From 669c51d3481bc3ad17f761d28261d378641e5281 Mon Sep 17 00:00:00 2001 From: jhodgkin Date: Sun, 12 Jul 2026 22:46:27 -0600 Subject: [PATCH] docs: record Vaultwarden credential backup completion Co-Authored-By: Claude Sonnet 5 --- CLAUDE.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 7b0acb2..77ff93e 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -87,8 +87,9 @@ One login instead of logging into Proxmox, Zabbix, OMV, and every service separa - **Authentik redirect URIs**: both the public (`https://monitor.jerodrigged.com/...`, now primary in `.env`) and LAN (`http://192.168.1.103:8090/...`) callback URLs are registered in the blueprint, so OIDC login still works if the tunnel/DNS is ever down. -- **Vaultwarden**: dashboard admin credentials saved as "Homelab Monitor (dashboard admin)". OIDC client - credentials not yet saved there (pending a `BW_SESSION` from the user). +- **Vaultwarden**: three items saved — "Homelab Monitor (dashboard admin)" (local admin login), + "Homelab Monitor - Authentik OIDC client (homelab-monitor provider)" (client_id/secret, secure note), + and "Homelab Monitor - Authentik test account (playwright-test)" (the e2e test account's login). ## Zabbix: intentionally skipped, not blocked @@ -108,11 +109,13 @@ skipped). `GET .../issues?state=open` on this repo should return empty. First re both above), fixed, and now covered by `e2e/oidc-login.spec.ts` as regression coverage. Both local and OIDC login are Playwright-verified passing (5 consecutive runs) as of this writing. +e2e coverage expanded beyond the happy path (invalid credentials, session persistence, unauthenticated +API rejection) — 9 tests, stable across repeated full-suite runs with parallel workers. All credentials +this project generated are now in Vaultwarden. + If picking this up again with no specific ask from the user, there's no queued work — check in with them for what's next rather than inventing scope. Remaining known gaps, none blocking: -- OIDC client credentials aren't in Vaultwarden yet (Proxmox token and admin password are) — needs a - `BW_SESSION` from the user. - `diskPaths` in `hosts.yaml` vs. the remote forced-command scripts on omv/ripper is a manual-sync point (documented, not automated — only 2 hosts, hasn't been worth it). - `e2e/` isn't wired into CI — run by hand (`cd e2e && npm test`) after any auth-related change.