unkinben
435057b034
identity.unkin.net is now the canonical Authentik host. Grafana, LiteLLM and NetBox reach it over TLS served by the internal unkin.net CA, which their images don't trust, so OIDC/discovery failed with x509 unknown-authority. NetBox also still pointed at the secondary admin host. - grafana: mount the reflected vault-ca-cert and set generic_oauth tls_client_ca. - litellm: combine-certs init builds a public+internal CA bundle; SSL_CERT_FILE and REQUESTS_CA_BUNDLE point at it. - netbox: flip the OIDC issuer to identity.unkin.net; same combine-certs bundle for python-social-auth (requests). - docs: record the Rancher manual runtime step (issuer + CA in the auth config). Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv Signed-off-by: Ben Vincent <ben@unkin.net>
argocd-apps docs
Operational notes for the manifests in this repo.
| Doc | What it covers |
|---|---|
| cnpg-backups.md | How CNPG Postgres backups (WAL archiving + nightly base backups) to Ceph RGW are configured. |
| cnpg-restore.md | Restoring a CNPG cluster: full recovery, point-in-time recovery, cutover, and gotchas. |
| authentik-rancher-sso.md | Manual runtime step to point Rancher's OIDC auth at the canonical identity.unkin.net issuer and trust the internal CA. |