Thore Cimbal
e0db79a3f1
Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s
Ingress-only default-deny (egress untouched) plus explicit allows: Traefik (kube-system) + MAS (matrix ns) -> authentik-server on 80/443, and Traefik -> cert-manager's ACME HTTP-01 solver pods on 8089. authentik-postgresql already has its own Bitnami-chart-managed policy, left alone. Part of issue #10.