fix(auth): harden public infra routes

fix(auth): mark OIDC healthz probes anonymous
fix(monitoring): probe OIDC-safe health routes
2026-06-04 13:20:16 -05:00 · 2026-06-04 11:03:20 -05:00 · 2026-06-04 06:45:34 +00:00 · 2026-06-04 06:20:09 +00:00 · 2026-06-04 01:19:16 -05:00 · 2026-06-04 06:05:15 +00:00
22 changed files with 1285 additions and 35 deletions
--- a/apps/andrew/andrew.yaml
+++ b/apps/andrew/andrew.yaml
@@ -201,6 +201,8 @@ spec:
    metadata:
      labels:
        app: andrew-web
+      annotations:
+        flowercore.io/healthz-auth-policy: "allow-anonymous"
    spec:
      containers:
        - name: nginx
@@ -225,12 +227,18 @@ spec:
            httpGet:
              path: /healthz
              port: 80
+              httpHeaders:
+                - name: X-Forwarded-Proto
+                  value: https
            initialDelaySeconds: 5
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /healthz
              port: 80
+              httpHeaders:
+                - name: X-Forwarded-Proto
+                  value: https
            initialDelaySeconds: 3
            periodSeconds: 5
      volumes:
@@ -265,7 +273,7 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: Host(`bluejay.dev`) || Host(`www.bluejay.dev`)
+    - match: (Host(`bluejay.dev`) || Host(`www.bluejay.dev`)) && (Method(`GET`) || Method(`HEAD`))
      kind: Rule
      services:
        - name: andrew-web
--- a/apps/dustin/dustin.yaml
+++ b/apps/dustin/dustin.yaml
@@ -201,6 +201,8 @@ spec:
    metadata:
      labels:
        app: dustin-web
+      annotations:
+        flowercore.io/healthz-auth-policy: "allow-anonymous"
    spec:
      containers:
        - name: nginx
@@ -225,12 +227,18 @@ spec:
            httpGet:
              path: /healthz
              port: 80
+              httpHeaders:
+                - name: X-Forwarded-Proto
+                  value: https
            initialDelaySeconds: 5
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /healthz
              port: 80
+              httpHeaders:
+                - name: X-Forwarded-Proto
+                  value: https
            initialDelaySeconds: 3
            periodSeconds: 5
      volumes:
@@ -265,7 +273,7 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: Host(`timeforta.co`) || Host(`www.timeforta.co`)
+    - match: (Host(`timeforta.co`) || Host(`www.timeforta.co`)) && (Method(`GET`) || Method(`HEAD`))
      kind: Rule
      services:
        - name: dustin-web
--- a/apps/erik/erik.yaml
+++ b/apps/erik/erik.yaml
@@ -201,6 +201,8 @@ spec:
    metadata:
      labels:
        app: erik-web
+      annotations:
+        flowercore.io/healthz-auth-policy: "allow-anonymous"
    spec:
      containers:
        - name: nginx
@@ -225,12 +227,18 @@ spec:
            httpGet:
              path: /healthz
              port: 80
+              httpHeaders:
+                - name: X-Forwarded-Proto
+                  value: https
            initialDelaySeconds: 5
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /healthz
              port: 80
+              httpHeaders:
+                - name: X-Forwarded-Proto
+                  value: https
            initialDelaySeconds: 3
            periodSeconds: 5
      volumes:
@@ -265,7 +273,7 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: Host(`erckak.dev`) || Host(`www.erckak.dev`)
+    - match: (Host(`erckak.dev`) || Host(`www.erckak.dev`)) && (Method(`GET`) || Method(`HEAD`))
      kind: Rule
      services:
        - name: erik-web
--- a/apps/fc-distribution/fc-distribution.yaml
+++ b/apps/fc-distribution/fc-distribution.yaml
@@ -74,6 +74,14 @@ metadata:
 spec:
  itemPath: "vaults/IAmWorkin/items/FlowerCore Edition Signing Key - edition:aistation-field"
 ---
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: distribution-oidc-client
+  namespace: fc-distribution
+spec:
+  itemPath: "vaults/IAmWorkin/items/distribution-oidc-client"
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -101,6 +109,7 @@ spec:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8080"
        prometheus.io/path: "/metrics"
+        flowercore.io/healthz-auth-policy: "allow-anonymous"
    spec:
      # Synology NFS export `/volume1/kubernetes` ACL only allows rke2-server
      # (10.0.56.11) right now. Until the ACL is widened in DSM (admin only),
@@ -118,7 +127,7 @@ spec:
          #   dotnet.exe publish -c Release -o deploy/app \
          #     src/FlowerCore.Distribution.Web/FlowerCore.Distribution.Web.csproj
          #   podman build -t localhost/fc-distribution:v<tag> -f deploy/Dockerfile.deploy deploy
-          image: localhost/fc-distribution:v202605061948
+          image: localhost/fc-distribution:v20260604-oidc-root-anon
          imagePullPolicy: Never
          ports:
            - containerPort: 8080
@@ -130,6 +139,25 @@ spec:
              value: "Production"
            - name: DOTNET_SYSTEM_GLOBALIZATION_INVARIANT
              value: "false"
+            # Authentik/OIDC enforcement. Public read/entitlement + the
+            # dist.flowercore.io Method() allowlist stay open; OIDC gates the
+            # operator/admin surface while /healthz remains anonymous.
+            - name: FlowerCore__Auth__Enabled
+              value: "true"
+            - name: FlowerCore__Auth__Oidc__Enabled
+              value: "true"
+            - name: FlowerCore__Auth__Oidc__Authority
+              value: "https://id.iamworkin.lan/application/o/distribution/"
+            - name: FlowerCore__Auth__Oidc__Audience
+              value: "distribution"
+            - name: FlowerCore__Auth__Oidc__ClientId
+              value: "distribution"
+            - name: FlowerCore__Auth__Oidc__ClientSecret
+              valueFrom:
+                secretKeyRef:
+                  name: distribution-oidc-client
+                  key: client_secret
+                  optional: true
            # SQLite connection (catalog + data-protection keys via FlowerCoreDbContext).
            # Read by Data/DatabaseProviderExtensions.cs in precedence order; Sqlite key wins.
            - name: FlowerCore__Database__Provider
--- a/apps/fc-dns/fc-dns.yaml
+++ b/apps/fc-dns/fc-dns.yaml
@@ -0,0 +1,481 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: fc-dns
+  labels:
+    app.kubernetes.io/part-of: flowercore
+---
+# 1Password-backed Secret for the pfSense admin password.
+# The operator watches this CRD, resolves the vault item, and produces a
+# K8s Secret of the same name with each 1P field as a key. The `password`
+# field of the "pfSense Admin" item becomes Secret key `password`.
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: pfsense-admin
+  namespace: fc-dns
+spec:
+  itemPath: "vaults/IAmWorkin/items/pfSense Admin"
+---
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: dns-oidc-client
+  namespace: fc-dns
+spec:
+  itemPath: "vaults/IAmWorkin/items/dns-oidc-client"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: dns-web-data
+  namespace: fc-dns
+spec:
+  accessModes: [ReadWriteOnce]
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: dns-web-config
+  namespace: fc-dns
+data:
+  appsettings.Production.json: |
+    {
+        "FlowerCore": {
+        "Auth": {
+          "Enabled": true,
+          "Oidc": {
+            "Enabled": true,
+            "Audience": "dns",
+            "RequireHttpsMetadata": true
+          }
+        },
+        "Database": {
+          "Provider": "Sqlite",
+          "ConnectionStrings": {
+            "Sqlite": "Data Source=/data/dns.db"
+          }
+        },
+        "Tenant": {
+          "DefaultTenantId": "default",
+          "JwtClaimsEnabled": false,
+          "DefaultTenantHosts": [
+            "dns.iamworkin.lan"
+          ]
+        },
+        "Audit": {
+          "HashChain": {
+            "BridgeSensitivity": {
+              "Distribution": "Warn"
+            }
+          }
+        }
+      }
+    }
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dns-web
+  namespace: fc-dns
+  labels:
+    app.kubernetes.io/name: dns-web
+    app.kubernetes.io/managed-by: flowercore
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: dns-web
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: dns-web
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "5320"
+        prometheus.io/path: "/metrics/prometheus"
+        flowercore.io/healthz-auth-policy: "allow-anonymous"
+    spec:
+      serviceAccountName: dns-web
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1654
+        runAsGroup: 1654
+        fsGroup: 1654
+      containers:
+        - name: dns-web
+          image: localhost/fc-dns-web:v20260604-oidc-proper
+          imagePullPolicy: Never
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+          ports:
+            - containerPort: 5320
+          env:
+            # pfSense admin password resolved by the 1Password operator.
+            # `FallbackPassword` is the Slice A seam exposed by
+            # OptionsFallbackPasswordResolver; Slice B will replace it with
+            # a pull-at-runtime 1P Connect resolver once Shared.Vault ships.
+            - name: FlowerCore__Dns__Providers__PfSenseUnbound__FallbackPassword
+              valueFrom:
+                secretKeyRef:
+                  name: pfsense-admin
+                  key: password
+            - name: FlowerCore__Auth__Oidc__Authority
+              valueFrom:
+                secretKeyRef:
+                  name: dns-oidc-client
+                  key: issuer_url
+                  optional: true
+            - name: FlowerCore__Auth__Oidc__ClientId
+              valueFrom:
+                secretKeyRef:
+                  name: dns-oidc-client
+                  key: client_id
+                  optional: true
+            - name: FlowerCore__Auth__Oidc__ClientSecret
+              valueFrom:
+                secretKeyRef:
+                  name: dns-oidc-client
+                  key: client_secret
+                  optional: true
+            - name: FlowerCore__Auth__Enabled
+              value: "true"
+            - name: FlowerCore__Auth__Oidc__Enabled
+              value: "true"
+            - name: FlowerCore__Auth__Oidc__Audience
+              value: "dns"
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: tmp
+              mountPath: /tmp
+            - name: logs
+              mountPath: /app/logs
+            - name: config
+              mountPath: /app/appsettings.Production.json
+              subPath: appsettings.Production.json
+              readOnly: true
+          resources:
+            requests:
+              cpu: 50m
+              memory: 96Mi
+            limits:
+              cpu: 300m
+              memory: 384Mi
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: 5320
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 5320
+            initialDelaySeconds: 20
+            periodSeconds: 30
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: dns-web-data
+        - name: tmp
+          emptyDir: {}
+        - name: logs
+          emptyDir: {}
+        - name: config
+          configMap:
+            name: dns-web-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dns-web
+  namespace: fc-dns
+spec:
+  selector:
+    app.kubernetes.io/name: dns-web
+  ports:
+    - port: 5320
+      targetPort: 5320
+  type: ClusterIP
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: dns-web
+  namespace: fc-dns
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: dns-web
+rules:
+  - apiGroups: [""]
+    resources: ["namespaces", "pods", "services", "secrets", "configmaps"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["cert-manager.io"]
+    resources: ["certificates"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: dns-web
+subjects:
+  - kind: ServiceAccount
+    name: dns-web
+    namespace: fc-dns
+roleRef:
+  kind: ClusterRole
+  name: dns-web
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: dns-web-cert
+  namespace: fc-dns
+spec:
+  secretName: dns-web-tls
+  issuerRef:
+    name: step-ca-dns01
+    kind: ClusterIssuer
+  dnsNames:
+    - dns.iamworkin.lan
+  duration: 720h
+  renewBefore: 240h
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: dns-web
+  namespace: fc-dns
+spec:
+  entryPoints: [websecure]
+  routes:
+    - match: Host(`dns.iamworkin.lan`)
+      kind: Rule
+      services:
+        - name: dns-web
+          port: 5320
+  tls:
+    secretName: dns-web-tls
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: dns-acme-webhook
+  namespace: fc-dns
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dns-acme-webhook
+  namespace: fc-dns
+  labels:
+    app.kubernetes.io/name: dns-acme-webhook
+    app.kubernetes.io/managed-by: flowercore
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: dns-acme-webhook
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: dns-acme-webhook
+    spec:
+      serviceAccountName: dns-acme-webhook
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1654
+        runAsGroup: 1654
+        fsGroup: 1654
+      containers:
+        - name: dns-acme-webhook
+          image: localhost/fc-dns-acme-webhook:v202604290845
+          imagePullPolicy: Never
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+          ports:
+            - containerPort: 9443
+              name: https
+          env:
+            - name: ASPNETCORE_URLS
+              value: https://+:9443
+            - name: Kestrel__Certificates__Default__Path
+              value: /tls/tls.crt
+            - name: Kestrel__Certificates__Default__KeyPath
+              value: /tls/tls.key
+            - name: FlowerCore__Dns__AcmeWebhook__ServiceBaseUrl
+              value: http://dns-web:5320
+            - name: FlowerCore__Dns__AcmeWebhook__GroupName
+              value: acme.flowercore.io
+            - name: FlowerCore__Dns__AcmeWebhook__SolverName
+              value: flowercore-dns
+            - name: FlowerCore__Dns__AcmeWebhook__Version
+              value: v1alpha1
+          volumeMounts:
+            - name: tls
+              mountPath: /tls
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+            - name: logs
+              mountPath: /app/logs
+          resources:
+            requests:
+              cpu: 25m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 256Mi
+          readinessProbe:
+            httpGet:
+              scheme: HTTPS
+              path: /readyz
+              port: https
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+          livenessProbe:
+            httpGet:
+              scheme: HTTPS
+              path: /healthz
+              port: https
+            initialDelaySeconds: 10
+            periodSeconds: 20
+            timeoutSeconds: 5
+      volumes:
+        - name: tls
+          secret:
+            secretName: dns-acme-webhook-tls
+        - name: tmp
+          emptyDir: {}
+        - name: logs
+          emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dns-acme-webhook
+  namespace: fc-dns
+spec:
+  selector:
+    app.kubernetes.io/name: dns-acme-webhook
+  ports:
+    - port: 443
+      targetPort: https
+      name: https
+  type: ClusterIP
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: dns-acme-webhook-selfsigned
+  namespace: fc-dns
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: dns-acme-webhook-ca
+  namespace: fc-dns
+spec:
+  secretName: dns-acme-webhook-ca
+  duration: 43800h
+  issuerRef:
+    name: dns-acme-webhook-selfsigned
+  commonName: ca.dns-acme-webhook.fc-dns
+  isCA: true
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: dns-acme-webhook-ca-issuer
+  namespace: fc-dns
+spec:
+  ca:
+    secretName: dns-acme-webhook-ca
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: dns-acme-webhook-serving-cert
+  namespace: fc-dns
+spec:
+  secretName: dns-acme-webhook-tls
+  duration: 8760h
+  issuerRef:
+    name: dns-acme-webhook-ca-issuer
+  dnsNames:
+    - dns-acme-webhook
+    - dns-acme-webhook.fc-dns
+    - dns-acme-webhook.fc-dns.svc
+---
+apiVersion: apiregistration.k8s.io/v1
+kind: APIService
+metadata:
+  name: v1alpha1.acme.flowercore.io
+  annotations:
+    cert-manager.io/inject-ca-from: fc-dns/dns-acme-webhook-serving-cert
+spec:
+  group: acme.flowercore.io
+  groupPriorityMinimum: 1000
+  service:
+    name: dns-acme-webhook
+    namespace: fc-dns
+  version: v1alpha1
+  versionPriority: 15
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: dns-acme-webhook-solver
+rules:
+  - apiGroups: ["acme.flowercore.io"]
+    resources: ["flowercore-dns"]
+    verbs: ["create"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: dns-acme-webhook-solver
+subjects:
+  - kind: ServiceAccount
+    name: cert-manager
+    namespace: cert-manager
+roleRef:
+  kind: ClusterRole
+  name: dns-acme-webhook-solver
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: step-ca-dns01
+spec:
+  acme:
+    caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJ4RENDQVdxZ0F3SUJBZ0lSQVBZMzU3RzZvdzZ6TUFMNSs0YlMya2t3Q2dZSUtvWkl6ajBFQXdJd1FERWEKTUJnR0ExVUVDaE1SU1VGdFYyOXlhMmx1SUVGRFRVVWdRMEV4SWpBZ0JnTlZCQU1UR1VsQmJWZHZjbXRwYmlCQgpRMDFGSUVOQklGSnZiM1FnUTBFd0hoY05Nall3TXpBNE1UZ3dOekV4V2hjTk16WXdNekExTVRnd056RXhXakJBCk1Sb3dHQVlEVlFRS0V4RkpRVzFYYjNKcmFXNGdRVU5OUlNCRFFURWlNQ0FHQTFVRUF4TVpTVUZ0VjI5eWEybHUKSUVGRFRVVWdRMEVnVW05dmRDQkRRVEJaTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCSjJuMDRYMQpKWm81WmRxL2kxSWR2OCtmcXdaeUF6Qmg3d2hicWowU1dzSkw4VVdSYWJDTXFZQ3M3K2RYTzB4UlN6cWt3RkRMCngrdm9vT2FpOFJnUk5oYWpSVEJETUE0R0ExVWREd0VCL3dRRUF3SUJCakFTQmdOVkhSTUJBZjhFQ0RBR0FRSC8KQWdFQk1CMEdBMVVkRGdRV0JCUm51UFBRUjZpTS9INnZPbHVpVTNTeWdheXo4akFLQmdncWhrak9QUVFEQWdOSQpBREJGQWlFQXJRSzlkWVBHbUFac2RZbmp6aXVGVlZFNU5LWlVjY2VZdkdmR0MrdExYVXNDSUF1ZEYyekpyQ1JxCjNtSzUwWlpFVC9md1RrSndpRUY0ODI0bWpQOHAxQ0tNCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+    privateKeySecretRef:
+      name: step-ca-dns01-account-key
+    server: https://10.0.56.10:9443/acme/acme/directory
+    solvers:
+      - dns01:
+          webhook:
+            groupName: acme.flowercore.io
+            solverName: flowercore-dns
--- a/apps/fc-dns/kustomization.yaml
+++ b/apps/fc-dns/kustomization.yaml
@@ -0,0 +1,6 @@
+# ArgoCD's bluejay-infra ApplicationSet discovers apps/* directories on main.
