- Pinned to 1.37.0 so the migration is not also an upgrade
- ADMIN_TOKEN rotated to an Argon2id PHC string, stored as a SealedSecret.
The old token was plaintext AND set in config.json, which overrides env --
both that key and signups_allowed were removed during migration so the
Deployment is the source of truth. signups had been silently enabled.
- /admin keeps Authentik forward-auth at priority 1000 (Traefik's default
priority is rule length; the old docker router used 10 vs an implicit 24
and was therefore bypassed).
- vault.aleshym.co stays private: absent from the k3s public catchall and
from the Docker Traefik wan entrypoint.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude