From 4ca727878214a436ade04004c2fd21c4773d2401 Mon Sep 17 00:00:00 2001
From: James Allenby <JamesAllenby@protonmail.com>
Date: Wed, 1 Jul 2026 21:10:35 +0100
Subject: [PATCH] feat: add ForwardAuth middleware, protect Longhorn and Hubble
 with Authentik

---
 manifests/middleware.yaml       | 21 ++++++++++++++++++
 manifests/protected-routes.yaml | 39 +++++++++++++++++++++++++++++++++
 manifests/routes.yaml           | 34 ----------------------------
 3 files changed, 60 insertions(+), 34 deletions(-)
 create mode 100644 manifests/middleware.yaml
 create mode 100644 manifests/protected-routes.yaml

diff --git a/manifests/middleware.yaml b/manifests/middleware.yaml
new file mode 100644
index 0000000..0c787f9
--- /dev/null
+++ b/manifests/middleware.yaml
@@ -0,0 +1,21 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: authentik-forwardauth
+  namespace: traefik
+spec:
+  forwardAuth:
+    address: http://ak-outpost-traefik-forwardauth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+      - X-authentik-jwt
+      - X-authentik-meta-jwks
+      - X-authentik-meta-outpost
+      - X-authentik-meta-provider
+      - X-authentik-meta-app
+      - X-authentik-meta-version
diff --git a/manifests/protected-routes.yaml b/manifests/protected-routes.yaml
new file mode 100644
index 0000000..efed279
--- /dev/null
+++ b/manifests/protected-routes.yaml
@@ -0,0 +1,39 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: longhorn-ui
+  namespace: longhorn-system
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`longhorn.solidish.dev`)
+      kind: Rule
+      middlewares:
+        - name: authentik-forwardauth
+          namespace: traefik
+      services:
+        - name: longhorn-frontend
+          port: 80
+  tls:
+    secretName: longhorn-solidish-dev-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: hubble-ui
+  namespace: kube-system
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`hubble.solidish.dev`)
+      kind: Rule
+      middlewares:
+        - name: authentik-forwardauth
+          namespace: traefik
+      services:
+        - name: hubble-ui
+          port: 80
+  tls:
+    secretName: hubble-solidish-dev-tls
diff --git a/manifests/routes.yaml b/manifests/routes.yaml
index ff8d37d..3ddc884 100644
--- a/manifests/routes.yaml
+++ b/manifests/routes.yaml
@@ -1,39 +1,5 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
-metadata:
-  name: longhorn-ui
-  namespace: longhorn-system
-spec:
-  parentRefs:
-    - name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure-longhorn
-  hostnames:
-    - longhorn.solidish.dev
-  rules:
-    - backendRefs:
-        - name: longhorn-frontend
-          port: 80
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: hubble-ui
-  namespace: kube-system
-spec:
-  parentRefs:
-    - name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure-hubble
-  hostnames:
-    - hubble.solidish.dev
-  rules:
-    - backendRefs:
-        - name: hubble-ui
-          port: 80
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
 metadata:
   name: authentik
   namespace: authentik