+# The kustomization is included for local previews and single-app validation.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - fc-dns.yaml
--- a/apps/fc-landing/fc-landing.yaml
+++ b/apps/fc-landing/fc-landing.yaml
@@ -203,6 +203,8 @@ spec:
    metadata:
      labels:
        app: fc-landing
+      annotations:
+        flowercore.io/healthz-auth-policy: "allow-anonymous"
    spec:
      containers:
        - name: nginx
@@ -227,12 +229,18 @@ spec:
            httpGet:
              path: /healthz
              port: 80
+              httpHeaders:
+                - name: X-Forwarded-Proto
+                  value: https
            initialDelaySeconds: 5
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /healthz
              port: 80
+              httpHeaders:
+                - name: X-Forwarded-Proto
+                  value: https
            initialDelaySeconds: 3
            periodSeconds: 5
      volumes:
@@ -298,7 +306,7 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: Host(`flowercore.io`) || Host(`www.flowercore.io`)
+    - match: (Host(`flowercore.io`) || Host(`www.flowercore.io`)) && (Method(`GET`) || Method(`HEAD`))
      kind: Rule
      services:
        - name: fc-landing
@@ -316,7 +324,7 @@ spec:
  entryPoints:
    - web
  routes:
-    - match: Host(`flowercore.io`) || Host(`www.flowercore.io`)
+    - match: (Host(`flowercore.io`) || Host(`www.flowercore.io`)) && (Method(`GET`) || Method(`HEAD`))
      kind: Rule
      services:
        - name: fc-landing
--- a/apps/fc-media/fc-media.yaml
+++ b/apps/fc-media/fc-media.yaml
@@ -0,0 +1,296 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: fc-media
+  labels:
+    app.kubernetes.io/name: fc-media
+    app.kubernetes.io/part-of: flowercore
+---
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: media-oidc-client
+  namespace: fc-media
+  labels:
+    app.kubernetes.io/name: fc-media-web
+    app.kubernetes.io/part-of: flowercore
+spec:
+  itemPath: "vaults/IAmWorkin/items/media-oidc-client"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: fc-media-config
+  namespace: fc-media
+  labels:
+    app.kubernetes.io/name: fc-media-web
+    app.kubernetes.io/part-of: flowercore
+data:
+  appsettings.Production.json: |
+    {
+      "DatabaseProvider": "Sqlite",
+      "ConnectionStrings": {
+        "Sqlite": "Data Source=/data/media.db"
+      },
+      "FlowerCore": {
+        "Auth": {
+          "Enabled": true,
+          "Oidc": {
+            "Authority": "https://id.iamworkin.lan/application/o/media/",
+            "ClientId": "media",
+            "ClientSecret": "",
+            "Audience": "media",
+            "RequireHttpsMetadata": true
+          }
+        },
+        "Tenant": {
+          "JwtClaimsEnabled": false,
+          "DefaultTenantHosts": [ "media.iamworkin.lan" ]
+        }
+      },
+      "Media": {
+        "LibraryRoot": "/media/library",
+        "Sources": [
+          {
+            "Name": "BlueJayNAS Video",
+            "Driver": "Nfs",
+            "MountedPath": "/media/library",
+            "RemotePath": "nfs://10.0.58.3/volume1/video",
+            "IsEnabled": true,
+            "IsDefault": true,
+            "Notes": "Synology NFS media share mounted read-only inside the cluster."
+          }
+        ],
+        "GeneratedRoot": "/data/generated",
+        "TranscodeRoot": "/data/transcodes",
+        "InboxPath": "/media/inbox",
+        "InboxScanIntervalMinutes": 5,
+        "ScanOnStartup": false,
+        "ComputeChecksums": false,
+        "FfmpegCommand": "ffmpeg",
+        "FfprobeCommand": "ffprobe",
+        "Hls": {
+          "MaxConcurrentJobs": 1
+        },
+        "DefaultViewerName": "BlueJay",
+        "Dlna": {
+          "IsEnabled": true,
+          "MulticastAddress": "239.255.255.250",
+          "Port": 1900,
+          "DiscoveryTimeoutSeconds": 2,
+          "DescriptionFetchTimeoutSeconds": 2,
+          "MaxResponsesPerSearchTarget": 32,
+          "SearchTargets": [
+            "urn:schemas-upnp-org:device:MediaRenderer:1",
+            "urn:schemas-upnp-org:device:MediaServer:1"
+          ]
+        }
+      }
+    }
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: fc-media-data
+  namespace: fc-media
+  labels:
+    app.kubernetes.io/name: fc-media-web
+    app.kubernetes.io/part-of: flowercore
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 20Gi
+  storageClassName: longhorn
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: fc-media-web
+  namespace: fc-media
+  labels:
+    app: fc-media-web
+    app.kubernetes.io/name: fc-media-web
+    app.kubernetes.io/part-of: flowercore
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: fc-media-web
+  template:
+    metadata:
+      labels:
+        app: fc-media-web
+        app.kubernetes.io/name: fc-media-web
+        app.kubernetes.io/part-of: flowercore
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "5200"
+        prometheus.io/path: "/metrics"
+        flowercore.io/healthz-auth-policy: "allow-anonymous"
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: rke2-server
+      containers:
+        - name: fc-media-web
+          image: localhost/fc-media-web:v20260604-oidc-proper
+          imagePullPolicy: Never
+          ports:
+            - containerPort: 5200
+              name: http
+          env:
+            - name: ASPNETCORE_ENVIRONMENT
+              value: Production
+            - name: ASPNETCORE_URLS
+              value: http://+:5200
+            - name: FlowerCore__Auth__Enabled
+              value: "true"
+            - name: FlowerCore__Auth__Oidc__Enabled
+              value: "true"
+            - name: FlowerCore__Auth__Oidc__Audience
+              value: "media"
+            - name: FlowerCore__Auth__Oidc__ClientId
+              valueFrom:
+                secretKeyRef:
+                  name: media-oidc-client
+                  key: client_id
+                  optional: true
+            - name: FlowerCore__Auth__Oidc__ClientSecret
+              valueFrom:
+                secretKeyRef:
+                  name: media-oidc-client
+                  key: client_secret
+                  optional: true
+            - name: FlowerCore__Auth__Oidc__Authority
+              valueFrom:
+                secretKeyRef:
+                  name: media-oidc-client
+                  key: issuer_url
