viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

openclaw: task-webhook ingress auth required->none (inbound Forgejo webhook)

Browse source 
The task-webhook host is an inbound webhook receiver: Forgejo (a machine
with no Authentik SSO cookie) POSTs issue/comment events, so forward-auth
302-bounced every delivery and silently dropped all webhooks. Flip only
this ingress to auth=none; the do_POST handler gates on payload action +
bot-user filtering. Gateway (openclaw) and openlobster stay auth=required.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Viktor Barzin 2026-06-02 21:55:25 +00:00
parent 91d110acf5
commit 982dc9e63a
1 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
stacks/openclaw/main.tf
View file

@ -1685,8 +1685,9 @@ resource "kubernetes_service" "task_webhook" {
}
module "task_webhook_ingress" {
source = "../../modules/kubernetes/ingress_factory"
auth = "required"
source = "../../modules/kubernetes/ingress_factory"
# auth = "none": inbound Forgejo webhook receiver - machine sender (no Authentik SSO cookie); receiver filters on payload action + bot-user
auth = "none"
namespace = kubernetes_namespace.openclaw.metadata[0].name
name = "task-webhook"
tls_secret_name = var.tls_secret_name