Put the artifactapi web UI behind Authentik oauth2-proxy #456

2026-09-07T14:02:28+10:00

unkin-agent commented

2026-09-07 14:02:28 +10:00

The artifactapi web UI is open to anyone who can reach the host. Front it with Authentik SSO gated on akP-artifactapi-admin, while leaving the package-manager surfaces (/api/v1, /api/v2, /v2 docker registry, /terraform, /.well-known) untouched — dnf, containerd mirrors, buildah, terraform and CI publish steps cannot do a browser flow.

Add the oauth2-proxy ConfigMap, Deployment, Service and VMPodScrape.
Add the oauth-credentials VaultStaticSecret.
Point the api-route /ui rule at oauth2-proxy and add a /oauth2 rule; the catch-all / rule still goes straight to the api Service on both listeners.

Requires terraform-authentik #34 applied and the Vault kv seed first.

The artifactapi web UI is open to anyone who can reach the host. Front it with Authentik SSO gated on akP-artifactapi-admin, while leaving the package-manager surfaces (/api/v1, /api/v2, /v2 docker registry, /terraform, /.well-known) untouched — dnf, containerd mirrors, buildah, terraform and CI publish steps cannot do a browser flow. - Add the oauth2-proxy ConfigMap, Deployment, Service and VMPodScrape. - Add the oauth-credentials VaultStaticSecret. - Point the api-route /ui rule at oauth2-proxy and add a /oauth2 rule; the catch-all / rule still goes straight to the api Service on both listeners. Requires terraform-authentik #34 applied and the Vault kv seed first.

unkin-agent added 1 commit 2026-09-07 14:02:28 +10:00

Put the artifactapi web UI behind Authentik oauth2-proxy 8f7b9360ad

Front /ui with an Authentik-authenticated oauth2-proxy while leaving every
package-manager surface unauthenticated.

- Add the oauth2-proxy ConfigMap, Deployment, Service and VMPodScrape.
- Add the oauth-credentials VaultStaticSecret.
- Split httproute: /ui and /oauth2 to oauth2-proxy (HTTPS, plus an HTTP
  redirect); everything else to the api Service on both listeners.

unkin-agent added 1 commit 2026-09-07 14:07:47 +10:00

Keep the artifactapi UI/API split inside one HTTPRoute

ci/woodpecker/pr/pre-commit Pipeline was canceled

Details

ci/woodpecker/pr/kubeconform Pipeline was canceled

Details

ci/woodpecker/pr/vector-test Pipeline was canceled

Details

7a9763e51b

Cross-route path precedence is untested on this Traefik gateway; the single
route already resolves /ui before / today.

- Fold the /ui and /oauth2 rules back into api-route on both listeners.
- Drop the separate ui-route and ui-http-redirect routes.

unkin-agent added 1 commit 2026-09-07 14:08:00 +10:00

Correct the oauth2 Service comment to name api-route

ci/woodpecker/pr/vector-test Pipeline was successful

Details

ci/woodpecker/pr/kubeconform Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

57972e1a9f

unkin-agent added 1 commit 2026-09-07 14:14:38 +10:00

Use the browser-trusted Authentik host for the artifactapi OIDC issuer

ci/woodpecker/pr/vector-test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/kubeconform Pipeline failed

Details

af1f77618d

The authorize step is a browser redirect, so the issuer must present a
publicly-trusted cert; identity.k8s.syd1.au.unkin.net serves an internal-CA
cert that no user's browser trusts.

- Point OAUTH2_PROXY_OIDC_ISSUER_URL at identity.unkin.net
- Drop the combine-certs initContainer, its volumes/mounts and
  PROVIDER_CA_FILES: the pod's only other upstream is plain-HTTP in-cluster

unkin-agent added 1 commit 2026-09-07 14:20:26 +10:00

Retrigger CI after a transient purelb chart download timeout

ci/woodpecker/pr/vector-test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/kubeconform Pipeline was successful

Details

fc41c5778a

benvin merged commit c98d88c197 into main

2026-09-07 21:01:17 +10:00

benvin deleted branch benvin/artifactapi-ui-oauth2-proxy