Story Crater BotandClaude Opus 5
058f11cf2b
Baseline for the Kong replacement on api.riotpiao.com. Brings the working tree under version control for the first time: gateway source, the task board that drives the agent runs, test fixtures, and K8s manifests. Anchor the gateway ignore rule to the repo root. Unanchored, "gateway" also matched the cmd/gateway/ source directory, so the program entrypoint was excluded from every commit. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
31 lines
1.8 KiB
Markdown
31 lines
1.8 KiB
Markdown
# 3.3 — Authentik service account and token provider (GREEN)
|
|
|
|
Phase: 3 — Authentication
|
|
Stage: GREEN
|
|
Depends on: [3.2](3.2-bearer-validation.md)
|
|
|
|
- [ ] A service account exists in Authentik at `https://authentik.riotpiao.com` for machine callers of the model API
|
|
- [ ] An OAuth2 provider is configured so that account can obtain a token non-interactively, with no browser step
|
|
- [ ] The token endpoint returns a signed JWT whose issuer and audience match what the gateway validates, and which the gateway accepts on a protected route
|
|
- [ ] Token lifetime is set deliberately and recorded, not left at whatever the default is
|
|
- [ ] The client secret is stored as a Kubernetes Secret referenced from git, never committed in plaintext
|
|
- [ ] The Authentik configuration is captured in the repo as reproducible steps or declarative config, so it can be rebuilt rather than clicked together again
|
|
- [ ] The token carries whatever claim [3.5](3.5-capability-authorization.md) authorizes on
|
|
|
|
Open risk recorded in `AUTH-PLAN.md` and unresolved: Authentik 2026.x may require an
|
|
app-password or JWT-assertion flow rather than a plain `client_secret` POST to the
|
|
token endpoint. Verify which flow the running version accepts before wiring anything
|
|
that depends on it, and record the answer here.
|
|
|
|
## Verify
|
|
|
|
```bash
|
|
curl -s -i -X POST https://authentik.riotpiao.com/application/o/token/ \
|
|
-d grant_type=client_credentials -d "client_id=$CID" -d "client_secret=$CSEC"
|
|
# expected: 200, JSON with access_token; if 400/401, the app-password / JWT-assertion risk above is real — record which
|
|
|
|
curl -s -o /dev/null -w '%{http_code}\n' http://homelab-frontend.api.svc.cluster.local/v1/models \
|
|
-H "authorization: Bearer $ACCESS_TOKEN"
|
|
# expected: 200 — the gateway accepts a real Authentik-issued token, not only a stub one
|
|
```
|