Three corrections to questions I should not have asked again.
#0103 is implemented: autoEnrollGroups points at wiki-anwender, verified in the live
database rather than from the job log. The decision was already in #0049 - the role
model was built, only the way in was missing.
#0102's blocker was in the documentation all along: maintenance-notify sends under
.de, not .chat, via IONOS on 587. The MAIL_FROM in config.example is an example, not
the operating state. So hardening .chat cannot break maintenance mail, and Authentik
remains its only .chat sender - DKIM-covered.
#0008 is not resolved by the console screenshots: they show fw-matrix-cx42, the
Matrix host, while the issue asks which rule keeps 9090 and 3100 shut on CFGMON.
Still open. What they did show is worth keeping: SSH and the Kubernetes API are
properly source-restricted, and several rules open ports to everyone where nothing
listens - including an inbound smtp 587 that cannot help the outbound sending it was
presumably added for.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Decision sorb. elbojoloco joins apo in wiki-anwender, so both read /anwender and
the start page while betrieb/* stays closed. Recorded because the addendum's table
would otherwise still list the account as having no effect.
The grant takes hold at the next login - the groups claim is minted during sign-in,
not continuously - and elbojoloco has never signed in to the wiki, so the account
gets created and mapped on first attempt.
Boje is still undecided, and clark and lucky remain test accounts slated for
deletion in #0074. The silent dead end persists for them, which is why the grants
do not close this issue.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
apo reads the wiki now. Checking every other configured user turned up the bigger
finding: Authentik has a group wiki-zugang with four members, and Wiki.js does not
honour it. Groups map by name, and the wiki only knows wiki-anwender and authentik
Admins - so elbojoloco, clark and Boje hold membership that does nothing, while the
name promises the opposite. Nobody noticed because none of them ever attempted a
login; Wiki.js has exactly two OIDC users.
The reason is a leftover: two Authentik applications share the display name
"ThreadNet Wiki". The one carrying the wiki-zugang policy has no provider at all -
an empty shell from the Docusaurus forward-auth era that ADR-0014 retired. The live
wiki-js application carries no policy binding, so it is open to any authenticated
user and the whole separation rests on a group assignment nobody looks for there.
So the trap cuts both ways: granting wiki-zugang grants nothing, and the real
application is ungated at its own layer. Acceptance now also covers retiring the
dead shell, resolving wiki-zugang, and the two empty leftover groups.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Decision sorb, after diagnosing why @apo could not reach the wiki. apo logs in
fine; the account exists since 2026-08-16 and was used again today. It is in no
group, and wiki-anwender has zero members, so the wiki is effectively admin-only
and every non-admin who ever tried met the same wall.
Three deliberate settings compose into a dead end: OIDC self-registration creates
the account, autoEnrollGroups is empty so it gets no group, and Guests was stripped
to no permissions while the only rule for home belongs to wiki-anwender. Default
deny then applies to every path including the start page - the user sees nothing
rather than a reason, and at the current log level nothing records the attempt
either. Same class as the mrtc outage: healthy, green, unusable, silent.
The issue asks for a decision rather than assuming one: auto-enroll into
wiki-anwender (the population is already curated by the invitation token, and
betrieb/* stays admin-only through default deny), or keep per-person curation and
make the dead end speak. Acceptance is a real login, not a config diff.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Thore CimbalandClaude Opus 5