+                  optional: true
+          resources:
+            requests:
+              cpu: 500m
+              memory: 1Gi
+            limits:
+              cpu: "4"
+              memory: 4Gi
+          volumeMounts:
+            - name: config
+              mountPath: /app/appsettings.Production.json
+              subPath: appsettings.Production.json
+              readOnly: true
+            - name: data
+              mountPath: /data
+            - name: transcodes
+              mountPath: /data/transcodes
+            - name: media-library
+              mountPath: /media/library
+              readOnly: true
+            - name: media-inbox
+              mountPath: /media/inbox
+          startupProbe:
+            httpGet:
+              path: /healthz
+              port: 5200
+              httpHeaders:
+                - name: X-Forwarded-Proto
+                  value: https
+            failureThreshold: 18
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: 5200
+              httpHeaders:
+                - name: X-Forwarded-Proto
+                  value: https
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 5200
+              httpHeaders:
+                - name: X-Forwarded-Proto
+                  value: https
+            initialDelaySeconds: 30
+            periodSeconds: 30
+      volumes:
+        - name: config
+          configMap:
+            name: fc-media-config
+        - name: data
+          persistentVolumeClaim:
+            claimName: fc-media-data
+        - name: transcodes
+          nfs:
+            server: 10.0.58.3
+            path: /volume1/kubernetes/fc-media-transcodes
+        - name: media-inbox
+          nfs:
+            server: 10.0.58.3
+            path: /volume1/kubernetes/fc-media-inbox
+        - name: media-library
+          nfs:
+            server: 10.0.58.3
+            path: /volume1/video
+            readOnly: true
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: fc-media-web
+  namespace: fc-media
+  labels:
+    app: fc-media-web
+    app.kubernetes.io/name: fc-media-web
+    app.kubernetes.io/part-of: flowercore
+spec:
+  type: ClusterIP
+  selector:
+    app: fc-media-web
+  ports:
+    - port: 5200
+      targetPort: 5200
+      protocol: TCP
+      name: http
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: fc-media-tls
+  namespace: fc-media
+  labels:
+    app.kubernetes.io/name: fc-media-web
+    app.kubernetes.io/part-of: flowercore
+spec:
+  secretName: fc-media-tls
+  issuerRef:
+    name: step-ca-acme
+    kind: ClusterIssuer
+  dnsNames:
+    - media.iamworkin.lan
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: fc-media-web
+  namespace: fc-media
+  labels:
+    app.kubernetes.io/name: fc-media-web
+    app.kubernetes.io/part-of: flowercore
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`media.iamworkin.lan`)
+      kind: Rule
+      services:
+        - name: fc-media-web
+          port: 5200
+  tls:
+    secretName: fc-media-tls
--- a/apps/fc-media/kustomization.yaml
+++ b/apps/fc-media/kustomization.yaml
@@ -0,0 +1,6 @@
+# ArgoCD's bluejay-infra ApplicationSet discovers apps/* directories on main.
+# The kustomization is included for local previews and single-app validation.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - fc-media.yaml
--- a/apps/fit/fit.yaml
+++ b/apps/fit/fit.yaml
@@ -201,6 +201,8 @@ spec:
    metadata:
      labels:
        app: fit-web
+      annotations:
+        flowercore.io/healthz-auth-policy: "allow-anonymous"
    spec:
      containers:
        - name: nginx
@@ -225,12 +227,18 @@ spec:
            httpGet:
              path: /healthz
              port: 80
+              httpHeaders:
+                - name: X-Forwarded-Proto
+                  value: https
            initialDelaySeconds: 5
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /healthz
              port: 80
+              httpHeaders:
+                - name: X-Forwarded-Proto
+                  value: https
            initialDelaySeconds: 3
            periodSeconds: 5
      volumes:
@@ -265,7 +273,7 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: Host(`flowerinsider.xyz`) || Host(`www.flowerinsider.xyz`)
+    - match: (Host(`flowerinsider.xyz`) || Host(`www.flowerinsider.xyz`)) && (Method(`GET`) || Method(`HEAD`))
      kind: Rule
      services:
        - name: fit-web
--- a/apps/flowercore/flowercore.yaml
+++ b/apps/flowercore/flowercore.yaml
@@ -257,6 +257,8 @@ spec:
    metadata:
      labels:
        app: flowercore-web
+      annotations:
+        flowercore.io/healthz-auth-policy: "allow-anonymous"
    spec:
      containers:
        - name: nginx
@@ -281,12 +283,18 @@ spec:
            httpGet:
              path: /healthz
              port: 80
+              httpHeaders:
+                - name: X-Forwarded-Proto
+                  value: https
            initialDelaySeconds: 5
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /healthz
              port: 80
+              httpHeaders:
+                - name: X-Forwarded-Proto
+                  value: https
            initialDelaySeconds: 3
            periodSeconds: 5
      volumes:
--- a/apps/gitea-public/gitea-public.yaml
+++ b/apps/gitea-public/gitea-public.yaml
@@ -11,7 +11,7 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: Host(`gitea.flowercore.io`)
+    - match: Host(`gitea.flowercore.io`) && (Method(`GET`) || Method(`HEAD`) || Method(`POST`) || Method(`OPTIONS`))
      kind: Rule
      services:
        - name: gitea-http
--- a/apps/knowledge/knowledge.yaml
+++ b/apps/knowledge/knowledge.yaml
@@ -93,6 +93,7 @@ spec:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8080"
        prometheus.io/path: "/metrics"
+        flowercore.io/healthz-auth-policy: "allow-anonymous"
    spec:
      securityContext:
        runAsNonRoot: true
@@ -123,11 +124,11 @@ spec:
              value: "Production"
            - name: DOTNET_SYSTEM_GLOBALIZATION_INVARIANT
              value: "false"
-            # AuthentiK/OIDC is wired but not enforced until the
-            # knowledge-oidc-client Secret is provisioned and
-            # FlowerCore__Auth__Enabled is flipped to true.
+            # AuthentiK/OIDC is enforced. /healthz stays anonymous by contract;
+            # see flowercore.io/healthz-auth-policy above and the Sprint 58
+            # OIDC readiness probe audit.
