From 1af1a3527dcfa9aef477ead01b1ac9a12a9d0601 Mon Sep 17 00:00:00 2001
From: "azykov@mail.ru" <azykov@mail.ru>
Date: Tue, 29 Sep 2026 13:17:55 +0300
Subject: [PATCH] dev.aggtaa.com/api/admin path auth, prefix stip

---
 clusters/base/apps/dev/ingress.yaml       | 54 +++++++++++++++++++----
 clusters/base/apps/dev/kustomization.yaml |  1 +
 clusters/base/apps/dev/middleware.yaml    | 13 ++++++
 3 files changed, 59 insertions(+), 9 deletions(-)
 create mode 100644 clusters/base/apps/dev/middleware.yaml

diff --git a/clusters/base/apps/dev/ingress.yaml b/clusters/base/apps/dev/ingress.yaml
index 815878d..9c23717 100644
--- a/clusters/base/apps/dev/ingress.yaml
+++ b/clusters/base/apps/dev/ingress.yaml
@@ -1,9 +1,13 @@
-# Two Ingresses on one host because the auth middleware is per-Ingress:
-# "/" goes through Authelia, "/api" and "/m" are public. Traefik picks the
-# longer path prefix first, so /api and /m never hit the auth router.
-# Both need the tls section (otherwise the router is http-only), but only
-# the first carries the cert-manager annotation so a single Certificate
-# owns the dev-tls secret.
+# Three Ingresses on one host because middlewares and router priority are
+# per-Ingress. Traefik matches pathType Prefix character-wise (not per path
+# segment), so public prefixes carry a trailing slash and priorities are
+# explicit - by default Traefik orders routers by rule length, which would
+# not reliably put /api/admin above /api/.
+#   300 dev-admin  /api/admin  -> Authelia -> api (prefix /api stripped)
+#   200 dev-public /api/ /m/   -> api / m, public (prefixes stripped)
+#   100 dev        /           -> Authelia -> ui (also bare /api and /m)
+# All carry the tls section (otherwise the router is http-only), but only
+# "dev" has the cert-manager annotation so a single Certificate owns dev-tls.
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -11,6 +15,7 @@ metadata:
   namespace: dev
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.priority: "100"
     traefik.ingress.kubernetes.io/router.middlewares: auth-authelia@kubernetescrd
 spec:
   ingressClassName: traefik
@@ -33,22 +38,53 @@ spec:
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: dev-public
+  name: dev-admin
   namespace: dev
+  annotations:
+    traefik.ingress.kubernetes.io/router.priority: "300"
+    traefik.ingress.kubernetes.io/router.middlewares: auth-authelia@kubernetescrd,dev-strip-prefix@kubernetescrd
 spec:
   ingressClassName: traefik
   rules:
     - host: dev.aggtaa.com
       http:
         paths:
-          - path: /api
+          # no trailing slash on purpose: also catches bare /api/admin
+          # (and /api/administrator...), all of which stay behind Authelia
+          - path: /api/admin
             pathType: Prefix
             backend:
               service:
                 name: dev
                 port:
                   name: api
-          - path: /m
+  tls:
+    - secretName: dev-tls
+      hosts:
+        - dev.aggtaa.com
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: dev-public
+  namespace: dev
+  annotations:
+    traefik.ingress.kubernetes.io/router.priority: "200"
+    traefik.ingress.kubernetes.io/router.middlewares: dev-strip-prefix@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: dev.aggtaa.com
+      http:
+        paths:
+          - path: /api/
+            pathType: Prefix
+            backend:
+              service:
+                name: dev
+                port:
+                  name: api
+          - path: /m/
             pathType: Prefix
             backend:
               service:
diff --git a/clusters/base/apps/dev/kustomization.yaml b/clusters/base/apps/dev/kustomization.yaml
index ab2ea8d..81fcc55 100644
--- a/clusters/base/apps/dev/kustomization.yaml
+++ b/clusters/base/apps/dev/kustomization.yaml
@@ -2,4 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - service.yaml
+  - middleware.yaml
   - ingress.yaml
diff --git a/clusters/base/apps/dev/middleware.yaml b/clusters/base/apps/dev/middleware.yaml
new file mode 100644
index 0000000..1a52b4e
--- /dev/null
+++ b/clusters/base/apps/dev/middleware.yaml
@@ -0,0 +1,13 @@
+# Shared by dev-admin and dev-public: /api/a -> /a, /api/admin/b -> /admin/b,
+# /m/main.css -> /main.css. Only the first matching prefix is stripped, and
+# none of these routes can match both.
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: strip-prefix
+  namespace: dev
+spec:
+  stripPrefix:
+    prefixes:
+      - /api
+      - /m