Admin Bot
ea6974cdad
fix: Use internal Authentik for JWKS in gateway auth config
CI / Vet, test, build (push) Successful in 3m46s
CI / Build and push image (push) Successful in 1m20s
2026-09-03 16:33:36 -07:00
Admin Bot
14cc67833c
feat(auth): wire JWT validation into /v1/* LLM endpoints
CI / Vet, test, build (push) Successful in 3m52s
CI / Build and push image (push) Successful in 1m17s
2026-08-31 23:01:59 -07:00
Admin Bot
95045e80f6
fix: SQS gateway JWT validation, MinIO/Temporal native JWT support
...
CI / Vet, test, build (push) Successful in 2m9s
CI / Build and push image (push) Successful in 45s
Auth strategy clarified per service:
- SQS: Gateway validates JWT (kmsvc code unverified, needs Phase 3)
- MinIO: Native JWT/OIDC support (validates itself, Phase 3: load-test)
- Temporal: Native JWT via jwtKeyProvider (Phase 3: configure)
- Memory, IAM: Services validate JWTs (dumb pipe)
SQS now requires Authorization header at gateway.
Phase 3 will implement actual JWT signature validation against Authentik.
2026-08-27 11:33:04 -07:00
Admin Bot
139bc80529
refactor: dispatcher as dumb pipe + add gRPC detection for Temporal
...
CI / Vet, test, build (push) Canceled after 24s
CI / Build and push image (push) Canceled after 0s
BREAKING CHANGE: Gateway no longer validates JWTs at dispatcher level.
Each upstream service (MinIO, Authentik, Temporal) validates bearer
tokens independently. Gateway passes Authorization header through unchanged.
Changes:
- Removed JWT validation from Dispatcher
- Removed internal/auth JWT validator usage
- Added gRPC URL scheme detection (grpc://)
- Added temporal-frontend with gRPC config (returns 501 not-implemented)
- All adapters now auth: required: false (services validate own tokens)
- Gateway is now a transparent routing layer, not auth gateway
gRPC forwarding requires grpcproxy middleware (future Phase 9).
For now, gRPC clients should connect directly to temporal-frontend:7233.
2026-08-27 11:16:15 -07:00
Admin Bot
57d64039d5
config: set memory to public (no JWT required), only iam protected
...
CI / Vet, test, build (push) Successful in 2m6s
CI / Build and push image (push) Successful in 45s
- sqs, s3, memory: public APIs (auth not required)
- memory: uses static API key internally, no JWT validation needed
- iam: protected by JWT validation + iam:admin capability check
- revoked tokens detected via JWKS key rotation (15min cache TTL)
2026-08-27 11:11:37 -07:00
Admin Bot
46dc24a26c
fix: remove workflow adapter (temporal-frontend is gRPC-only, not HTTP)
...
CI / Vet, test, build (push) Successful in 2m3s
CI / Build and push image (push) Successful in 44s
Per homelab/project-usage/jwt-auth-rollout.md, temporal-frontend (port 7233)
is gRPC-specific for workers/SDKs. External HTTP access is unresolved design.
Disabled until gRPC ingress is added. Keeps only: sqs, memory, s3, iam.
2026-08-27 09:48:46 -07:00
Admin Bot
e7536a80ce
fix: correct SQS port from 8080 to 9090
CI / Vet, test, build (push) Successful in 2m11s
CI / Build and push image (push) Successful in 43s
2026-08-27 09:07:12 -07:00
Admin Bot
f4193fe6e1
fix: correct service names in adapter upstreams (management-service.sqs, minio.storage, authentik-server.iam)
CI / Vet, test, build (push) Successful in 2m9s
CI / Build and push image (push) Successful in 48s
2026-08-27 09:03:58 -07:00
Admin Bot
9c5fb0ce84
feat: load service adapters from ConfigMap, remove k8s API dependency
...
CI / Vet, test, build (push) Canceled after 2m10s
CI / Build and push image (push) Canceled after 0s
Adapters defined in config.yaml alongside routes and models.
Parsed by existing config loader, populated into registry at startup.
Removed: client-go deps, REST loader, informer, nginx proxy,
CiliumNetworkPolicy, apis/gateway/v1/ (duplicate types).
Kept: merged CI pipeline, imagePullPolicy Always, CA certs in Dockerfile.
2026-08-26 16:39:30 -07:00
Story Crater Bot and Claude Opus 5
058f11cf2b
chore: initial commit of Go API gateway
...
CI / Test (push) Canceled after 0s
CI / Vet (push) Canceled after 0s
CI / Build (push) Canceled after 0s
CI / Security (govulncheck) (push) Canceled after 0s
Baseline for the Kong replacement on api.riotpiao.com. Brings the working
tree under version control for the first time: gateway source, the task
board that drives the agent runs, test fixtures, and K8s manifests.
Anchor the gateway ignore rule to the repo root. Unanchored, "gateway"
also matched the cmd/gateway/ source directory, so the program entrypoint
was excluded from every commit.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]
2026-08-19 20:54:34 -07:00
Admin Bot