            - name: FlowerCore__Auth__Enabled
-              value: "false"
+              value: "true"
            - name: FlowerCore__Auth__Oidc__Enabled
              value: "true"
            - name: FlowerCore__Auth__Oidc__Authority
--- a/apps/mail/mail.yaml
+++ b/apps/mail/mail.yaml
@@ -243,7 +243,7 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: Host(`webmail.flowercore.io`)
+    - match: Host(`webmail.flowercore.io`) && (Method(`GET`) || Method(`HEAD`) || Method(`POST`) || Method(`OPTIONS`))
      kind: Rule
      services:
        - name: mail-webmail
--- a/apps/matrix/matrix.yaml
+++ b/apps/matrix/matrix.yaml
@@ -479,7 +479,7 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: Host(`element.flowercore.io`)
+    - match: Host(`element.flowercore.io`) && (Method(`GET`) || Method(`HEAD`))
      kind: Rule
      services:
        - name: element-web
@@ -497,7 +497,7 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: Host(`matrix.flowercore.io`)
+    - match: Host(`matrix.flowercore.io`) && (Method(`GET`) || Method(`HEAD`) || Method(`POST`) || Method(`OPTIONS`))
      kind: Rule
      services:
        - name: synapse
--- a/apps/monitoring/noc-monitoring.yaml
+++ b/apps/monitoring/noc-monitoring.yaml
@@ -481,22 +481,25 @@ data:
              - "https://intranet.iamworkin.lan/"
              - "https://signage.iamworkin.lan/healthz"   # root 401 auth-gated 2026-06-01; /healthz anon 200
              - "https://kiosk.iamworkin.lan/"
-              - "https://media.iamworkin.lan/"
+              - "https://media.iamworkin.lan/healthz"    # root auth-gated by OIDC; /healthz anonymous 200
              - "https://mysql.iamworkin.lan/healthz"   # root 401 auth-gated 2026-06-01; /healthz anon 200
              - "https://php.iamworkin.lan/healthz"     # root 401 auth-gated 2026-06-01; /healthz anon 200
              - "https://zabbix.iamworkin.lan/"
              - "https://desktop.iamworkin.lan/"
-              - "https://print.iamworkin.lan/"
-              - "https://dns.iamworkin.lan/"
-              - "https://chat.iamworkin.lan/"
-              - "https://dist.iamworkin.lan/"
-              - "https://dms.iamworkin.lan/"
+              - "https://print.iamworkin.lan/healthz"    # root 401 behind API key auth; /healthz anonymous 200
+              - "https://dns.iamworkin.lan/healthz"      # root auth-gated by OIDC; /healthz anonymous 200
+              - "https://chat.iamworkin.lan/healthz"     # OIDC staged; keep blackbox off root before enforcement flips
+              - "https://dist.iamworkin.lan/healthz"     # root/admin auth-gated by OIDC; /healthz anonymous 200
+              - "https://dms.iamworkin.lan/healthz"      # future OIDC posture; health route is already anonymous/live
              - "https://menuboard.iamworkin.lan/"
              - "https://messageboard.iamworkin.lan/"
              - "https://presentations.iamworkin.lan/"
              - "https://retail.iamworkin.lan/"
              - "https://ttsreader.iamworkin.lan/"
              # Explicit healthcheck paths
+              - "https://library.iamworkin.lan/health"
+              - "https://aistation.iamworkin.lan/healthz"
+              - "https://knowledge.iamworkin.lan/healthz"
              - "https://fc-llm-bridge.iamworkin.lan/healthz"
              - "https://acme.iamworkin.lan/health"
              # NOTE: services intentionally NOT in this probe surface
@@ -1020,7 +1023,12 @@ data:
      - name: kubernetes-state
        rules:
          - alert: KubeContainerRestartingFrequently
-            expr: increase(kube_pod_container_status_restarts_total[1h]) > 5
+            # Exclude github-runner: ephemeral runners register, run one job,
+            # exit cleanly, and restart by design. Also require kube_pod_info so
+            # deleted rollout pods do not keep firing from retained restart series.
+            expr: |
+              increase(kube_pod_container_status_restarts_total{namespace!="github-runner"}[1h]) > 5
+              and on(namespace, pod) kube_pod_info
            for: 15m
            labels:
              severity: warning
@@ -1029,7 +1037,12 @@ data:
              description: "Container {{ $labels.container }} in pod {{ $labels.namespace }}/{{ $labels.pod }} has restarted {{ $value | printf \"%.0f\" }} times in the last hour. Check 'kubectl describe pod' + last-state termination reason."

          - alert: KubeContainerCrashLooping
-            expr: increase(kube_pod_container_status_restarts_total[15m]) > 3
+            # Same github-runner/delete-retention exclusions as the hourly
+            # restart rule above; real runner failures are covered by the
+            # dedicated LinuxRunnerOffline/MacMiniRunnerOffline alerts.
+            expr: |
+              increase(kube_pod_container_status_restarts_total{namespace!="github-runner"}[15m]) > 3
+              and on(namespace, pod) kube_pod_info
            for: 5m
            labels:
              severity: critical
@@ -1057,7 +1070,10 @@ data:
              description: "Pod can't pull image. Check the image ref (often a stale tag or unreachable registry) and clean up if it's an orphan."

          - alert: KubeDeploymentReplicasMismatch
-            expr: kube_deployment_spec_replicas != kube_deployment_status_replicas_available
+            # github-runner has explicit runner-offline alerts; the generic
+            # replica-mismatch rule should not page on intentionally ephemeral
+            # 0/1 runner churn between CI jobs.
+            expr: kube_deployment_spec_replicas{namespace!="github-runner"} != kube_deployment_status_replicas_available{namespace!="github-runner"}
            for: 15m
            labels:
              severity: warning
--- a/apps/pki-web/pki-web.yaml
+++ b/apps/pki-web/pki-web.yaml
@@ -134,6 +134,8 @@ spec:
    metadata:
      labels:
        app: pki-web
+      annotations:
+        flowercore.io/healthz-auth-policy: "allow-anonymous"
    spec:
      containers:
        - name: nginx
@@ -158,12 +160,18 @@ spec:
            httpGet:
              path: /healthz
              port: 80
+              httpHeaders:
+                - name: X-Forwarded-Proto
+                  value: https
            initialDelaySeconds: 5
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /healthz
              port: 80
+              httpHeaders:
+                - name: X-Forwarded-Proto
+                  value: https
            initialDelaySeconds: 3
            periodSeconds: 5
      volumes:
@@ -201,6 +209,7 @@ spec:
  dnsNames:
    - pki.iamworkin.lan
 ---
+# Internal-only route: if a public twin is ever operator-approved, gate it with Host(`<public-host>`) && (Method(`GET`) || Method(`HEAD`)).
 # Traefik IngressRoute
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
--- a/apps/telephony/telephony.yaml
+++ b/apps/telephony/telephony.yaml
@@ -207,12 +207,18 @@ spec:
            httpGet:
              path: /health
              port: 5100
+              httpHeaders:
+                - name: X-Forwarded-Proto
+                  value: https
            initialDelaySeconds: 30
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /health
              port: 5100
+              httpHeaders:
+                - name: X-Forwarded-Proto
+                  value: https
            initialDelaySeconds: 10
            periodSeconds: 5
      volumes:
@@ -256,12 +262,12 @@ spec:
    - websecure
  routes:
    - kind: Rule
-      match: Host(`telephony.flowercore.io`)
+      match: Host(`telephony.flowercore.io`) && (Method(`GET`) || Method(`HEAD`) || Method(`POST`) || Method(`OPTIONS`))
      services:
        - name: telephony-web
          port: 5100
    - kind: Rule
-      match: Host(`telephony.iamwork.in`)
+      match: Host(`telephony.iamwork.in`) && (Method(`GET`) || Method(`HEAD`) || Method(`POST`) || Method(`OPTIONS`))
      services:
        - name: telephony-web
          port: 5100
--- a/apps/traefik-dashboard/traefik-dashboard.yaml
+++ b/apps/traefik-dashboard/traefik-dashboard.yaml
@@ -20,10 +20,11 @@ metadata:
 spec:
  basicAuth:
    secret: traefik-dashboard-auth
---
-# Dashboard IngressRoute
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
+---
+# Internal-only route: if a public twin is ever operator-approved, gate it with Host(`<public-host>`) && (Method(`GET`) || Method(`HEAD`)).
+# Dashboard IngressRoute
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
 metadata:
  name: traefik-dashboard
  namespace: traefik-system
--- a/apps/voice/voice.yaml
+++ b/apps/voice/voice.yaml
@@ -66,7 +66,7 @@ spec:
    - websecure
  routes:
    - kind: Rule
-      match: Host(`voice.bluejay.dev`)
+      match: Host(`voice.bluejay.dev`) && (Method(`GET`) || Method(`HEAD`) || Method(`POST`) || Method(`OPTIONS`))
      services:
        - name: voice-bridge
          port: 8766
@@ -84,7 +84,7 @@ spec:
    - websecure
  routes:
    - kind: Rule
-      match: Host(`voice-ws.bluejay.dev`)
+      match: Host(`voice-ws.bluejay.dev`) && (Method(`GET`) || Method(`HEAD`))
      services:
        - name: voice-bridge
          port: 8765
--- a/apps/zabbix/zabbix.yaml
+++ b/apps/zabbix/zabbix.yaml
@@ -344,6 +344,7 @@ spec:
  dnsNames:
    - zabbix.iamworkin.lan
 ---
+# Internal-only route: if a public twin is ever operator-approved, gate it with Host(`<public-host>`) && (Method(`GET`) || Method(`HEAD`)).
