dev.aggtaa.com/api/admin path auth, prefix stip

clusters/base/apps/dev/ingress.yaml

@@ -1,9 +1,13 @@
-# Two Ingresses on one host because the auth middleware is per-Ingress:
-# "/" goes through Authelia, "/api" and "/m" are public. Traefik picks the
-# longer path prefix first, so /api and /m never hit the auth router.
-# Both need the tls section (otherwise the router is http-only), but only
-# the first carries the cert-manager annotation so a single Certificate
-# owns the dev-tls secret.
+# Three Ingresses on one host because middlewares and router priority are
+# per-Ingress. Traefik matches pathType Prefix character-wise (not per path
+# segment), so public prefixes carry a trailing slash and priorities are
+# explicit - by default Traefik orders routers by rule length, which would
+# not reliably put /api/admin above /api/.
+#   300 dev-admin  /api/admin  -> Authelia -> api (prefix /api stripped)
+#   200 dev-public /api/ /m/   -> api / m, public (prefixes stripped)
+#   100 dev        /           -> Authelia -> ui (also bare /api and /m)
+# All carry the tls section (otherwise the router is http-only), but only
+# "dev" has the cert-manager annotation so a single Certificate owns dev-tls.
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -11,6 +15,7 @@ metadata:
   namespace: dev
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.priority: "100"
     traefik.ingress.kubernetes.io/router.middlewares: auth-authelia@kubernetescrd
 spec:
   ingressClassName: traefik
@@ -33,22 +38,53 @@ spec:
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: dev-public
+  name: dev-admin
   namespace: dev
+  annotations:
+    traefik.ingress.kubernetes.io/router.priority: "300"
+    traefik.ingress.kubernetes.io/router.middlewares: auth-authelia@kubernetescrd,dev-strip-prefix@kubernetescrd
 spec:
   ingressClassName: traefik
   rules:
     - host: dev.aggtaa.com
       http:
         paths:
-          - path: /api
+          # no trailing slash on purpose: also catches bare /api/admin
+          # (and /api/administrator...), all of which stay behind Authelia
+          - path: /api/admin
             pathType: Prefix
             backend:
               service:
                 name: dev
                 port:
                   name: api
-          - path: /m
+  tls:
+    - secretName: dev-tls
+      hosts:
+        - dev.aggtaa.com
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: dev-public
+  namespace: dev
+  annotations:
+    traefik.ingress.kubernetes.io/router.priority: "200"
+    traefik.ingress.kubernetes.io/router.middlewares: dev-strip-prefix@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: dev.aggtaa.com
+      http:
+        paths:
+          - path: /api/
+            pathType: Prefix
+            backend:
+              service:
+                name: dev
+                port:
+                  name: api
+          - path: /m/
             pathType: Prefix
             backend:
               service:

clusters/base/apps/dev/kustomization.yaml

@@ -2,4 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - service.yaml
+  - middleware.yaml
   - ingress.yaml

clusters/base/apps/dev/middleware.yaml

@@ -0,0 +1,13 @@
+# Shared by dev-admin and dev-public: /api/a -> /a, /api/admin/b -> /admin/b,
+# /m/main.css -> /main.css. Only the first matching prefix is stripped, and
+# none of these routes can match both.
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: strip-prefix
+  namespace: dev
+spec:
+  stripPrefix:
+    prefixes:
+      - /api
+      - /m