viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

tripit: satisfy the auth-comment lint on the tripit-api ingress
All checks were successful
ci/woodpecker/push/default Pipeline was successful
Details
ci/woodpecker/push/build-cli Pipeline was successful
Details

Browse source 
The previous commit (c5631cff) failed CI's ingress_factory guard: the
'# auth = "none": <why>' justification must sit directly above the auth
line inside the module, not above the module block. Same content, moved
to where the lint looks; no functional change.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Viktor Barzin 2026-06-12 08:53:02 +00:00
parent c5631cff74
commit e8a4eb0f05
1 changed files with 10 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

17
stacks/tripit/main.tf
View file

@ -821,14 +821,17 @@ module "ingress_planner_slack" {
tls_secret_name = var.tls_secret_name
}
# Bearer-only API host for the native Shell (tripit ADR-0017, viktor/tripit#49).
# auth = "none": the backend itself validates OIDC bearer JWTs from the
# tripit-app Authentik provider (AUTH_MODE=hybrid, tripit slice 2) — a WebView
# client can't do the forward-auth cookie dance, and CORS preflights would die
# at the outpost. strip-auth-headers deletes inbound X-authentik-* so the
# hybrid fallback header can never be spoofed through this host.
# Bearer-only API host for the native Shell (tripit ADR-0017, viktor/tripit#49):
# the Shell's WebView can't do the forward-auth cookie dance, and CORS
# preflights would die at the outpost, so this host carries no Authentik
# middleware at all.
module "ingress_api" {
source = "../../modules/kubernetes/ingress_factory"
source = "../../modules/kubernetes/ingress_factory"
# auth = "none": requests are gated by the backend itself — it validates
# OIDC bearer JWTs from the tripit-app Authentik provider (AUTH_MODE=hybrid,
# tripit slice 2; 401 for everything else). strip-auth-headers deletes
# inbound X-authentik-* so the hybrid fallback header can never be spoofed
# through this host.
auth = "none"
anti_ai_scraping = false
dns_type = "proxied"