 # Traefik IngressRoute
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
--- a/tests/bluejay-infra-lint/FleetManifestLintTests.cs
+++ b/tests/bluejay-infra-lint/FleetManifestLintTests.cs
@@ -13,9 +13,20 @@ public sealed class FleetManifestLintTests

    private static readonly HashSet<string> PublicReadOnlyHosts = new(StringComparer.Ordinal)
    {
+        "bluejay.dev",
        "brochure.flowercore.io",
        "dist.flowercore.io",
-        "dns.iamworkin.lan",
+        "element.flowercore.io",
+        "erckak.dev",
+        "flowercore.io",
+        "flowerinsider.xyz",
+        "timeforta.co",
+        "voice-ws.bluejay.dev",
+        "www.bluejay.dev",
+        "www.erckak.dev",
+        "www.flowercore.io",
+        "www.flowerinsider.xyz",
+        "www.timeforta.co",
    };

    // Public hosts that allow a tightly bounded write surface in addition to
@@ -29,10 +40,40 @@ public sealed class FleetManifestLintTests
    // same bounded read-write allowlist as the LAN pair.
    private static readonly HashSet<string> PublicReadWriteAllowlistHosts = new(StringComparer.Ordinal)
    {
+        "chat.flowercore.io",
+        "gitea.flowercore.io",
+        "matrix.flowercore.io",
+        "telephony.flowercore.io",
+        "telephony.iamwork.in",
        "updatecenter.iamworkin.lan",
        "updates.iamworkin.lan",
        "update.flowercore.io",
        "updates.flowercore.io",
+        "voice.bluejay.dev",
+        "webmail.flowercore.io",
+    };
+
+    private static readonly IReadOnlyDictionary<string, string> InfraHealthzProbeDeployments = new Dictionary<string, string>(StringComparer.Ordinal)
+    {
+        ["andrew"] = "andrew-web",
+        ["dustin"] = "dustin-web",
+        ["erik"] = "erik-web",
+        ["fc-landing"] = "fc-landing",
+        ["fit"] = "fit-web",
+        ["flowercore"] = "flowercore-web",
+        ["pki-web"] = "pki-web",
+    };
+
+    private static readonly IReadOnlyDictionary<string, string> InfraForwardedProtoProbeDeployments = new Dictionary<string, string>(StringComparer.Ordinal)
+    {
+        ["andrew"] = "andrew-web",
+        ["dustin"] = "dustin-web",
+        ["erik"] = "erik-web",
+        ["fc-landing"] = "fc-landing",
+        ["fit"] = "fit-web",
+        ["flowercore"] = "flowercore-web",
+        ["pki-web"] = "pki-web",
+        ["telephony"] = "telephony-web",
    };

    private static readonly HashSet<string> ApiKeyProtectedDeployments = new(StringComparer.Ordinal)
@@ -132,8 +173,13 @@ public sealed class FleetManifestLintTests
                    }))
            .Where(entry => PublicReadOnlyHosts.Any(host => entry.Match.Contains($"Host(`{host}`)", StringComparison.Ordinal)))
            .Where(entry => !entry.Match.Contains("Method(`GET`)", StringComparison.Ordinal)
-                || !entry.Match.Contains("Method(`HEAD`)", StringComparison.Ordinal))
-            .Select(entry => $"{entry.Document.Descriptor} is missing an explicit GET/HEAD method allowlist.")
+                || !entry.Match.Contains("Method(`HEAD`)", StringComparison.Ordinal)
+                || entry.Match.Contains("Method(`POST`)", StringComparison.Ordinal)
+                || entry.Match.Contains("Method(`PUT`)", StringComparison.Ordinal)
+                || entry.Match.Contains("Method(`PATCH`)", StringComparison.Ordinal)
+                || entry.Match.Contains("Method(`DELETE`)", StringComparison.Ordinal)
+                || entry.Match.Contains("Method(`OPTIONS`)", StringComparison.Ordinal))
+            .Select(entry => $"{entry.Document.Descriptor} must explicitly allow GET/HEAD only on a public read-only host.")
            .ToList();

        violations.Should().BeEmpty();
@@ -424,6 +470,125 @@ public sealed class FleetManifestLintTests
        monitoring.Should().Contain("alert_channel: irc");
    }

+    [Fact]
+    public void Monitoring_GenericKubernetesAlerts_MustExcludeEphemeralGithubRunnerNamespace()
+    {
+        var monitoring = File.ReadAllText(Path.Combine(Inventory.BluejayRoot, "apps", "monitoring", "noc-monitoring.yaml"));
+
+        monitoring.Should().Contain("kube_pod_container_status_restarts_total{namespace!=\"github-runner\"}");
+        monitoring.Should().Contain("and on(namespace, pod) kube_pod_info");
+        monitoring.Should().Contain("kube_deployment_spec_replicas{namespace!=\"github-runner\"} != kube_deployment_status_replicas_available{namespace!=\"github-runner\"}");
+        monitoring.Should().Contain("dedicated LinuxRunnerOffline/MacMiniRunnerOffline alerts");
+    }
+
+    [Fact]
+    public void Monitoring_BlackboxTargetsForOidcSensitiveServices_MustUseAnonymousHealthRoutesWhenAvailable()
+    {
+        var monitoring = File.ReadAllText(Path.Combine(Inventory.BluejayRoot, "apps", "monitoring", "noc-monitoring.yaml"));
+
+        monitoring.Should().Contain("https://chat.iamworkin.lan/healthz");
+        monitoring.Should().Contain("https://dist.iamworkin.lan/healthz");
+        monitoring.Should().Contain("https://dms.iamworkin.lan/healthz");
+        monitoring.Should().Contain("https://print.iamworkin.lan/healthz");
+        monitoring.Should().Contain("https://knowledge.iamworkin.lan/healthz");
+        monitoring.Should().Contain("https://library.iamworkin.lan/health");
+        monitoring.Should().Contain("https://aistation.iamworkin.lan/healthz");
+        monitoring.Should().NotContain("https://print.iamworkin.lan/\"");
+    }
+
+    [Fact]
+    public void OidcEnforcedDeployments_WithHttpHealthzProbes_MustDeclareAnonymousHealthzContract()
+    {
+        var violations = Inventory.Documents
+            .Where(document => document.Kind == "Deployment")
+            .SelectMany(document => document.MainContainerMappings()
+                .Where(container => string.Equals(EnvValue(container, "FlowerCore__Auth__Enabled"), "true", StringComparison.OrdinalIgnoreCase))
+                .Where(container => string.Equals(EnvValue(container, "FlowerCore__Auth__Oidc__Enabled"), "true", StringComparison.OrdinalIgnoreCase))
+                .Where(container => ProbeHttpGetPath(container, "readinessProbe") == "/healthz"
+                    || ProbeHttpGetPath(container, "startupProbe") == "/healthz")
+                .Where(_ => !string.Equals(
+                    PodAnnotation(document, "flowercore.io/healthz-auth-policy"),
+                    "allow-anonymous",
+                    StringComparison.Ordinal))
+                .Select(container =>
+                {
+                    var containerName = ManifestNodeExtensions.Scalar(container, "name") ?? "<unnamed>";
+                    return $"{document.Descriptor} container '{containerName}' enforces OIDC while probing /healthz but lacks flowercore.io/healthz-auth-policy: allow-anonymous.";
+                }))
+            .ToList();
+
+        violations.Should().BeEmpty();
+    }
+
+    [Fact]
+    public void AuthSafeInfraHealthzProbes_MustDeclareAnonymousHealthzContract()
+    {
+        var violations = InfraHealthzProbeDeployments.SelectMany(expected =>
+        {
+            var deployment = AppDocuments(expected.Key)
+                .Single(document => document.Kind == "Deployment" && document.Name == expected.Value);
+            var hasHealthzProbe = deployment.MainContainerMappings()
+                .Any(container => ProbeHttpGetPath(container, "readinessProbe") == "/healthz"
+                    || ProbeHttpGetPath(container, "startupProbe") == "/healthz"
+                    || ProbeHttpGetPath(container, "livenessProbe") == "/healthz");
+
+            return hasHealthzProbe
