v0.9.45-alpha — webadmin LDAP login on no-hairpin / self-hosted boxes

webadmin 8446 login now works on self-hosted boxes behind NAT without hairpin (home lab / Hyper-V / Starlink) — even with a public IP and full port forwarding.

The fix

The Authentik LDAP outpost's internal→FQDN routing migration was silently aborting on no-hairpin boxes: its pre-check required NAT hairpin (a container reaching its own host's public IP), the probe hung until a 15s timeout, and the box stayed on spiral-prone internal routing — so webadmin cold binds died with exceeded stage recursion depth (a flow spiral, not a wrong password) and 8446 rejected the correct password. Port forwarding does not provide hairpin, which is why a fully-forwarded box still failed.

The migration now treats the hairpin timeout as the signal it is and routes the outpost to Caddy via the host gateway (extra_hosts: host-gateway) instead, with the existing post-recreate validation + auto-rollback as the safety net. The Resync LDAP to TAK Server button runs it directly and visibly.

Also in this release

• LDAP bind verifier no longer shows a false-red "NOT READY" when ldapsearch can't be installed (tri-state OK / FAIL / UNVERIFIED; hardened install rides out apt locks).
• Outpost-log diagnostic is un-truncated and classifies the failure (flow spiral vs invalid credentials vs authenticated).
• "Download Certificates" password no longer shows the pre-deploy default until you refresh.

Upgrade

Update Now from the console, or git pull + restart. Cloud boxes are unaffected — their routing path is unchanged.