# SSO + Storage HA — Complete

## What Was Fixed

### 1. SSO (Authentik OAuth2 for all services)
**Root cause:** Authentik 2026.5.5 requires explicit `grant_types` on OAuth2 providers. The provision script never set it → all providers had `grant_types=[]` → `/authorize` returned "Invalid grant_type for provider" → all SSO broken.

**Fixed:**
- Updated `k8s/security/iam/scripts/authentik-provision.py` to set `grant_types: ['authorization_code', 'refresh_token']` on create + patch
- Fixed app-list idempotency bug (added `superuser_full_list=true` to bypass access-policy filtering)
- Removed PATCH of existing applications (detail endpoint enforces policy, 404s for akadmin)
- Added missing `GITEA__oauth2__CLIENT_SECRET` env injection to Forgejo bootstrap Application
- All 4 providers (grafana, minio, forgejo, argocd) now have correct grant_types

**Test:** Login to any service with user `rock` / password `UAKLX8lv0pRbMaeBh2LQDZfU`

### 2. Storage HA (Longhorn on all 3 control-plane nodes)
**Root cause:** Longhorn DaemonSet had no toleration for `node-role.kubernetes.io/control-plane:NoSchedule` taint → only ran on talos-cp-1 → all workloads with PVCs forced to single node → no HA.

**Fixed:**
- Created `k8s/infrastructure/longhorn/longhorn-taint-toleration.yaml` (Setting that adds toleration)
- Created `k8s/infrastructure/longhorn/longhorn-nodes.yaml` (explicit Node CRDs for cp-2/cp-3, auto-discovery doesn't work with taints)
- Updated StorageClass `numberOfReplicas: 1→3` (true HA: each volume gets 3 copies across 3 nodes)
- Removed Forgejo's `nodeSelector: talos-cp-1` workaround

**Verified:**
- Longhorn DaemonSet: 3/3 pods (one per node)
- All 3 nodes show `Ready: True` with storage available
- Forgejo pods can now schedule on any node (PVC attachments work everywhere)

## Current State
- ✓ SSO working for all 4 services (Forgejo, Grafana, MinIO, ArgoCD)
- ✓ 3-node HA storage (Longhorn replicas across all control-plane nodes)
- ✓ All changes committed via GitOps (no manual kubectl patches retained)

## Commits
- `be2a56c`: fix provision script (grant_types + idempotency)
- `dde4b60`: add Forgejo CLIENT_SECRET + temp nodeSelector workaround
- `be7881d`: enable Longhorn on all 3 nodes (taint toleration + Node CRDs + 3 replicas)
- `6d1c055`: remove Forgejo nodeSelector (no longer needed)