frank/App-Idea-Hunter
1
1
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Deploy to hookhouse-pro as ideahunter.fmrdigital.dev with Authentik SSO #1

New issue
Closed
opened 2026-07-12 23:25:39 +00:00 by frank · 1 comment
frank commented 2026-07-12 23:25:39 +00:00
Owner
Copy link

Goal

Deploy App Idea Hunter to production on hookhouse-pro (100.123.113.16) at ideahunter.fmrdigital.dev, gated by Authentik SSO.

See decision record: decisions/2026-07-12-ideahunter-auth-architecture.md in this repo for the full architecture rationale.

Plan

  • Add a minimal backend proxy (Node/Express) so GEMINI_API_KEY never ships in the client bundle; frontend calls the proxy instead of the Gemini SDK directly
  • Create Infisical project + machine identity for this app; store GEMINI_API_KEY there
  • Dockerize (small compose: static build + proxy, or single Node server serving both)
  • /opt/ideahunter/ on hookhouse-pro, one-app-per-dir convention
  • Caddy block on hookhouse-pro: ideahunter.fmrdigital.dev, TLS via existing Cloudflare Origin CA snippet, forward_auth to http://100.119.88.80:9000 (fmrdigital Authentik, reachable over Tailscale)
  • New Authentik Proxy Provider + outpost + Application entry for ideahunter (same recipe as equityintel/gatus/mind-melder)
  • Add ideahunter.fmrdigital.dev DNS record in Cloudflare (orange-cloud, matching sibling fmrdigital.dev subdomains)
  • Verify end-to-end: SSO gate blocks unauthenticated access, authenticated flow generates ideas, API key never appears in client bundle/network tab

Notes

  • Confirmed via recon (2026-07-12): hookhouse-pro can reach fmrdigital Authentik directly over Tailscale (port 9000 bound to Tailscale IP), bypassing Cloudflare � no need to co-locate Authentik with the app.
  • Not using app-level OIDC (PromptHouse pattern) � forward-auth only, no app code changes needed for the auth gate itself.
## Goal Deploy App Idea Hunter to production on hookhouse-pro (100.123.113.16) at `ideahunter.fmrdigital.dev`, gated by Authentik SSO. See decision record: `decisions/2026-07-12-ideahunter-auth-architecture.md` in this repo for the full architecture rationale. ## Plan - [ ] Add a minimal backend proxy (Node/Express) so GEMINI_API_KEY never ships in the client bundle; frontend calls the proxy instead of the Gemini SDK directly - [ ] Create Infisical project + machine identity for this app; store GEMINI_API_KEY there - [ ] Dockerize (small compose: static build + proxy, or single Node server serving both) - [ ] `/opt/ideahunter/` on hookhouse-pro, one-app-per-dir convention - [ ] Caddy block on hookhouse-pro: `ideahunter.fmrdigital.dev`, TLS via existing Cloudflare Origin CA snippet, `forward_auth` to `http://100.119.88.80:9000` (fmrdigital Authentik, reachable over Tailscale) - [ ] New Authentik Proxy Provider + outpost + Application entry for ideahunter (same recipe as equityintel/gatus/mind-melder) - [ ] Add `ideahunter.fmrdigital.dev` DNS record in Cloudflare (orange-cloud, matching sibling fmrdigital.dev subdomains) - [ ] Verify end-to-end: SSO gate blocks unauthenticated access, authenticated flow generates ideas, API key never appears in client bundle/network tab ## Notes - Confirmed via recon (2026-07-12): hookhouse-pro can reach fmrdigital Authentik directly over Tailscale (port 9000 bound to Tailscale IP), bypassing Cloudflare � no need to co-locate Authentik with the app. - Not using app-level OIDC (PromptHouse pattern) � forward-auth only, no app code changes needed for the auth gate itself.
frank commented 2026-07-13 03:08:36 +00:00
Author
Owner
Copy link

Deployed. https://ideahunter.fmrdigital.dev is live, gated by Authentik SSO (forward-auth over Tailscale to fmrdigital's Authentik). GEMINI_API_KEY moved server-side (server/index.js), sourced from Infisical, confirmed absent from the deployed client bundle. Full checklist completed:

  • Backend proxy for GEMINI_API_KEY
  • Infisical project + machine identity (used pre-existing "Idea Hunter" project)
  • Dockerized (Dockerfile + docker-compose.yml)
  • /opt/ideahunter/ on hookhouse-pro
  • Caddy block with forward_auth to fmrdigital Authentik (100.119.88.80:9000)
  • Authentik Proxy Provider + Application + outpost assignment
  • DNS record (added by user directly in Cloudflare)
  • End-to-end verification: SSO gate, real Gemini generation, key-absence check

Bonus fix found during verification: Cloudflare replaces 502/503/504 response bodies with its own HTML page, which broke client-side JSON parsing on Gemini transient errors. Proxy now always returns 200 with an error field instead (commit b5db56f).

See decisions/2026-07-12-ideahunter-auth-architecture.md and .ai/AUTONOMOUS_CHANGELOG.md for full detail. Related: #2 (secret rotation, still open).

Deployed. https://ideahunter.fmrdigital.dev is live, gated by Authentik SSO (forward-auth over Tailscale to fmrdigital's Authentik). GEMINI_API_KEY moved server-side (server/index.js), sourced from Infisical, confirmed absent from the deployed client bundle. Full checklist completed: - [x] Backend proxy for GEMINI_API_KEY - [x] Infisical project + machine identity (used pre-existing "Idea Hunter" project) - [x] Dockerized (Dockerfile + docker-compose.yml) - [x] /opt/ideahunter/ on hookhouse-pro - [x] Caddy block with forward_auth to fmrdigital Authentik (100.119.88.80:9000) - [x] Authentik Proxy Provider + Application + outpost assignment - [x] DNS record (added by user directly in Cloudflare) - [x] End-to-end verification: SSO gate, real Gemini generation, key-absence check Bonus fix found during verification: Cloudflare replaces 502/503/504 response bodies with its own HTML page, which broke client-side JSON parsing on Gemini transient errors. Proxy now always returns 200 with an `error` field instead (commit b5db56f). See decisions/2026-07-12-ideahunter-auth-architecture.md and .ai/AUTONOMOUS_CHANGELOG.md for full detail. Related: #2 (secret rotation, still open).
frank closed this issue 2026-07-13 03:08:36 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
bug

   
documentation

   
enhancement

   
infra

   
integration

   
priority:high

   
priority:low

   
priority:medium

   
research

   
security

   
tech-debt

   
ux
No labels
bug
documentation
enhancement
infra
integration
priority:high
priority:low
priority:medium
research
security
tech-debt
ux
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
frank/App-Idea-Hunter#1
No description provided.