Document Synology Authentik deploy guardrails

docs/CURRENT_INFRA_HANDOFF.md

@@ -263,6 +263,23 @@ The script does not overwrite live secret files:
 /volume1/docker/nodedc-platform/ops-agents/.env
 ```
 
+Launcher must use the platform Authentik alias for internal API sync:
+
+```env
+NODEDC_AUTHENTIK_BASE_URL=http://nodedc-platform-authentik-server:9000
+AUTHENTIK_BASE_URL=http://nodedc-platform-authentik-server:9000
+```
+
+Do not use `http://authentik-server:9000` in Launcher env after attaching Launcher to the Engine Docker network. The Engine stack also has an `authentik-server` service name, so Docker DNS can resolve the name to the wrong Authentik and valid platform tokens will fail with `403 Token invalid/expired`.
+
+The platform Authentik service exposes a stable identity-network alias in the Synology compose:
+
+```text
+nodedc-platform-authentik-server
+```
+
+When changing this alias or Authentik env wiring, recreate `authentik-server`, `authentik-worker`, and `launcher` together. A freshly recreated Authentik server can temporarily return `503 Service Unavailable` until the worker/bootstrap path is ready, so verify with retry from inside the launcher container.
+
 Launcher image build is done from the Launcher repo when frontend/backend code changes:
 
