From c51fa2dfb45f943a627976fb3b3ec51312f5373a Mon Sep 17 00:00:00 2001
From: ALI YESILKAYA <Aliyesilkaya93@gmail.com>
Date: Tue, 7 Jul 2026 16:31:44 +0200
Subject: [PATCH] =?UTF-8?q?feat(auth):=20hub=20sur=20le=20domaine=20HTTPS?=
 =?UTF-8?q?=20=E2=80=94=20routes=20publiques=20+=20SSO=20Guacamole=20(#89)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

(Commits restés orphelins après le squash-merge de #88, poussés trop tard.)
- IngressRoutes websecure+TLS : auth./portail.funklab.online
- Guacamole : endpoints OIDC basculés sur https://auth./portail.funklab.online
  (les ports 9080/9081 restent un chemin réseau valide)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 k8s/apps/authentik/ingress-public.yaml | 18 ++++++++++++++++++
 k8s/apps/guacamole/deployment.yaml     | 11 +++++------
 k8s/apps/guacamole/ingress-public.yaml | 18 ++++++++++++++++++
 3 files changed, 41 insertions(+), 6 deletions(-)
 create mode 100644 k8s/apps/authentik/ingress-public.yaml
 create mode 100644 k8s/apps/guacamole/ingress-public.yaml

diff --git a/k8s/apps/authentik/ingress-public.yaml b/k8s/apps/authentik/ingress-public.yaml
new file mode 100644
index 0000000..232ef89
--- /dev/null
+++ b/k8s/apps/authentik/ingress-public.yaml
@@ -0,0 +1,18 @@
+# Accès public HTTPS — auth.funklab.online (cert Let's Encrypt auto).
+# S'ajoute à la route interne auth.lab.local (non destructif).
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: authentik-public
+  namespace: auth
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`auth.funklab.online`)
+      kind: Rule
+      services:
+        - name: authentik
+          port: 9000
+  tls:
+    certResolver: letsencrypt
diff --git a/k8s/apps/guacamole/deployment.yaml b/k8s/apps/guacamole/deployment.yaml
index 86df0e9..c99364e 100644
--- a/k8s/apps/guacamole/deployment.yaml
+++ b/k8s/apps/guacamole/deployment.yaml
@@ -43,19 +43,18 @@ spec:
             - name: WEBAPP_CONTEXT
               value: "ROOT"
             # --- SSO OIDC → Authentik (app « guacamole » dans l'UI Authentik) ---
-            # Endpoints navigateur : URL publique kaya.freeboxos.fr (une seule URL
-            # canonique, LAN inclus — hairpin NAT Freebox) ; JWKS : appel
-            # serveur→serveur via le Service interne
+            # URL canonique = domaine HTTPS (auth./portail.funklab.online), LAN inclus
+            # (split-horizon dnsmasq). JWKS : appel serveur→serveur via le Service interne.
             - name: OPENID_AUTHORIZATION_ENDPOINT
-              value: "http://kaya.freeboxos.fr:9081/application/o/authorize/"
+              value: "https://auth.funklab.online/application/o/authorize/"
             - name: OPENID_JWKS_ENDPOINT
               value: "http://authentik.auth.svc.cluster.local:9000/application/o/guacamole/jwks/"
             - name: OPENID_ISSUER
-              value: "http://kaya.freeboxos.fr:9081/application/o/guacamole/"
+              value: "https://auth.funklab.online/application/o/guacamole/"
             - name: OPENID_CLIENT_ID
               value: "guacamole"
             - name: OPENID_REDIRECT_URI
-              value: "http://kaya.freeboxos.fr:9080/"
+              value: "https://portail.funklab.online/"
             - name: OPENID_USERNAME_CLAIM_TYPE
               value: "preferred_username"
             - name: OPENID_SCOPE
diff --git a/k8s/apps/guacamole/ingress-public.yaml b/k8s/apps/guacamole/ingress-public.yaml
new file mode 100644
index 0000000..b017719
--- /dev/null
+++ b/k8s/apps/guacamole/ingress-public.yaml
@@ -0,0 +1,18 @@
+# Accès public HTTPS — portail.funklab.online (cert Let's Encrypt auto).
+# S'ajoute à la route interne portail.lab.local (non destructif).
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: guacamole-public
+  namespace: auth
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`portail.funklab.online`)
+      kind: Rule
+      services:
+        - name: guacamole
+          port: 8080
+  tls:
+    certResolver: letsencrypt