feat(apps): Open WebUI (OIDC) + n8n sur le domaine public HTTPS (#91)

- open-webui : SSO OIDC Authentik (app openwebui) + route
  openwebui.funklab.online. Secret vault_openwebui_oauth_client_secret
  (= secret k8s ai/open-webui-oauth). Nouveaux comptes en rôle 'user'.
- n8n : route n8n.funklab.online (garde son propre login ; route interne
  n8n.lab.local conservée pour le webhook AlertManager)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

k8s/apps/n8n/ingress-public.yaml

@@ -0,0 +1,19 @@
+# Accès public HTTPS — n8n.funklab.online (cert Let's Encrypt auto).
+# n8n garde son propre login (pas d'OIDC en édition communautaire).
+# Route interne n8n.lab.local conservée (utilisée par le webhook AlertManager).
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: n8n-public
+  namespace: ai
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`n8n.funklab.online`)
+      kind: Rule
+      services:
+        - name: n8n
+          port: 5678
+  tls:
+    certResolver: letsencrypt

k8s/apps/open-webui/deployment.yaml

@@ -49,6 +49,29 @@ spec:
               value: "Funk AI"
             - name: DEFAULT_LOCALE
               value: "fr-FR"
+            # --- SSO OIDC → Authentik (app « openwebui ») ---
+            # Découverte server-side + navigateur sur l'URL publique (le pod la joint
+            # via hairpin). Redirect URI Authentik : .../oauth/oidc/callback
+            - name: WEBUI_URL
+              value: "https://openwebui.funklab.online"
+            - name: ENABLE_OAUTH_SIGNUP
+              value: "true"
+            - name: OAUTH_PROVIDER_NAME
+              value: "Authentik"
+            - name: OPENID_PROVIDER_URL
+              value: "https://auth.funklab.online/application/o/openwebui/.well-known/openid-configuration"
+            - name: OAUTH_CLIENT_ID
+              value: "openwebui"
+            - name: OAUTH_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: open-webui-oauth
+                  key: client-secret
+            - name: OAUTH_SCOPES
+              value: "openid email profile"
+            # Nouveaux comptes OIDC directement utilisables (sinon 'pending' = à valider)
+            - name: DEFAULT_USER_ROLE
+              value: "user"
           volumeMounts:
             - name: data
               mountPath: /app/backend/data

k8s/apps/open-webui/ingress-public.yaml

@@ -0,0 +1,18 @@
+# Accès public HTTPS — openwebui.funklab.online (cert Let's Encrypt auto).
+# Route interne openwebui.lab.local conservée (non destructif).
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: open-webui-public
+  namespace: ai
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`openwebui.funklab.online`)
+      kind: Rule
+      services:
+        - name: open-webui
+          port: 8080
+  tls:
+    certResolver: letsencrypt