iOS apps and Authentik¶

Status: OneUptime router split is in git. It goes live when Komodo procedure deploy-oneuptime recreates oneuptime-ingress. Komodo Go still needs an API key; that app has no code change.

Komodo Go and OneUptime On-Call were both stopping with Authentik in the path, for different reasons. Komodo’s router has no forward-auth. OneUptime’s browser router still uses it. /api and /identity do not.

Parent: ADR-002.

What each app actually does¶

flowchart TD
  subgraph komodoApp [Komodo Go]
    K1[API key and secret] --> K2["POST /read and /execute"]
    K2 --> K3[komodo-core JSON]
  end
  subgraph oneApp [OneUptime On-Call]
    O1["GET /api/status and POST /identity/login"] --> O2[oneuptime-api router]
    O2 --> O3[OneUptime JSON and bearer tokens]
    O4[Browser pages] --> O5[authentik@file]
  end

OneUptime On-Call¶

The App Store app is a native client. It does not share Safari’s Authentik cookie.

Step	Request	What the app needs
Server check	`GET /api/status`	HTTP 200
Password login	`POST /identity/login` and `/identity/verify-*`	JSON session tokens
After login	`POST /api/...` with `Authorization: Bearer`	JSON
SSO button	system auth sheet to `/identity/...?...mobile=true`	final redirect `oneuptime://sso-callback`

Before the split, oneuptime-ingress had one Traefik router with authentik@file on the whole host. The app’s HTTP client followed that redirect and received the login HTML. GET /api/status could still look successful when the login page returned HTTP 200, and the sign-in call never got a token. The SSO sheet had the same first hop: forward-auth ran before OneUptime could record the mobile login and redirect to oneuptime://sso-callback.

services/oneuptime/compose.yml now keeps authentik@file on router oneuptime (priority 10) and sends /api and /identity to router oneuptime-api (priority 100) with no Authentik middleware.

Community Edition on this stack uses OneUptime local accounts. The service README keeps IS_ENTERPRISE_EDITION off. The app’s SSO button only works after a Global OIDC provider exists inside OneUptime. That provider is not configured here. Password login is the path that should work.

Browser users still have two layers on purpose: Authentik at the edge, then OneUptime’s own login. See services/oneuptime/README.md.

Komodo Go¶

Komodo Go is a third-party client. It stores an API key and API secret and calls POST /read and POST /execute with X-Api-Key and X-Api-Secret. It has no Authentik or OIDC login.

The Komodo router is already correct for that client: native OIDC, no authentik@file. See komodo-authentik-oidc.md.

The app’s advanced “proxy authentication” fields send HTTP Basic. Authentik forward-auth does not accept that header. Komodo Go treats an HTML login page as a failed connection, and it treats a forwarded Authorization header as a bad Komodo JWT.

If the stuck screen is Safari or a Home Screen icon for https://komodo.infra.realemail.app, that is the website. KOMODO_OIDC_AUTO_REDIRECT=true sends the browser straight to auth.realemail.app. iOS Home Screen web apps keep a separate cookie jar from Safari, so the bounce between auth.realemail.app and komodo.infra.realemail.app can sit on Authentik or loop after a successful password. A WebAuthn or passkey stage on the default Authentik authentication flow does the same on iPhone: the sheet never advances.

OneUptime router split¶

The labels on oneuptime-ingress follow the ARA pattern (services/ara/compose.yml): priority 10 on the host router with authentik@file, and priority 100 on /api and /identity with no middleware. ARA can IP-allowlist /api/ because only lab hosts call it. Phones are not a fixed source, so this API router relies on OneUptime’s own bearer tokens.

Dashboard, account, and status-page HTML stay on the priority-10 router. /identity/login and /api are reachable without an Authentik cookie. OneUptime still requires its own credentials. tests/test_oneuptime_stack.py covers both routers.

OneUptime is excluded from general deploy-infra, which uses explicit confirmed dispatch. After this change is on main, run Komodo procedure deploy-oneuptime so Traefik reloads the ingress labels.

After that deploy, from a client that has no Authentik cookie:

curl -sI https://oneuptime.infra.realemail.app/ | head -n 15
curl -sI https://oneuptime.infra.realemail.app/api/status | head -n 15

The first command should redirect into the outpost. The second should be HTTP 200 with no authentik redirect. Repeat the status URL without -I and confirm the body is JSON. Then in the app: set the server URL to https://oneuptime.infra.realemail.app, sign in with the OneUptime email and password, and confirm incidents load.

Komodo Go — API key from an enabled OIDC user¶

In a desktop browser, open https://komodo.infra.realemail.app and finish Authentik. The OIDC user must already be enabled in Komodo.
In Komodo, create an API key and secret under the user settings.
In Komodo Go, set the server URL to https://komodo.infra.realemail.app and paste the key and secret.
Leave proxy authentication off.

If Komodo Go reports a login page or a redirect on /read or /execute, the live router has authentik@file even though git does not. Remove it and recreate komodo-core. The check is in komodo-authentik-oidc.md.

Komodo in Safari on iPhone¶

Use Safari itself for the first login. A Home Screen web app will not reuse Safari’s Authentik cookies.

On the Komodo OIDC provider in Authentik:

Authorization flow: implicit consent, so iOS is not left on an extra consent page.
Redirect URI, strict: https://komodo.infra.realemail.app/auth/oidc/callback.
Encryption key empty.
Prefer a password stage when the default flow’s passkey stage never finishes on that phone.

Break-glass for a stuck auto-redirect is already in the Komodo runbook: KOMODO_LOCAL_AUTH=true and https://komodo.infra.realemail.app/login?disableAutoLogin.

Later, only if the OneUptime SSO button is required¶

/identity is already off the Authentik middleware. Add a dedicated Authentik OAuth2/OIDC provider for OneUptime. Its redirect URI is the HTTPS callback OneUptime shows in Global OIDC (https://oneuptime.infra.realemail.app/identity/global-oidc-callback/<id>). The app then finishes on oneuptime://sso-callback. That provider is separate from the domain forward-auth provider. Turning on IS_ENTERPRISE_EDITION still needs a license and a tested migration.

Leave unchanged¶

Komodo stays on native OIDC with no authentik@file.
Komodo Go’s Basic proxy fields stay empty.
Browser pages on oneuptime.infra.realemail.app stay on authentik@file.