+                && !string.Equals(PodAnnotation(deployment, "flowercore.io/healthz-auth-policy"), "allow-anonymous", StringComparison.Ordinal)
+                    ? new[] { $"{deployment.Descriptor} probes /healthz but lacks flowercore.io/healthz-auth-policy: allow-anonymous." }
+                    : Array.Empty<string>();
+        }).ToList();
+
+        violations.Should().BeEmpty();
+    }
+
+    [Fact]
+    public void AuthSafeInfraHttpProbes_MustSendForwardedProtoHttpsHeader()
+    {
+        var violations = InfraForwardedProtoProbeDeployments.SelectMany(expected =>
+        {
+            var deployment = AppDocuments(expected.Key)
+                .Single(document => document.Kind == "Deployment" && document.Name == expected.Value);
+
+            return deployment.MainContainerMappings()
+                .SelectMany(container => new[] { "startupProbe", "readinessProbe", "livenessProbe" }
+                    .Where(probeKey => ProbeHttpGetPath(container, probeKey) is "/healthz" or "/health")
+                    .Where(probeKey => !string.Equals(ProbeHttpGetHeaderValue(container, probeKey, "X-Forwarded-Proto"), "https", StringComparison.Ordinal))
+                    .Select(probeKey =>
+                    {
+                        var containerName = ManifestNodeExtensions.Scalar(container, "name") ?? "<unnamed>";
+                        return $"{deployment.Descriptor} container '{containerName}' {probeKey} is missing X-Forwarded-Proto=https.";
+                    }));
+        }).ToList();
+
+        violations.Should().BeEmpty();
+    }
+
+    [Fact]
+    public void Knowledge_OidcEnforcement_MustKeepHealthzAnonymousContractVisibleInManifest()
+    {
+        var knowledge = Inventory.Documents
+            .Single(document => document.Kind == "Deployment" && document.Namespace == "knowledge" && document.Name == "knowledge-web");
+        var container = knowledge.MainContainerMappings().Should().ContainSingle().Subject;
+
+        EnvValue(container, "FlowerCore__Auth__Enabled").Should().Be("true");
+        EnvValue(container, "FlowerCore__Auth__Oidc__Enabled").Should().Be("true");
+        ProbeHttpGetPath(container, "readinessProbe").Should().Be("/healthz");
+        PodAnnotation(knowledge, "flowercore.io/healthz-auth-policy").Should().Be("allow-anonymous");
+    }
+
+    [Fact]
+    public void Distribution_OidcEnforcement_MustKeepHealthzAnonymousContractVisibleInManifest()
+    {
+        var distribution = Inventory.Documents
+            .Single(document => document.Kind == "Deployment" && document.Namespace == "fc-distribution" && document.Name == "fc-distribution");
+        var container = distribution.MainContainerMappings().Should().ContainSingle().Subject;
+
+        EnvValue(container, "FlowerCore__Auth__Oidc__Enabled").Should().Be("true");
+        EnvValue(container, "FlowerCore__Auth__Enabled").Should().Be("true");
+        ProbeHttpGetPath(container, "readinessProbe").Should().Be("/healthz");
+        PodAnnotation(distribution, "flowercore.io/healthz-auth-policy").Should().Be("allow-anonymous");
+    }
+
    [Fact]
    public void StatefulSets_WithVolumeClaimTemplates_MustDeclareFilesystemDefaults()
    {
@@ -706,6 +871,146 @@ public sealed class FleetManifestLintTests
        application.Scalar("spec", "destination", "namespace").Should().Be("fc-devicemgmt");
    }

+    [Fact]
+    public void OidcFlipServices_AreGitOpsManagedWithHealthzProbes()
+    {
+        var deployments = new[]
+        {
+            (App: "fc-dns", Name: "dns-web", Slug: "dns", Secret: "dns-oidc-client"),
+            (App: "fc-media", Name: "fc-media-web", Slug: "media", Secret: "media-oidc-client"),
+            (App: "fc-distribution", Name: "fc-distribution", Slug: "distribution", Secret: "distribution-oidc-client"),
+        };
+
+        foreach (var expected in deployments)
+        {
+            var deployment = AppDocuments(expected.App)
+                .Single(document => document.Kind == "Deployment" && document.Name == expected.Name);
+            var container = deployment.MainContainerMappings().Should().ContainSingle().Subject;
+
+            EnvValue(container, "FlowerCore__Auth__Enabled").Should().Be("true");
+            EnvValue(container, "FlowerCore__Auth__Oidc__Enabled").Should().Be("true");
+            (EnvValue(container, "FlowerCore__Auth__Oidc__Audience") ?? EnvValue(container, "FlowerCore__Auth__Oidc__ClientId"))
+                .Should()
+                .Be(expected.Slug);
+            EnvSecretName(container, "FlowerCore__Auth__Oidc__ClientSecret").Should().Be(expected.Secret);
+            EnvSecretOptional(container, "FlowerCore__Auth__Oidc__ClientSecret").Should().Be("true");
+
+            ProbePath(container, "readinessProbe").Should().Be("/healthz");
+            if (ProbePath(container, "startupProbe") is { } startupProbePath)
+            {
+                startupProbePath.Should().Be("/healthz");
+            }
+
+            if (ProbePath(container, "livenessProbe") is { } livenessProbePath)
+            {
+                livenessProbePath.Should().Be("/healthz");
+            }
+        }
+    }
+
+    [Fact]
+    public void OidcFlipServices_UseOnePasswordItemClientSecrets()
+    {
+        var expectedItems = new Dictionary<string, (string Name, string ItemPath)>(StringComparer.Ordinal)
+        {
+            ["fc-dns"] = ("dns-oidc-client", "vaults/IAmWorkin/items/dns-oidc-client"),
+            ["fc-media"] = ("media-oidc-client", "vaults/IAmWorkin/items/media-oidc-client"),
+            ["fc-distribution"] = ("distribution-oidc-client", "vaults/IAmWorkin/items/distribution-oidc-client"),
+        };
+
+        foreach (var expected in expectedItems)
+        {
+            var item = AppDocuments(expected.Key)
+                .Single(document => document.Kind == "OnePasswordItem" && document.Name == expected.Value.Name);
+
+            item.Scalar("spec", "itemPath").Should().Be(expected.Value.ItemPath);
+        }
+    }
+
+    [Fact]
+    public void DnsAndMediaGitOpsAdoption_PreservesLiveStorageAndImageShape()
+    {
+        var dnsDeployment = AppDocuments("fc-dns")
+            .Single(document => document.Kind == "Deployment" && document.Name == "dns-web");
+        var dnsContainer = dnsDeployment.MainContainerMappings().Should().ContainSingle().Subject;
+        var dnsPvc = AppDocuments("fc-dns")
+            .Single(document => document.Kind == "PersistentVolumeClaim" && document.Name == "dns-web-data");
+
+        ManifestNodeExtensions.Scalar(dnsContainer, "image").Should().Be("localhost/fc-dns-web:v20260604-oidc-proper");
+        dnsPvc.Scalar("spec", "storageClassName").Should().Be("longhorn");
+        dnsPvc.Scalar("spec", "resources", "requests", "storage").Should().Be("1Gi");
+
+        var mediaDeployment = AppDocuments("fc-media")
+            .Single(document => document.Kind == "Deployment" && document.Name == "fc-media-web");
+        var mediaContainer = mediaDeployment.MainContainerMappings().Should().ContainSingle().Subject;
+        var mediaPvc = AppDocuments("fc-media")
+            .Single(document => document.Kind == "PersistentVolumeClaim" && document.Name == "fc-media-data");
+
+        ManifestNodeExtensions.Scalar(mediaContainer, "image").Should().Be("localhost/fc-media-web:v20260604-oidc-proper");
+        mediaPvc.Scalar("spec", "storageClassName").Should().Be("longhorn");
+        mediaPvc.Scalar("spec", "resources", "requests", "storage").Should().Be("20Gi");
+
+        mediaDeployment.AllScalars().Should().Contain(new[]
+        {
+            "/volume1/kubernetes/fc-media-transcodes",
+            "/volume1/kubernetes/fc-media-inbox",
+            "/volume1/video",
