dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

docs: record marreta login-wall fix (proxy provider needs linked Application)

Browse Source 
Documents the root-cause chain for the marreta.franksdank.cloud login wall:
null invalidation_flow (outpost serde crash) -> missing flows -> and the real
blocker, ProxyProvider.application=None so the embedded outpost's
filter(application__isnull=False) never loaded the provider. Notes the
providers are live-only (no repo blueprint) as a provenance gap.
This commit is contained in:
Frank
2026-09-12 13:34:02 -07:00
parent 57dbcc5459
commit dd44223f3f
1 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serverAppConfigs-docs/log.md
+20
View File
@@ -43,6 +43,26 @@ timestamp: 2026-09-14
which 500s every Laravel app route (`Unsupported cipher or incorrect key which 500s every Laravel app route (`Unsupported cipher or incorrect key
length`). Re-keyed with the required `base64:` prefix before any encrypted length`). Re-keyed with the required `base64:` prefix before any encrypted
data persisted. See [[Marreta]] § Secrets. data persisted. See [[Marreta]] § Secrets.
- **Login-wall fixed 2026-09-12 (post-deploy).** The homepage Marreta link
parked on `marreta.franksdank.cloud/if/flow/default-authentication-flow/`
instead of the app. Root cause chain, in the order found:
1. `marreta-proxy` had `invalidation_flow = null`, which crashed the Rust
embedded outpost's serde (`invalid type: null, expected a formatted UUID
string`) and took down **every** provider on the outpost. Set to
`default-provider-invalidation-flow`.
2. `authentication_flow` / `authorization_flow` were null; set to
`default-authentication-flow` / `default-provider-authorization-implicit-consent`.
3. **The real blocker:** the outpost's config API filters
`ProxyProvider.objects.filter(application__isnull=False)`. `marreta-proxy`
had no linked **Application**, so the outpost never loaded it and the
request fell through to raw flow serving on the marreta host — where the
IdP session cookie (scoped to `auth.franksdank.cloud`) is invisible.
Created `Application(name="Marreta", slug="marreta", provider=marreta-proxy)`.
- After `systemctl --user restart authentik-server authentik-outpost`, the
outpost loaded `marreta-proxy` and the OAuth dance completes: `/` →
`/outpost.goauthentik.io/start` → `auth…/o/authorize` → callback → Marreta.
Regression test: `tests/e2e/specs/16-marreta.spec.ts`. Providers remain
**live-only (no repo blueprint)** — a provenance gap to close.
## 2026-09-04 — *arr fleet consolidated on FrankBook-Pro; all egress VPN-gated ## 2026-09-04 — *arr fleet consolidated on FrankBook-Pro; all egress VPN-gated
- Operator decision: **FrankBook-Pro is the sole *arr deployment.** The - Operator decision: **FrankBook-Pro is the sole *arr deployment.** The