ci(release): add workflow_dispatch — enable manual image builds

.github/workflows/release.yml

@@ -4,6 +4,16 @@ name: Release (images + GitOps bump)
 # GHCR tagged with the commit SHA, then bump the tags in values-prod.yaml and
 # commit. Argo CD sees the git change and rolls out the new images.
 on:
+  # Manual trigger: auto-merged PRs push to master under GITHUB_TOKEN, and GitHub
+  # does NOT start push-triggered workflows for GITHUB_TOKEN pushes — so this
+  # workflow otherwise never runs after an auto-merge and images never build.
+  # Dispatch this after a deploy-window merge to build + bump the image tags.
+  workflow_dispatch:
+    inputs:
+      reason:
+        description: 'Why this manual build (e.g. deploy security-service after an auto-merged PR)'
+        required: false
+        default: 'manual release'
   push:
     branches: [master]
     paths:

deploy/helm/fuzefront/templates/authentik.yaml

@@ -284,24 +284,5 @@ spec:
   headers:
     customRequestHeaders:
       X-Forwarded-Proto: "https"
-{{- if eq .Values.ingress.className "traefik" }}
----
-# Strip the `/api/auth/idp` prefix before forwarding to authentik-server, so
-# Authentik receives its native paths (e.g. /application/o/fuzefront/). Traefik's
-# stripPrefix also sets `X-Forwarded-Prefix: /api/auth/idp`, which Authentik uses
-# to build absolute discovery/authorize URLs back under the app host + prefix —
-# keeping the issuer `https://app.fuzefront.com/api/auth/idp/...` consistent.
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: authentik-idp-stripprefix
-  labels:
-    {{- include "fuzefront.labels" . | nindent 4 }}
-spec:
-  stripPrefix:
-    prefixes:
-      - /api/auth/idp
-    forceSlash: false
-{{- end }}
 {{- end }}
 {{- end }}

deploy/helm/fuzefront/templates/ingress.yaml

@@ -186,9 +186,8 @@ metadata:
     app.kubernetes.io/component: authentik-idp
   annotations:
     {{- if eq .Values.ingress.className "traefik" }}
-    traefik.ingress.kubernetes.io/router.middlewares: {{ .Release.Namespace }}-authentik-idp-stripprefix@kubernetescrd,{{ .Release.Namespace }}-authentik-forwarded-proto@kubernetescrd
+    traefik.ingress.kubernetes.io/router.middlewares: {{ .Release.Namespace }}-authentik-forwarded-proto@kubernetescrd
     {{- else if eq .Values.ingress.className "nginx" }}
-    nginx.ingress.kubernetes.io/rewrite-target: /$2
     nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
     {{- end }}
     {{- with .Values.ingress.annotations }}
@@ -206,16 +205,13 @@ spec:
     - host: {{ .Values.ingress.host | quote }}
       http:
         paths:
-          {{- if eq .Values.ingress.className "nginx" }}
-          - path: /api/auth/idp(/|$)(.*)
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: authentik-server
-                port:
-                  number: 9000
-          {{- else }}
-          - path: /api/auth/idp
+          # Route Authentik's OWN native root paths under the app host (NO prefix,
+          # NO strip). Authentik ignores X-Forwarded-Prefix, so it builds absolute
+          # OIDC discovery/authorize URLs at these root paths using the forwarded
+          # Host (app.fuzefront.com) — which must therefore be routable here.
+          # These prefixes don't overlap the app's /api, /apps, /socket.io, / routes.
+          {{- range $p := list "/application" "/if" "/source" "/flows" "/ws" "/-" "/outpost.goauthentik.io" "/static/dist" "/static/authentik" }}
+          - path: {{ $p }}
             pathType: Prefix
             backend:
               service:

deploy/helm/fuzefront/values-prod.yaml

@@ -256,11 +256,14 @@ authentik:
   bootstrapEmail: admin@fuzefront.com
   oidc:
     enabled: true
-    # App-hosted, reverse-proxied issuer. The /api/auth/idp prefix is stripped by
-    # the Traefik middleware before reaching authentik-server; X-Forwarded-Prefix
-    # keeps Authentik's discovery URLs under this path. The FuzeFront OAuth
-    # callback (redirectUri) is already app-hosted and unchanged.
-    issuerUrl: "https://app.fuzefront.com/api/auth/idp/application/o/fuzefront/"
+    # App-hosted, reverse-proxied issuer at Authentik's NATIVE root path. Authentik
+    # ignores X-Forwarded-Prefix, so it advertises discovery/authorize URLs at
+    # /application/o/... (using the forwarded Host app.fuzefront.com); the app
+    # Ingress routes those native Authentik paths (/application,/if,/source,...)
+    # straight to authentik-server (no prefix, no strip), so the browser stays on
+    # app.fuzefront.com and never sees the IdP host. Callback (redirectUri) is the
+    # FuzeFront security-service route, unchanged.
+    issuerUrl: "https://app.fuzefront.com/application/o/fuzefront/"
     redirectUri: "https://app.fuzefront.com/api/auth/oidc/callback"
     # No split-DNS in prod: real public DNS + a real Let's Encrypt cert mean the
     # backend reaches Authentik over the internet without a hostAlias or a custom