Travis Herbranson 7eb8d756d1 compile: first compile — 17 entities, 2 synthesis, all indexes rebuilt

Read all 62 source files (Dev: 37, Homelab: 22, Venture: 3, Reference: 0).

Entity pages created (17):
- Wiki/Reference: lovebug, jenny, sunnie, n8n, ob1, tailscale, authentik,
  traefik, cloudflare, obsidian, gitea, plant-based-southerner, claude-code,
  dispatch, docker
- Wiki/Homelab: proxmox
- Wiki/Dev: pbs-hub, herbydev

Synthesis pages created (2):
- Wiki/Homelab/homelab-ingress-stack — four-layer ingress model (Cloudflare +
  Traefik + Authentik + Tailscale); operational lessons from 10+ source files
- Wiki/Dev/ai-memory-architecture — three memory layers (wiki + OB1 + Dispatch
  context); ingest paths; harness-vs-model design decision

All 11 index pages rebuilt (Sources/Dev, Venture, Homelab, Reference, Sources
root; Wiki/Dev, Venture, Homelab, Reference, Wiki root; vault root index.md).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-08 18:15:31 -04:00

2.0 KiB

Raw Blame History

type

path

Authentik

What it is

Authentik is the self-hosted identity provider (IdP) and SSO platform for homelab services. It handles OAuth2 and OIDC flows, providing centralized authentication for internal tools without relying on external identity providers. In the homelab stack, Authentik acts as the authorization layer in front of sensitive services, including the MCP server and planned SSH CA integration.

Current state

Active. Current integrations:

Homelab MCP server — Authentik provides OAuth2 for the mcp.herbylab.dev Streamable HTTP endpoint; first deployed May 2026
SSH CA (planned) — step-ca + Authentik OIDC for short-lived SSH certificates, replacing long-lived keys
PBS security hardening (planned) — Authentik / Authelia as second authentication layer for PBS services alongside Crowdsec

Where it lives

Homelab — running as a Docker container or Proxmox LXC/VM
Accessible internally and via Cloudflare Tunnel / Traefik ingress
Domain: likely auth.herbylab.dev (split-horizon .herbylab.dev)

Sources/Homelab/homelab-mcp-server — OAuth2 for MCP endpoint
Sources/Homelab/2026-05-06-homelab-mcp-server-stand-up — MCP stand-up session
Sources/Homelab/ssh-ca-with-step-ca-authentik — SSH CA integration
Sources/Homelab/pbs-security-hardening — layered PBS security
Wiki/Reference/traefik — ingress layer
Wiki/Reference/cloudflare — tunnel/DNS layer
Wiki/Homelab/homelab-ingress-stack — synthesis

History

Ongoing — Core SSO platform for homelab services
2026-05-06 — First MCP server deployed behind Authentik OAuth2
Planned — step-ca OIDC integration for short-lived SSH certs
Planned — PBS security hardening layer alongside Crowdsec

2.0 KiB Raw Blame History