homelab-gitops/apps/oldipmi

Legacy IPMI browser

Argo Application oldipmi deploys the independent published oldipmi chart into namespace oldimpi (intentional spelling). Its chart targetRevision is the single selected version. Chart source: https://code.brunner.ninja/feedc0de/oldipmi

Open https://oldipmi.brunner.ninja. Traefik uses its existing wildcard TLS certificate and the namespace's Authentik forward-auth middleware for every browser asset and WebSocket handshake. The Old IPMI application is restricted to authentik Admins by the blueprint in apps/authentik/values.yaml. The existing shared /outpost.goauthentik.io/ route handles login callbacks. As with Kubernetes Dashboard, the proxy provider is attached additively to the embedded Authentik outpost, preserving all its other providers. Recovery: apply the blueprint, then add Old IPMI to that outpost through Authentik's admin UI.

Cloudflare DNS: unproxied CNAME oldipmi.brunner.ninja → brunner.ninja, following the existing admin service domains. DNS is account-managed outside Argo CD.

The chart's namespace-wide NetworkPolicy admits only Traefik pods on the web port. Cilium allows external destinations, including Internet, 192.168.0.0/16 and Funkfeuer 10.12.0.0/16, but explicitly denies cluster/node/API identities, ServiceCIDR, link-local metadata, MetalLB's pool, and the cluster's Funkfeuer service address. Public resolvers and no Kubernetes search domains prevent ordinary .svc.cluster.local discovery. This is not a domain-name firewall; IP policy enforces the boundary even if a name resolves to a cluster IP. Public ingress URLs remain reachable. Keep the explicit service/MetalLB exclusions aligned with platform range changes; pod/node exclusions follow Cilium identities automatically. Cilium policy must reconcile before startup.

This is one shared disposable browser session. BMC passwords, downloads and sessions are not persisted or backed up. Log out of the BMC after use. A pod replacement resets the desktop. No existing PVCs or legacy cluster writer are involved. The user's local Podman session is left intact for comparison.

Verification: check Argo Synced/Healthy, non-root/zero-capability runtime, HTTP and WebSocket authentication redirects, admin policy/outpost membership, external connectivity and denied pod/node/Service/LoadBalancer destinations. Actual hardware KVM verification requires identifying the BMC and logging in.

Verified deployment

On 2026-10-31, CI passed the rendered security checks and the Podman HTTP/WebSocket/RFB runtime test, published the chart anonymously, and promoted its version through GitOps. Argo reached Synced/Healthy with zero pod restarts. The browser ran as UID 1000 with CapEff=0, NoNewPrivs=1 and seccomp mode 2; no service-account token or persistent volume was present.

Unauthenticated page, asset and WebSocket requests redirected to Authentik, including a request with forged Authentik identity headers. The provider's only group binding was authentik Admins. Traefik could fetch the backend; an unrelated Authentik pod could not connect directly to its web port.

The browser reached public DNS, Internet HTTPS, LAN Victron (192.168.0.169) and Funkfeuer (10.12.4.172 HTTP/SSH). Connections to the Kubernetes API Service, API node, its own node SSH, an Authentik pod, the Traefik MetalLB address, and the cluster's Funkfeuer service address timed out. Kubernetes local names did not resolve. A real WebSocket upgrade returned the VNC RFB protocol handshake. No BMC login or physical server KVM session was tested: its address is unknown.

Archival: NOT APPLICABLE. The source was a standalone local Podman command, with no legacy deployment repository. The new chart repository is retained because it owns the deployment contract and publication pipeline.