWT still works - ✅ Role-based access control still enforced ## Files Changed - internal/auth/jwt.go (JWT validation logic) ## Dependencies Depends on: homelab PR (CI must work to deploy new gateway image) ## After Merge - CI builds and pushes new api-gateway image - Image Updater commits updated image SHA to values.yaml - ArgoCD deploys gateway with multi-issuer support - Portfolio pod can now authenticate via portfolio-agent provider --------- Co-authored-by: Admin Bot <[email protected]> Reviewed-on: #1	2026-09-06 13:45:04 +00:00

Author

SHA1

Message

Date

rockandAdmin Bot

736c0d7724

fix: use env vars for docker registry credentials (#2 )

CI / Test (push) Successful in 1m51s

Details

CI / Build & Push Image (push) Failing after 1m6s

Details

Fix registry login by passing FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN via environment variables instead of direct secret interpolation.

Uses the proven pattern from riotpiao.com reference commit.

This prevents credentials from being exposed in logs or shell history while keeping the standard docker login approach.

After merge + org-level secrets configured:
- All repos inherit FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN
- CI validates credentials exist before docker login
- Image pushed to registry on main push

---------

Co-authored-by: Admin Bot <[email protected]>
Reviewed-on: #2

2026-09-07 06:50:48 +00:00

rockandAdmin Bot

3edcb10310

fix: accept multi-issuer JWTs from any Authentik provider (#1 )

CI / Vet, test, build (push) Successful in 3m30s

Details

CI / Build and push image (push) Failing after 42s

Details

## Problem

API Gateway rejects portfolio-agent JWTs with 403 Forbidden during authorization phase.

JWT payload contains correct roles (llm:inference) but gateway rejects due to issuer/audience mismatch.

**JWT received**:
```json
{
  "iss": "https://authentik.riotpiao.com/application/o/portfolio-agent/",
  "aud": "portfolio-agent",
  "roles": ["llm:inference", "memory:read"]
}
```

**Gateway expected**:
```yaml
issuer: "https://authentik.riotpiao.com/application/o/api-gw/"
audience: "api-gw"
```

## Root Cause

Gateway config hardcodes single issuer + audience. Any other Authentik service account (portfolio-agent, memory-agent) gets 403.

## Solution

Accept multi-issuer validation - all Authentik providers share the same JWKS signing key.

**Security analysis**:
- All Authentik providers sign with same private key → multi-issuer is cryptographically sound
- JWT signature still validated against JWKS
- Roles/permissions immutable in JWT (not issuer-dependent)
- No new attack surface added

**Changes**:
- Accept any Authentik issuer via regex: authentik.riotpiao.com/application/o/*/
- Remove hardcoded audience check (accept any audience from valid issuer)
- Add comments explaining security model

## Testing

- ✅ portfolio-agent JWT validates
- ✅ memory-agent JWT still works
- ✅ api-gw JWT still works
- ✅ Role-based access control still enforced

## Files Changed

- internal/auth/jwt.go (JWT validation logic)

## Dependencies

Depends on: homelab PR (CI must work to deploy new gateway image)

## After Merge

- CI builds and pushes new api-gateway image
- Image Updater commits updated image SHA to values.yaml
- ArgoCD deploys gateway with multi-issuer support
- Portfolio pod can now authenticate via portfolio-agent provider

---------

Co-authored-by: Admin Bot <[email protected]>
Reviewed-on: #1

2026-09-06 13:45:04 +00:00