ATAuth Deployment Inventory #

Last updated: 2026-03-01

Single Instance (Consolidated) #

K8s Instance (DigitalOcean) #

Field	Value
Public URL	`https://apricot.workingtitle.zip`
Internal	`atauth.atauth.svc.cluster.local:3100`
Version	v2.2.0
Routing	Cloudflare Tunnel → K8s service
Image	`registry.digitalocean.com/ghostmesh-registry/atauth`
Data	K8s PersistentVolume (SQLite) at `/app/data/gateway.db`
CI/CD	Gitea Actions → DO registry → kubectl (working, last deploy 2026-03-01)
Kubectl	`KUBECONFIG=~/.kube/atauth-kubeconfig.yaml kubectl --insecure-skip-tls-verify -n atauth`
Admin Token	In K8s Secret `atauth-secrets` key `ATAUTH_ADMIN_TOKEN`

All apps use this instance.

Decommissioned: PDS Server Instance (Hetzner) #

Stopped 2026-03-01 after consolidation. Data preserved at Docker volume atauth_atauth-data on pds-hetzner.

Field	Value
Former URL	`https://atauth.arcnode.xyz` (tunnel route still exists, returns 502)
Data backup	`/var/lib/docker/volumes/atauth_atauth-data/_data/gateway.db`
Config	`/opt/atauth/.env`, `/opt/atauth/docker-compose.yml`

Registered Apps #

Proxy Origins (forward-auth) #

Origin	Name	Notes
`search.arcnode.xyz`	SearXNG	nginx auth_request → K8s atauth
`blog.arcnode.xyz`	Arcnode Blog	Redirects to proxy login, validates ticket server-side

OIDC Clients #

ID	Name	Redirect URI
`bits-console`	BITS Backup Console	`bits-console.cloudforest-basilisk.ts.net/auth/callback`
`gitea`	Gitea/Forgejo	`gitea.cloudforest-basilisk.ts.net/user/oauth2/atauth/callback`
`audiobookshelf`	Audiobookshelf	`audiobookshelf.cloudforest-basilisk.ts.net/auth/openid/callback`
`mydrawings`	MyDrawings	`rock.workingtitle.zip/api/auth/atproto/callback`

Legacy HMAC Apps #

ID	Name	Callback URL
`mspdesk`	MSP-Desk	`tickets.brooksitservices.com/auth/callback`
`mdeditor`	Markdown Editor	`md.bkb.cx/api/auth/callback`

Critical Rules #

Never reroute apricot.workingtitle.zip — All apps depend on this single atauth instance. Rerouting the tunnel will break everything.
PDS nginx must set Sec-Fetch headers for /oauth/authorize — Cloudflare Tunnel strips browser security headers. Config at /pds/nginx/nginx.conf on pds-hetzner. Required headers:
```
proxy_set_header Sec-Fetch-Site "cross-site";
proxy_set_header Sec-Fetch-Mode "navigate";
proxy_set_header Sec-Fetch-Dest "document";
```
HMAC secrets are per-app — Each registered app has its own HMAC secret. Token verification uses createHmac('sha256', secretString) with UTF-8 encoding of the hex secret.
SQLite single-writer — Do NOT scale beyond 1 replica. PVC is RWO.

Cloudflare Tunnel Routes #

Tunnel: k3s-pds-tunnel (600f069c-4c53-4a59-b1fd-57c5ad09c044)

Hostname	Destination	Notes
`apricot.workingtitle.zip`	K8s service `atauth:3100`	Primary — DO NOT CHANGE

atauth.arcnode.xyz route and DNS CNAME removed 2026-03-01.

Kubectl Access #

# Save kubeconfig (shared separately, do not commit)
export KUBECONFIG=~/.kube/atauth-kubeconfig.yaml

# Note: TLS verify fails with DO CA cert, use --insecure-skip-tls-verify
kubectl --insecure-skip-tls-verify -n atauth get pods
kubectl --insecure-skip-tls-verify -n atauth logs deployment/atauth -f
kubectl --insecure-skip-tls-verify -n atauth rollout restart deployment/atauth

# Get admin token
kubectl --insecure-skip-tls-verify -n atauth get secret atauth-secrets \
  -o jsonpath='{.data.ATAUTH_ADMIN_TOKEN}' | base64 -d

See docs/DO-HANDOFF.md for full operations guide.

Cleanup TODO #

Fix Gitea CI pipeline — was not actually broken, stale note (verified 2026-03-01)
Remove stale atauth.arcnode.xyz Cloudflare tunnel route + DNS (done 2026-03-01)
Remove /opt/atauth/ directory and Docker volumes from pds-hetzner
Add /version endpoint to atauth for quick identification (done 2026-03-01, commit 28fd4cc)
Add uptime monitoring
Consolidate to single K8s atauth instance (done 2026-03-01)
Decommission PDS atauth sidecar (done 2026-03-01)
Fix PDS nginx Sec-Fetch headers (done 2026-03-01)
Remove stale app registrations from PDS instance (done 2026-03-01)