 ```bash
@@ -393,6 +410,7 @@ Never run docker compose down -v on production/staging data.
 Never delete nodedc-tasker_* volumes without a verified backup.
 Never use docker system prune blindly on the NAS.
 Never commit .env.synology or real secrets.
+Never deploy Launcher with NODEDC_AUTHENTIK_BASE_URL=http://authentik-server:9000 on NAS.
 ```
 
 ## Local development model

docs/SECURITY_CHECKLIST.md

@@ -27,6 +27,7 @@ Service catalog UX rules: `docs/SERVICE_CATALOG_UX_RULES.md`.
 
 - [ ] Authentik service token хранится только server-side.
 - [ ] Frontend не получает service token.
+- [ ] Synology Launcher использует platform Authentik alias `http://nodedc-platform-authentik-server:9000`, не неоднозначный `http://authentik-server:9000`.
 - [ ] Admin endpoints требуют `nodedc:superadmin` или `nodedc:launcher:admin`.
 - [ ] Все admin actions пишутся в audit log.
 - [ ] Удаление пользователя реализовано как deactivate/disable, не hard delete.

infra/synology/.env.synology.example

@@ -41,7 +41,10 @@ PLANE_OIDC_CLIENT_ID=nodedc-task-manager
 PLANE_OIDC_CLIENT_SECRET=replace-with-random-synology-secret
 PLANE_OIDC_REDIRECT_URI=https://ops.nodedc.ru/auth/oidc/callback
 
-NODEDC_AUTHENTIK_BASE_URL=http://authentik-server:9000
+NODEDC_AUTHENTIK_BASE_URL=http://nodedc-platform-authentik-server:9000
+AUTHENTIK_BASE_URL=http://nodedc-platform-authentik-server:9000
+NODEDC_AUTHENTIK_SERVICE_TOKEN=replace-with-authentik-api-token
+AUTHENTIK_SERVICE_TOKEN=replace-with-authentik-api-token
 NODEDC_INTERNAL_ACCESS_TOKEN=replace-with-random-synology-secret
 SESSION_SECRET=replace-with-random-synology-secret
 COOKIE_DOMAIN=.nas.nodedc

infra/synology/README.md

@@ -49,6 +49,47 @@ http://task.nas.nodedc:18090
 - Tasker поднимается отдельным compose из `NODEDC_TASKMANAGER/plane-app/docker-compose.yaml` на порту `18090`.
 - Ops Agents Gateway поднимается отдельным compose из `NODEDC_TASKMANAGER_CODEXAPI/docker-compose.synology.yml` на `172.22.0.222:18190`; Synology reverse proxy должен вести `ops-agents.nodedc.ru` на этот порт, а не на `18090`.
 
+## Внутренний Authentik API для Launcher
+
+Launcher подключен и к platform identity-сети, и к engine-сети. В engine-сети тоже может быть сервис с DNS-именем `authentik-server`, поэтому это имя нельзя использовать для `NODEDC_AUTHENTIK_BASE_URL`: Docker DNS может отдать не тот Authentik, и platform API-token будет получать `403 Token invalid/expired`.
+
+Для platform Authentik зафиксирован отдельный alias:
+
+```text
+http://nodedc-platform-authentik-server:9000
+```
+
+Live `/volume1/docker/nodedc-platform/platform/.env.synology` должен содержать:
+
+```env
+NODEDC_AUTHENTIK_BASE_URL=http://nodedc-platform-authentik-server:9000
+AUTHENTIK_BASE_URL=http://nodedc-platform-authentik-server:9000
+NODEDC_AUTHENTIK_SERVICE_TOKEN=<server Authentik API token>
+AUTHENTIK_SERVICE_TOKEN=<same token>
+```
+
+Быстрая проверка из launcher-контейнера:
+
+```bash
+sudo /usr/local/bin/docker exec nodedc-platform-launcher-1 sh -lc '
+echo "$NODEDC_AUTHENTIK_BASE_URL"
+getent hosts nodedc-platform-authentik-server
+for attempt in 1 2 3 4 5 6 7 8 9 10; do
+  wget -qSO- \
+    --header "Authorization: Bearer $NODEDC_AUTHENTIK_SERVICE_TOKEN" \
+    "$NODEDC_AUTHENTIK_BASE_URL/api/v3/core/groups/?search=nodedc_admin" \
+    2>&1 | head -n 25 && exit 0
+  echo "authentik-api-not-ready attempt=$attempt"
+  sleep 10
+done
+exit 1
+'
+```
+
+Ожидаемый результат: `HTTP/1.1 200 OK`.
+
+После изменения platform Authentik alias пересоздавать нужно `authentik-server`, `authentik-worker` и `launcher`. Один `authentik-server` может временно отдавать `503 Service Unavailable`, пока worker и bootstrap не готовы.
+
 ## Синхронизация текущего состояния
 
 С Mac, при смонтированном `/Volumes/docker`:
@@ -84,6 +125,8 @@ TASKER_SYNC_SOURCE=1 ./infra/synology/deploy-current.sh
 - `/volume1/docker/nodedc-platform/tasker/plane-app/.env.synology`
 - `/volume1/docker/nodedc-platform/ops-agents/.env`
 
+Если emergency-fix был сделан прямо на Synology в этих env-файлах, перенести sanitized-значение в `.env.synology.example`/docs, а секрет оставить только в live env.
+
 ## Backup текущего состояния
 
 С Mac, при смонтированном `/Volumes/docker`:

infra/synology/deploy-current.sh

@@ -173,6 +173,20 @@ Verify:
 sudo /usr/local/bin/docker exec nodedc-platform-launcher-1 sh -lc \
   'touch /app/server/storage/.write-test /app/server/storage/uploads/.write-test && rm /app/server/storage/.write-test /app/server/storage/uploads/.write-test && echo storage-ok'
 
+sudo /usr/local/bin/docker exec nodedc-platform-launcher-1 sh -lc '
+  echo "$NODEDC_AUTHENTIK_BASE_URL"
+  getent hosts nodedc-platform-authentik-server
+  for attempt in 1 2 3 4 5 6 7 8 9 10; do
+    wget -qSO- \
+      --header "Authorization: Bearer $NODEDC_AUTHENTIK_SERVICE_TOKEN" \
+      "$NODEDC_AUTHENTIK_BASE_URL/api/v3/core/groups/?search=nodedc_admin" \
+      2>&1 | head -n 25 && exit 0
+    echo "authentik-api-not-ready attempt=$attempt"
+    sleep 10
+  done
+  exit 1
+'
+
 curl -k -sS --compressed https://id.nodedc.ru/if/flow/default-authentication-flow/ \
   | grep -aE 'hub.nodedc.ru|launcher.local|getLauncherBaseUrl|Запросить доступ'
 

infra/synology/docker-compose.platform-http.yml

@@ -36,6 +36,8 @@ services:
       PORT: 5173
       NODEDC_LAUNCHER_STORAGE_DIR: /app/server/storage
       NODEDC_LAUNCHER_UPLOADS_DIR: /app/server/storage/uploads
+      NODEDC_AUTHENTIK_BASE_URL: http://nodedc-platform-authentik-server:9000
+      AUTHENTIK_BASE_URL: http://nodedc-platform-authentik-server:9000
     expose:
       - "5173"
     volumes:
@@ -98,7 +100,9 @@ services:
       - authentik-data:/data
       - ../authentik/custom-templates:/templates:ro
     networks:
-      - identity
+      identity:
+        aliases:
+          - nodedc-platform-authentik-server
 
   authentik-worker:
     image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2026.2.2}