Claude
1261e238aa
- Pinned to 1.37.0 so the migration is not also an upgrade - ADMIN_TOKEN rotated to an Argon2id PHC string, stored as a SealedSecret. The old token was plaintext AND set in config.json, which overrides env -- both that key and signups_allowed were removed during migration so the Deployment is the source of truth. signups had been silently enabled. - /admin keeps Authentik forward-auth at priority 1000 (Traefik's default priority is rule length; the old docker router used 10 vs an implicit 24 and was therefore bypassed). - vault.aleshym.co stays private: absent from the k3s public catchall and from the Docker Traefik wan entrypoint. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
48 lines
1.4 KiB
YAML
48 lines
1.4 KiB
YAML
# /admin gets Authentik forward-auth on top of the ADMIN_TOKEN.
|
|
#
|
|
# Bitwarden clients (browser extension, phone) use /api, /identity and
|
|
# /notifications/hub and CANNOT follow an SSO redirect, so this is deliberately
|
|
# path-scoped -- never blanket-auth this host.
|
|
#
|
|
# Priority must EXCEED the Ingress route's default, which Traefik derives from
|
|
# the rule's character length. Setting a low-but-nonzero number is the trap that
|
|
# left this same /admin panel unprotected under Docker (priority=10 vs an
|
|
# implicit 24). 1000 is unambiguous.
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: authentik
|
|
namespace: vaultwarden
|
|
spec:
|
|
forwardAuth:
|
|
# Resolves to 10.10.0.5 only because coredns-custom forwards aleshym.co to
|
|
# Pi-hole; the node's own resolver (1.1.1.1) returns the public IP.
|
|
address: https://auth.aleshym.co/outpost.goauthentik.io/auth/traefik
|
|
trustForwardHeader: true
|
|
authResponseHeaders:
|
|
- X-authentik-username
|
|
- X-authentik-groups
|
|
- X-authentik-email
|
|
- X-authentik-name
|
|
- X-authentik-uid
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: vaultwarden-admin
|
|
namespace: vaultwarden
|
|
spec:
|
|
entryPoints:
|
|
- websecure
|
|
routes:
|
|
- kind: Rule
|
|
priority: 1000
|
|
match: Host(`vault.aleshym.co`) && PathPrefix(`/admin`)
|
|
middlewares:
|
|
- name: authentik
|
|
services:
|
|
- name: vaultwarden
|
|
port: 80
|
|
tls:
|
|
secretName: vaultwarden-tls
|