+        });
+
+        var distributionDeployment = AppDocuments("fc-distribution")
+            .Single(document => document.Kind == "Deployment" && document.Name == "fc-distribution");
+        var distributionContainer = distributionDeployment.MainContainerMappings().Should().ContainSingle().Subject;
+
+        ManifestNodeExtensions.Scalar(distributionContainer, "image").Should().Be("localhost/fc-distribution:v20260604-oidc-root-anon");
+    }
+
+    [Fact]
+    public void MonitoringProbes_UseHealthzForOidcGatedHosts()
+    {
+        var monitoring = File.ReadAllText(Path.Combine(Inventory.BluejayRoot, "apps", "monitoring", "noc-monitoring.yaml"));
+
+        monitoring.Should().Contain("\"https://dns.iamworkin.lan/healthz\"");
+        monitoring.Should().Contain("\"https://dist.iamworkin.lan/healthz\"");
+        monitoring.Should().Contain("\"https://media.iamworkin.lan/healthz\"");
+        monitoring.Should().NotContain("\"https://dns.iamworkin.lan/\"");
+        monitoring.Should().NotContain("\"https://dist.iamworkin.lan/\"");
+        monitoring.Should().NotContain("\"https://media.iamworkin.lan/\"");
+    }
+
+    [Fact]
+    public void DistributionPublicIngress_KeepsGetHeadMethodAllowlist()
+    {
+        var publicIngress = AppDocuments("fc-distribution")
+            .Single(document => document.Kind == "IngressRoute" && document.Name == "fc-distribution-public");
+        var route = publicIngress.MappingSequence("spec", "routes").Should().ContainSingle().Subject;
+        var match = ManifestNodeExtensions.Scalar(route, "match");
+
+        match.Should().Contain("Host(`dist.flowercore.io`)");
+        match.Should().Contain("Method(`GET`)");
+        match.Should().Contain("Method(`HEAD`)");
+        match.Should().NotContain("Method(`POST`)");
+    }
+
+    [Fact]
+    public void DnsAndMediaIngressRoutes_MatchLiveInternalHosts()
+    {
+        var dnsRoute = AppDocuments("fc-dns")
+            .Single(document => document.Kind == "IngressRoute" && document.Name == "dns-web")
+            .MappingSequence("spec", "routes")
+            .Should()
+            .ContainSingle()
+            .Subject;
+        var mediaRoute = AppDocuments("fc-media")
+            .Single(document => document.Kind == "IngressRoute" && document.Name == "fc-media-web")
+            .MappingSequence("spec", "routes")
+            .Should()
+            .ContainSingle()
+            .Subject;
+
+        ManifestNodeExtensions.Scalar(dnsRoute, "match").Should().Be("Host(`dns.iamworkin.lan`)");
+        ManifestNodeExtensions.Scalar(mediaRoute, "match").Should().Be("Host(`media.iamworkin.lan`)");
+    }
+
    private static IEnumerable<string> ProbeViolations(
        ManifestDocument document,
        YamlMappingNode container,
@@ -762,12 +1067,58 @@ public sealed class FleetManifestLintTests
            : null;
    }

+    private static string? EnvSecretOptional(YamlMappingNode container, string name)
+    {
+        return EnvMapping(container, name) is { } env
+            ? ManifestNodeExtensions.Scalar(env, "valueFrom", "secretKeyRef", "optional")
+            : null;
+    }
+
+    private static string? ProbePath(YamlMappingNode container, string probeKey)
+    {
+        return ManifestNodeExtensions.Scalar(container, probeKey, "httpGet", "path");
+    }
+
+    private static IReadOnlyList<ManifestDocument> AppDocuments(string app)
+    {
+        return Inventory.Documents
+            .Where(document => document.RelativePath.StartsWith($"{app}/", StringComparison.Ordinal))
+            .ToList();
+    }
+
    private static YamlMappingNode? EnvMapping(YamlMappingNode container, string name)
    {
        return ManifestNodeExtensions.MappingSequence(container, "env")
            .SingleOrDefault(env => string.Equals(ManifestNodeExtensions.Scalar(env, "name"), name, StringComparison.Ordinal));
    }

+    private static string? PodAnnotation(ManifestDocument document, string name)
+    {
+        return document.Scalar("spec", "template", "metadata", "annotations", name);
+    }
+
+    private static string? ProbeHttpGetPath(YamlMappingNode container, string probeKey)
+    {
+        return ManifestNodeExtensions.TryGetMapping(container, probeKey, out var probe)
+            && ManifestNodeExtensions.TryGetMapping(probe, "httpGet", out var httpGet)
+            ? ManifestNodeExtensions.Scalar(httpGet, "path")
+            : null;
+    }
+
+    private static string? ProbeHttpGetHeaderValue(YamlMappingNode container, string probeKey, string name)
+    {
+        if (!ManifestNodeExtensions.TryGetMapping(container, probeKey, out var probe)
+            || !ManifestNodeExtensions.TryGetMapping(probe, "httpGet", out var httpGet))
+        {
+            return null;
+        }
+
+        return ManifestNodeExtensions.MappingSequence(httpGet, "httpHeaders")
+            .Where(header => string.Equals(ManifestNodeExtensions.Scalar(header, "name"), name, StringComparison.Ordinal))
+            .Select(header => ManifestNodeExtensions.Scalar(header, "value"))
+            .SingleOrDefault();
+    }
+
    private static IReadOnlyList<ManifestDocument> FcDeviceManagementDocuments()
    {
        return Inventory.Documents
Author	SHA1	Message	Date
Andrew Stoltz	90599b0413	fix(auth): harden public infra routes	2026-06-04 13:20:16 -05:00
Andrew Stoltz	81a3ddac4c	fix(auth): mark OIDC healthz probes anonymous	2026-06-04 11:03:20 -05:00
bluejay	300f8ad546	fix(monitoring): probe OIDC-safe health routes Sprint 58 Cx-12. Rebased over OIDC GitOps main; YAML parse and focused bluejay-infra lint tests passed.	2026-06-04 06:45:34 +00:00
bluejay	fe38c2641f	Merge pull request 'fix(auth): deploy distribution root anonymous image' (#38 ) from codex/s58-distribution-root-anon-gitops into main	2026-06-04 06:20:09 +00:00
Andrew Stoltz	3b40dfb185	fix(auth): deploy distribution root anonymous image	2026-06-04 01:19:16 -05:00
bluejay	103878671c	Merge pull request 'fix(auth): deploy Distribution OIDC image tag' (#37 ) from codex/s58-oidc-proper into main	2026-06-04 06:05:15 +00:00
Andrew Stoltz	36039c1335	fix(auth): deploy distribution oidc image tag	2026-06-04 01:04:44 -05:00
bluejay	2a66109f13	Merge pull request 'feat(auth): adopt OIDC GitOps for DNS Distribution Media' (#36 ) from codex/s58-oidc-proper into main	2026-06-04 05:52:56 +00:00
Andrew Stoltz	933fea89d1	feat(auth): adopt oidc apps in gitops	2026-06-04 00:49:36 -05:00
Andrew Stoltz	13f9bb7710	fix(distribution): revert OIDC enforcement — enabling it gated /healthz probe (service down) Flipping Auth__Enabled=true gated the /healthz readiness probe (302->NotReady-> no endpoints->distribution.iamworkin.lan down, healthz=000). Classic feedback_k8s_probes_behind_auth_middleware. Revert to false (OIDC env block kept, gate off) to restore service. Proper fix (AllowAnonymous /healthz + CA-trust + idempotent Editions seed + OIDC-challenge wiring + browser-proof) -> falcon OIDC lane. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-03 23:47:29 -05:00
Andrew Stoltz	9a58fd2af6	oidc: flip enforcement ON for knowledge + distribution (no-live-proof, fix-forward) Operator 2026-06-04: nothing is production yet, flip OIDC + fix-forward (no browser-proof gate). knowledge: Auth__Enabled false->true (OIDC env already wired). distribution: add OIDC env block (Authority/Audience/ClientId=distribution, ClientSecret from distribution-oidc-client) + Enabled=true; public read/entitlement + Method() allowlist stay open (OIDC gates admin only). Clients already provisioned (secrets present). ArgoCD deploys both. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-03 23:38:48 -05:00