feat(authn): hide Authentik host — reverse-proxy IdP under app.fuzefront.com - #247
Merged
Conversation
…wares [skip ci] Co-Authored-By: Claude claude-opus-4-8 <noreply@anthropic.com> Claude-Session-Id: cf830721-b1ef-4fe0-a024-035ad280dcf7
…pp.fuzefront.com [skip ci] - app Ingress: /api/auth/idp/* -> authentik-server (ClusterIP); /api/v1/security -> fuzefront-security - dedicated IdP Ingress with strip-prefix + forwarded-proto middlewares - values-prod: OIDC issuer now app.fuzefront.com/api/auth/idp/... Co-Authored-By: Claude claude-opus-4-8 <noreply@anthropic.com> Claude-Session-Id: cf830721-b1ef-4fe0-a024-035ad280dcf7
Co-Authored-By: Claude claude-opus-4-8 <noreply@anthropic.com> Claude-Session-Id: cf830721-b1ef-4fe0-a024-035ad280dcf7
Contributor
Automated code review (gate-code-review)Credit balance is too low Report-only — this check never blocks merge. |
izzywdev
added
hold
and removed
auto-merge
Contributor
Automated code review (gate-code-review)
Report-only — this check never blocks merge. |
izzywdev
added a commit
that referenced
this pull request
Jul 15, 2026
…C (prod outage) (#256) #247's reverse-proxy stripped /api/auth/idp and relied on X-Forwarded-Prefix, but Authentik IGNORES it — so discovery advertised app.fuzefront.com/application/o/authorize/ (no prefix), an unrouted path → the browser authorize redirect 404'd → prod login broke. Fix: route Authentik's native root paths (/application,/if,/source,/flows,/ws,/-, /outpost.goauthentik.io,/static/dist,/static/authentik) straight to authentik-server under app.fuzefront.com (no strip); issuer -> https://app.fuzefront.com/application/o/fuzefront/. Boundary intact: browser stays on app.fuzefront.com, never sees the IdP host. Chart-only — deploys via Argo, no image build. helm template renders clean. Claude-Session-Id: cf830721-b1ef-4fe0-a024-035ad280dcf7 Co-authored-by: fuzeone-bot[bot] <fuzeone-bot[bot]@users.noreply.github.com> Co-authored-by: Claude claude-opus-4-8 <noreply@anthropic.com>
izzywdev
added a commit
that referenced
this pull request
Jul 15, 2026
* fix(authn): route Authentik native paths under app host — restore OIDC (prod outage) #247's reverse-proxy stripped /api/auth/idp and relied on X-Forwarded-Prefix, but Authentik IGNORES it — so discovery advertised app.fuzefront.com/application/o/authorize/ (no prefix), an unrouted path → the browser authorize redirect 404'd → prod login broke. Fix: route Authentik's native root paths (/application,/if,/source,/flows,/ws,/-, /outpost.goauthentik.io,/static/dist,/static/authentik) straight to authentik-server under app.fuzefront.com (no strip); issuer -> https://app.fuzefront.com/application/o/fuzefront/. Boundary intact: browser stays on app.fuzefront.com, never sees the IdP host. Chart-only — deploys via Argo, no image build. helm template renders clean. Co-Authored-By: Claude claude-opus-4-8 <noreply@anthropic.com> Claude-Session-Id: cf830721-b1ef-4fe0-a024-035ad280dcf7 * ci(release): add workflow_dispatch — enable manual image builds Auto-merged PRs push to master under GITHUB_TOKEN, which GitHub does not let trigger push-workflows — so release.yml never ran after #247/#253/#256 and the security-service/frontend images never built. workflow_dispatch gives a reliable manual build+GitOps-bump path (durable fix: switch auto-merge to a PAT — needs a RELEASE_PAT secret, tracked separately). Co-Authored-By: Claude claude-opus-4-8 <noreply@anthropic.com> Claude-Session-Id: cf830721-b1ef-4fe0-a024-035ad280dcf7 --------- Co-authored-by: fuzeone-bot[bot] <fuzeone-bot[bot]@users.noreply.github.com> Co-authored-by: Claude claude-opus-4-8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Deploy/ingress slice of the AuthN boundary fix (contract PR #243)
Makes Authentik's host invisible to the browser. Deploy/Helm/values only — no app code, UI, or tests.
Changes
auth.fuzefront.comIngress (templates/authentik.yaml). Authentik is now ClusterIP-only (authentik-serverService unchanged). Kept theauthentik-forwarded-protomiddleware and added anauthentik-idp-stripprefixmiddleware (traefik) for the reverse-proxy path.templates/ingress.yaml): dedicatedfuzefront-authentik-idpIngress routesapp.fuzefront.com/api/auth/idp/*→authentik-server:9000(ClusterIP). Separate Ingress so the strip-prefix/forwarded-proto middlewares are scoped to the IdP proxy only. Traefik strips/api/auth/idp(+X-Forwarded-Prefix); nginx/local usesrewrite-target./api/v1/securityroute →fuzefront-security(the provider-neutral Security API);/api/auth+/api/organizationskept as deprecated shims. Longest-prefix-match keeps/api/auth/idpwinning over/api/auth.values-prod.yaml: OIDCissuerUrlmoved tohttps://app.fuzefront.com/api/auth/idp/application/o/fuzefront/;redirectUriunchanged (already app-hosted).authentik.hostretained only as an internal/legacy label (no Ingress binds it).Verified
helm lint(prod values): 0 failed.helm templateprod + local render clean; noauth.fuzefront.comIngress rule remains;/api/v1/security→fuzefront-security;/api/auth/idp→authentik-server.kubeconform -strict -ignore-missing-schemas: prod 31 valid / 0 invalid, local 23 valid / 0 invalid (skips = Traefik Middleware CRD, expected).Coordination / follow-ups (out of this slice)
@claudeissue filed to drop theauth.fuzefront.compublic CF-tunnel route (link added in comment).auth.fuzefront.com/source/oauth/callback/google/) must be re-pointed to the app-hosted path + the Google console redirect URI updated — backend/blueprint scope./api/auth/idp/; FuzeSocial re-point is a separate@claudeissue post-deploy.🤖 Generated with Claude Code