Its configuration was read from the running process yesterday: the
homeserver by internal service name, Authentik by its public name. Public
names resolve to the node address, and traffic there is not subject to the
policy at all - so the upstream path survives the restriction while
everything else goes.
Held back until now on purpose, because a mistake here hits sign-in and the
analysis alone is not an acceptance. The owner is testing a login against
this change; if it fails, the revert is one commit and about a minute,
rehearsed in wave 1.
Congruence rechecked: twenty-one excluded, the same twenty-one narrowly
ruled.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F2Q4Ri8NGwyTZzScvKnWFM
Thore CimbalandClaude Opus 5
90a89f338a