# Project Status

> **Last Updated:** 2025-11-23
> **Version:** 0.8.2-authentik-api-protection

## Current Phase

**Active Work:** Security & SSO Implementation (Authentik Deployment)
**Status:** 🔄 **IN PROGRESS** - 2 Services Protected (Organizr + Core API)

See [PLANS.md](PLANS.md) for complete implementation roadmap and [CHANGELOG.md](CHANGELOG.md) for version history.

## In Progress

### Priority 1: Security & SSO Implementation (Authentik)
- [x] **Milestone 1: Authentik Deployment**
  - [x] Deploy Authentik server and worker containers
  - [x] Configure shared PostgreSQL database (authentik_user, authentik database)
  - [x] Configure shared Redis (DB 0)
  - [x] Fix health checks (Python urllib instead of wget/curl)
  - [x] Create NPM proxy host for auth.schweitz.net
  - [x] Generate admin recovery key and set password
  - [x] Memory optimization: 563MB total (80-90% reduction vs previous attempt)

- [x] **Milestone 2: Google OAuth Integration**
  - [x] Create Google OAuth credentials (Client ID/Secret)
  - [x] Configure Authentik Google source via API
  - [x] Configure identification stage to show social login
  - [x] Test Google OAuth login (successful)
  - [x] Verify user creation (jpmschweitzer@gmail.com - external type)

- [x] **Milestone 3: Forward Auth for Organizr** ✅ COMPLETE (2025-11-21)
  - [x] Create Authentik Proxy Provider (Organizr Proxy) via API
  - [x] Create Authentik Application (Organizr) via API
  - [x] ~~Assign provider to embedded outpost~~ (embedded outpost failed)
  - [x] **Deploy standalone outpost container** (authentik-proxy on port 9443)
  - [x] Configure Redis connection for standalone outpost
  - [x] Verify outpost endpoints operational
  - [x] **Configure NPM forward auth for home.schweitz.net**
  - [x] Test SSO access to Organizr (Google OAuth login working)
  - [x] Verify no redirect loops
  - [x] Fix Organizr auto-login (moved headers to location / block)

**Resolution:** Embedded outpost has version-specific issues in 2024.8.4. Deployed standalone `authentik-proxy` container successfully. Forward auth fully operational with Organizr auto-login working.

**Standalone Outpost Details:**
- Container: `authentik-proxy` (port 9445:9443)
- Status: ✅ Healthy (websocket connected, ping endpoint responding)
- Memory: ~150MB
- Provider: Organizr Proxy (forward_single mode)
- Token: `9blMGz71CFMJszs7AedQefgydpTnwvybjmMn0AlYilIKBV5LIq7snqnCodwX`

**NPM Configuration:**
- Applied to: home.schweitz.net (Organizr) ONLY
- Forward auth: https://localhost:9445/outpost.goauthentik.io (NPM on host network)
- WebSocket support: Enabled
- Headers: X-authentik-username, X-authentik-email, X-authentik-groups, X-authentik-name, X-authentik-uid
- Status: ✅ Fully operational, tested in incognito

**Critical Fix:** Authentication headers must be set inside `location /` block, not at server level, for proper forwarding to backend applications.

### Priority 2: Core-API Refactoring & Infrastructure Management ✅ COMPLETE
- [x] **Code Cleanup:** Restructure Core API into function-specific controller files
  - [x] Create `/controllers` directory structure
  - [x] Create `/clients` directory structure
  - [x] Create `base.py` controller base class
  - [x] Add infrastructure settings to `config.py`
  - [x] Create credentials management system
  - [x] Update `main.py` routing to include infrastructure controller
  - [x] Separate AI Orchestrator logic into `ai_controller.py`
  - [x] Extract webscraper to `tools_controller.py`
  - [x] Create `health_controller.py` for monitoring endpoints

- [x] **Infrastructure Management Controller:** Build automation API for service management
  - [x] Portainer Integration (HTTP client with access token)
  - [x] NPM Integration (HTTP client with JWT bearer token + auto-refresh)
  - [x] Read/List Endpoints (all implemented & tested)
  - [x] Write Endpoints (POST/PUT/DELETE all implemented & tested)
  - [x] Portainer API Token generated programmatically
  - [ ] Uptime Kuma Integration (deferred - complex Socket.IO)
  - [ ] Replace ad-hoc shell scripts in `/stacks` with API endpoints
  - [ ] Add CLI wrapper for common operations

