# /admin gets Authentik forward-auth on top of the ADMIN_TOKEN.
#
# Bitwarden clients (browser extension, phone) use /api, /identity and
# /notifications/hub and CANNOT follow an SSO redirect, so this is deliberately
# path-scoped -- never blanket-auth this host.
#
# Priority must EXCEED the Ingress route's default, which Traefik derives from
# the rule's character length. Setting a low-but-nonzero number is the trap that
# left this same /admin panel unprotected under Docker (priority=10 vs an
# implicit 24). 1000 is unambiguous.
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: authentik
  namespace: vaultwarden
spec:
  forwardAuth:
    # Resolves to 10.10.0.5 only because coredns-custom forwards aleshym.co to
    # Pi-hole; the node's own resolver (1.1.1.1) returns the public IP.
    address: https://auth.aleshym.co/outpost.goauthentik.io/auth/traefik
    trustForwardHeader: true
    authResponseHeaders:
      - X-authentik-username
      - X-authentik-groups
      - X-authentik-email
      - X-authentik-name
      - X-authentik-uid
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: vaultwarden-admin
  namespace: vaultwarden
spec:
  entryPoints:
    - websecure
  routes:
    - kind: Rule
      priority: 1000
      match: Host(`vault.aleshym.co`) && PathPrefix(`/admin`)
      middlewares:
        - name: authentik
      services:
        - name: vaultwarden
          port: 80
  tls:
    secretName: vaultwarden-tls