fix(homarr): add AUTH_OIDC_URI + email account linking — homarr hides the Authentik sign-in button unless AUTH_OIDC_URI (authorize endpoint) is set alongside AUTH_OIDC_ISSUER (per authentik/homarr SSO docs); was the missing var

k8s/apps/api/ingress.yaml

@@ -0,0 +1,43 @@
+# Edge route for the API gateway.
+#
+# Lives here rather than in the central k8s/bootstrap/ingress/ingress.yaml
+# because that Application syncs in wave 1, before namespace `api` exists.
+#
+# nginx terminates TLS with the wildcard *.riotpiao.com cert (served as its
+# default-ssl-certificate, so no per-rule `tls:` block is needed) and forwards
+# plain HTTP to kong-proxy. Kong then does the real routing, from Ingresses
+# carrying `ingressClassName: kong`.
+#
+# Catch-all `/` on purpose: everything under this host belongs to Kong. Listing
+# per-API paths here would duplicate Kong's routing table inside nginx, and the
+# two copies would drift.
+#
+# In-cluster callers should prefer http://kong-proxy.api.svc.cluster.local
+# directly. Resolving api.riotpiao.com sends them out to nginx and back in,
+# which is a pointless hairpin unless they need TLS or the public hostname.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: api
+  namespace: api
+  annotations:
+    # An API gateway carries streaming responses (SSE, gRPC-web, LLM token
+    # streams). nginx's 60s default read timeout and its response buffering
+    # would truncate or stall those.
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-buffering: "off"
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: api.riotpiao.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: kong-proxy
+                port:
+                  number: 80