fix: close gitops review findings (auth, secrets, apply safety) - #127
Open
s3lcsum wants to merge 5 commits into
Open
fix: close gitops review findings (auth, secrets, apply safety)#127s3lcsum wants to merge 5 commits into
s3lcsum wants to merge 5 commits into
Conversation
added 5 commits
August 24, 2026 23:04
Mosquitto cannot bind 0.0.0.0:1883 together with 127.0.0.1:1883. Keep anonymous localhost for HA/healthcheck and require a password on the LAN IP and Docker host-gateway. Also gitignore the OpenCode htpasswd sidecar so rsync --delete cannot wipe the live password file.
n8n 2.x import requires a workflow id; without one it fails the NOT NULL constraint. Keep the live ids and webhook id so apply updates the existing workflows instead of creating duplicates.
Bcrypt hashes contain $ which Docker Compose interpolates to empty, breaking Traefik basicAuth. Document doubling every $ in the env example and lock that in the security invariants.
The firewall workflows PUT to https://router.dominiksiejak.pl/rest, which is now behind Authentik. n8n follows the login redirect and Authentik returns Django CSRF 403 because the request has no Referer. Use the router LAN IP and allowlist it for n8n SSRF protection.
n8n-gateway was a second tile for the same host (OAuth2 vs Traefik forward-auth). RouterOS already has RADIUS. ESPHome is no longer deployed. Remove the extra proxy/dashboard apps and the matching forward-auth middleware.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the GitOps security review findings and applies them on the Portainer host.
What changed
event.action/client_ip), login + authorize event rulesbasicAuthfromOPENCODE_HTPASSWD, Authentik forward-auth on n8n UI and *arr/Jellyfin, webhook rate-limit, API not insecure, metrics on localhost127.0.0.1:54320.0.0.0:1883with localhost on the same port)movedblock; Vault admin policy scoped; OAuth grants tightenedLive apply (already done)
Stacks recreated on the Portainer host. MQTT, n8n workflows, Authentik forward-auth, and Postgres bind verified.
Notes
stacks/traefik/.opencode-basic.pass(bcrypt$doubled intraefik.envfor Compose)chown 1883:1883/ mode640authentik@docker)