From 2762dcbdb80bc9c2688ac5b04a614b497bf16aad Mon Sep 17 00:00:00 2001 From: dtoro Date: Mon, 1 Jun 2026 00:33:26 +0200 Subject: [PATCH] arch-migration P1: dedicated forward-auth outpost (LXC 106) - containers/106-auth-outpost.md: new LAN outpost page - 124-authentik: forward-auth cut over, Authentik stopped (DNS-only now) - investigation: forward-auth outpost marked RESOLVED Co-Authored-By: Claude Opus 4.8 --- containers/106-auth-outpost.md | 42 +++++++++++++++++++ containers/124-authentik.md | 3 ++ .../2026-05-31-authentik-vps-migration.md | 6 +++ 3 files changed, 51 insertions(+) create mode 100644 containers/106-auth-outpost.md diff --git a/containers/106-auth-outpost.md b/containers/106-auth-outpost.md new file mode 100644 index 0000000..04a2c12 --- /dev/null +++ b/containers/106-auth-outpost.md @@ -0,0 +1,42 @@ +# 106 — `auth-outpost` + +Authentik **forward-auth outpost** for LAN-gated apps. A stateless proxy that connects outbound to the [VPS Authentik core](../investigations/2026-05-31-authentik-vps-migration.md) and serves forward-auth locally, so [Caddy (121)](121-caddy.md) never hairpins auth through VPS Traefik. + +## At a glance +- **Hostname:** `auth-outpost` +- **IP:** `192.168.8.6` (static) +- **Privilege:** privileged (Docker-in-LXC, `features: nesting=1`) +- **Resources:** 1 core / 512 MiB / 4 GiB rootfs +- **Mounts:** none +- **Created:** 2026-06-01, Debian 13, replacing the embedded outpost on [124](124-authentik.md) + +## Role + +Runs one container — `ghcr.io/goauthentik/proxy` — that opens an outbound websocket to `https://auth.hubris.network` (the VPS core), pulls its proxy-provider config, and answers Caddy's `forward_auth` subrequests on `192.168.8.6:9000` (LAN-only bind). Because the call path is **Caddy → outpost (LAN)**, with no Traefik in between, `X-Forwarded-Host` is preserved — the failure that 404s when Caddy is pointed at `https://auth.hubris.network` directly (Traefik rewrites the header). See the [migration investigation](../investigations/2026-05-31-authentik-vps-migration.md). + +## Service / port map +| Service | Listen | Notes | +| --- | --- | --- | +| authentik proxy outpost | `192.168.8.6:9000` | `/outpost.goauthentik.io/*` (ping, auth/caddy) | + +## Config paths +- `/opt/authentik-outpost/docker-compose.yml` — `ghcr.io/goauthentik/proxy:2026.5.2`, `AUTHENTIK_HOST=https://auth.hubris.network`, `AUTHENTIK_INSECURE=false`, port bound `192.168.8.6:9000`. +- `/opt/authentik-outpost/.env` (mode 600, **untracked**) — `AUTHENTIK_TOKEN` for outpost `hubris-lan-outpost` (sops-encrypt into `secrets/` — TODO Phase 5). + +## The outpost object (VPS Authentik) +- Outpost **`hubris-lan-outpost`** (type proxy), providers: `hubris-forward-auth` (domain, Paperless + domain-level apps), `Provider for Torrent` (qBittorrent), `Provider for Artifacto` (single). +- Health: VPS admin → Applications → Outposts → last-seen current; `curl http://192.168.8.6:9000/outpost.goauthentik.io/ping` → `204`; container log `Successfully connected websocket`. + +## Caddy wiring +[Caddy (121)](121-caddy.md) `(authentik)` snippet `reverse_proxy`/`forward_auth` → `http://192.168.8.6:9000` (was `192.168.8.180:9000` on LXC 124). Tracked in `dtoro/caddy-conf`. + +## Related +- [124 — authentik](124-authentik.md) — old embedded-outpost host (now DNS-only) +- [Caddy (121)](121-caddy.md) — forward-auth consumer +- [Ingress (VPS traefik)](../infrastructure/ingress.md) +- [Authentik VPS migration](../investigations/2026-05-31-authentik-vps-migration.md) + +## Changelog + +### 2026-06-01 — created; forward-auth cut over from LXC 124 +New dedicated LXC for the LAN forward-auth outpost (Phase 1 of the [architecture migration](../investigations/2026-05-31-authentik-vps-migration.md)). Deployed `goauthentik/proxy:2026.5.2` pointed at the VPS core; repointed Caddy `(authentik)` from `192.168.8.180:9000` → `192.168.8.6:9000`. Verified Paperless/qBittorrent/Artifacto return the SSO redirect with **124-Authentik stopped**, confirming the frozen instance is out of the path. dnsmasq stays on 124 until [DNS is relocated](124-authentik.md). diff --git a/containers/124-authentik.md b/containers/124-authentik.md index 81b0e3e..e597432 100644 --- a/containers/124-authentik.md +++ b/containers/124-authentik.md @@ -172,6 +172,9 @@ dnsmasq runs alongside Authentik on this LXC, listening on `192.168.8.180:53` + ## Changelog +### 2026-06-01 — forward-auth outpost cut over to LXC 106; Authentik stopped on 124 +The embedded outpost that Caddy called at `192.168.8.180:9000` was replaced by a dedicated LAN outpost on [106 — auth-outpost](106-auth-outpost.md) (`192.168.8.6:9000`), connected to the VPS core. Authentik (`server/worker/postgresql`) was **stopped** on this LXC; forward-auth apps verified working without it. **dnsmasq still runs here** — 124 stays up as a DNS-only box until DNS is relocated (architecture-migration Phase 2). Once DNS moves, 124 can be fully retired. + ### 2026-05-31 — Authentik migrated to the VPS (this LXC is now legacy) Resolved a bootstrap deadlock — netbird-mgmt on the VPS couldn't start because it fetches Authentik's OIDC discovery on boot, but Authentik was mesh-only and the mesh was down because mgmt was down. Moved the whole Authentik stack onto the VPS (image `2026.2.2` → `2026.5.2`, now with Redis, on a dedicated `auth` Docker network), migrated the full Postgres DB (users/apps/passwords/groups), and added `depends_on: service_healthy` so the deadlock can't recur. dnsmasq stays on this LXC; its `auth.hubris.network` entry now points to `82.165.190.79`. Along the way: switched redirect URIs to `STRICT`, ran `ak apply_blueprints` to fix old `return`-syntax expression policies, and deleted dead WebAuthn devices. Full writeup: [investigation](../investigations/2026-05-31-authentik-vps-migration.md). diff --git a/investigations/2026-05-31-authentik-vps-migration.md b/investigations/2026-05-31-authentik-vps-migration.md index ad909d7..1ab3026 100644 --- a/investigations/2026-05-31-authentik-vps-migration.md +++ b/investigations/2026-05-31-authentik-vps-migration.md @@ -72,6 +72,12 @@ The real reason the browser kept hitting the *old* Authentik even after the VPS 7. **Frontend/backend version skew shows as "Unknown error."** Confirm which Authentik the browser actually loaded (`version` line in the console) before chasing backend logs. 8. **WebAuthn/passkeys do not survive host migrations** — delete and re-enroll. +## Forward-auth outpost — RESOLVED 2026-06-01 + +Forward-auth apps (Paperless, qBittorrent, Artifacto) initially still validated against LXC 124's *embedded* outpost (Caddy → `192.168.8.180:9000`) — split-brain against the frozen DB. Pointing Caddy at `https://auth.hubris.network` instead fails: VPS Traefik rewrites `X-Forwarded-Host` → outpost can't match the app → 404 (tested + reverted). + +Fixed with a **dedicated LAN outpost** ([106 — auth-outpost](../containers/106-auth-outpost.md), `192.168.8.6`): `goauthentik/proxy` connects outbound to the VPS core and serves forward-auth locally; Caddy → outpost over the LAN, no Traefik, header preserved. Outpost `hubris-lan-outpost` carries the 3 proxy providers. Verified with 124-Authentik **stopped**. This was Phase 1 of the broader architecture migration (plan: VPS edge / hubris LAN core / Mac Mini redundancy). + ## Outstanding - **NetBird client version skew.** Mac client is `0.68.3` vs mgmt `0.71.3`; NetBird-SSH cert exchange fails between them. Upgrade all clients toward `0.71.x`.