Files

kubernetes/apps/selfhosted/koment/app/httproute.yaml

1 ---

2 # yaml-language-server: $schema=https://k8s-schemas.home-operations.com/gateway.networking.k8s.io/httproute_v1.json

3 apiVersion: gateway.networking.k8s.io/v1

4 kind: HTTPRoute

5 metadata:

6 name: koment

7 spec:

8 hostnames:

9 - koment.janpuc.com

10 parentRefs:

11 - name: envoy-internal

12 namespace: network

13 rules:

14 - matches:

15 - headers:

16 - name: authorization

17 type: RegularExpression

18 value: "^Bearer\\s.+$"

19 backendRefs:

20 - name: koment

21 port: 8080

22 - filters:

23 - type: RequestHeaderModifier

24 requestHeaderModifier:

25 add:

26 - name: X-Forwarded-User

27 value: anonymous

28 - name: X-Forwarded-Email

29 value: anonymous@janpuc.com

30 backendRefs:

31 - name: koment

32 port: 8080

browser route resolves but denies; needs OIDC or a bearer token

gotcha ·ok L8

A browser hitting this host will be refused until something in front asserts an authenticated identity. koment serve requires auth on every source, rationale, UI and MCP route on a non-loopback listener; only /livez and /readyz are public.

It accepts a human identity solely from X-Forwarded-User / X-Forwarded-Email / X-Forwarded-Preferred-Username, and only when the request comes from a CIDR in auth.trustedProxies (set to the pod network so Envoy qualifies). This cluster has no SecurityPolicy or OIDC filter on Envoy Gateway today, so nothing sets those headers and the route resolves but denies.

Show the rest

Two ways to finish it: attach an Envoy Gateway SecurityPolicy with OIDC against pocket-id, or keep using it as a bearer-token endpoint — which is all hermes needs. The public read path is the GitHub Pages snapshot, which needs none of this.

2026-08-0401KZ6PHKE9NWF8C9WR50BJCKCN

bearer rule precedes fall-through or Hermes auth breaks silently

why ·ok L13

Two rules in declaration order. Rule 1 catches authenticated traffic by matching on the Authorization header and forwards it untouched so Hermes's bearer token reaches koment serve unmodified. Rule 2 covers everything else (anonymous browser reads) and injects X-Forwarded-User / X-Forwarded-Email so the trusted-proxy branch in internal/auth/auth.go accepts them as the `anonymous` principal.

Show the rest

The order is load-bearing. Authenticate() in internal/auth/auth.go checks X-Forwarded-User before Authorization, so a single rule that always injects X-Forwarded-User would short-circuit the bearer path and break Hermes. Comments check is Go-only and would not flag this drift; the anchor is.

2026-08-0401KZ6VYBS25S2JJZ9T42RD4HSY