Files

T

unkinben dfb495d771 Trust internal CA for Authentik SSO; canonical identity.unkin.net for NetBox (#314 )

Authentik is canonical at https://identity.unkin.net, served by the internal
unkin.net CA. Grafana, LiteLLM and NetBox failed OIDC discovery because their
images don't trust that CA (x509: unknown authority); NetBox also still pointed
at the secondary admin host.

- grafana: mount the reflected vault-ca-cert; set generic_oauth `tls_client_ca`.
- litellm: `combine-certs` init builds public+internal CA bundle; `SSL_CERT_FILE`
  + `REQUESTS_CA_BUNDLE` point at it.
- netbox: flip OIDC issuer to identity.unkin.net; same combine bundle for
  python-social-auth (`requests`).
- docs: record the Rancher manual runtime step (issuer + CA in the auth config).

Validated: kustomize build + kubeconform + pre-commit.

https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
Reviewed-on: #314
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

2026-07-30 22:17:44 +10:00

552 B

Raw Blame History

argocd-apps docs

Operational notes for the manifests in this repo.

Doc	What it covers
cnpg-backups.md	How CNPG Postgres backups (WAL archiving + nightly base backups) to Ceph RGW are configured.
cnpg-restore.md	Restoring a CNPG cluster: full recovery, point-in-time recovery, cutover, and gotchas.
authentik-rancher-sso.md	Manual runtime step to point Rancher's OIDC auth at the canonical `identity.unkin.net` issuer and trust the internal CA.

552 B Raw Blame History

argocd-apps docs

552 B

Raw Blame History