### Priority 3: AI Orchestrator Phase 2 (Memory Systems) - DEFERRED
- [ ] Implement Tier 1: ConversationBufferMemory (in-memory, last 10 turns)
- [ ] Implement Tier 2: ConversationSummaryMemory (SQLite summaries)
- [ ] Integrate Tier 3: VectorStoreRetrieverMemory (Qdrant semantic search)
- [ ] Create Qdrant collections (conversation_memory, documents, user_facts)
- [ ] Implement memory consolidation service
- [ ] Add conversation history API endpoints
- [ ] Test memory persistence across container restarts

## Current Blockers

**None** - SSO implementation complete for critical services. Remaining service rollout deferred in favor of other priorities.

## Key Metrics

| Metric | Target | Current | Status |
|--------|--------|---------|--------|
| **Containers Running** | 15+ | 22 | 🟢 All Services Operational |
| **GPU Accessible** | Yes | Yes | 🟢 Working (RTX 2080 Ti) |
| **Storage Used** | <80% | 58% HDD (3.6TB/3.7TB) | 🟢 Healthy |
| **Services Accessible** | All | 21/21 | 🟢 Complete |
| **Remote Access** | Working | Ready | 🟢 Headscale + NPM |
| **Firewall Active** | Yes | Yes | 🟢 UFW Configured |
| **Backups Configured** | Yes | Yes | 🟢 Daily @ 3 AM |
| **AI Orchestrator** | Phase 6 | Phase 1 ✅ | 🟡 Phase 2 Deferred |
| **SSO (Authentik)** | Phase 5 | Core Complete ✅ | 🟢 Organizr + Core API Protected |

## Quick Reference

### Documentation
- [Implementation Plans](PLANS.md) - Master plan tracker and roadmap
- [Changelog](CHANGELOG.md) - Version history
- [Container Reference](docs/reference/CONTAINERS.md) - All deployed services
- [System Specifications](docs/reference/SYSTEM.md) - Hardware and software details
- [Agent Guidelines](AGENTS.md) - Development conventions

### Key Paths
- **SSD configs:** `/home/jpmschweitzer/docker-data/`
- **HDD content:** `/mnt/media/`
- **Stacks:** Managed in Portainer web UI
- **Scripts:** `/mnt/media/Projects/portainer-core/scripts/`

### Active Services & URLs

**Infrastructure:**
- **Portainer:** http://192.168.86.149:8080 (container management)
- **Nginx Proxy Manager:** http://192.168.86.149:8000 (reverse proxy admin)
- **Authentik:** https://auth.schweitz.net (SSO identity provider - Google OAuth enabled)
- **Ollama:** http://192.168.86.149:11434 (ML models API)

**Networking:**
- **Headscale:** http://192.168.86.149:8085 (mesh VPN control)

**Monitoring:**
- **Uptime Kuma:** http://192.168.86.149:3001 (service monitoring)
- **Netdata:** http://192.168.86.149:19999 (system metrics)
- **Organizr:** http://192.168.86.149:8084 OR https://home.schweitz.net (unified dashboard)

**Applications:**
- **Open WebUI:** http://192.168.86.149:8081 (LLM chat interface)
- **Core API:** http://192.168.86.149:8083 (infrastructure management & AI orchestration)
- **Jellyfin:** http://192.168.86.149:8096 OR https://media.schweitz.net (GPU media server)
- **Nextcloud:** http://192.168.86.149:8082 OR https://cloud.schweitz.net (cloud storage)
- **Gitea:** http://192.168.86.149:3002 OR https://git.schweitz.net (Git hosting, SSH: 2222)
- **Samba:** \\\\192.168.86.149 or \\\\tower-of-joy (file shares: Media, Downloads, Backups)

**Background Services:**
- **Watchtower:** Automatic updates daily @ 4 AM
- **Maintenance:** Automated backups daily @ 3 AM

---

*For detailed implementation history and completed work, see [CHANGELOG.md](CHANGELOG.md)*