From 0a810817b6b520ba5f93079baf0aca84c3ba849d Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Fri, 23 Oct 2026 21:24:00 +0200
Subject: [PATCH] gatus: expect the authentik redirect for Longhorn

Longhorn now sits behind an authentik login on the Gateway instead of nginx basic auth, so the check expects a 302 without following it. Same change for s1 on node001.
---
 gatus/config.yaml                   |  6 ++++--
 nix-infra-machine/nodes/node001.nix | 13 ++++++++-----
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/gatus/config.yaml b/gatus/config.yaml
index c736179..fccd025 100644
--- a/gatus/config.yaml
+++ b/gatus/config.yaml
@@ -69,9 +69,11 @@ endpoints:
     group: rubenhensen.nl
     url: https://longhorn.rubenhensen.nl
     interval: 60s
-    # Behind basic auth, so 401 means it's up
+    # Envoy sends visitors to authentik first, so a redirect means it's up
+    client:
+      ignore-redirect: true
     conditions:
-      - "[STATUS] == 401"
+      - "[STATUS] == 302"
       - "[CERTIFICATE_EXPIRATION] > 168h"
   - name: serpbear
     group: rubenhensen.nl
diff --git a/nix-infra-machine/nodes/node001.nix b/nix-infra-machine/nodes/node001.nix
index 7157f25..543e0ea 100644
--- a/nix-infra-machine/nodes/node001.nix
+++ b/nix-infra-machine/nodes/node001.nix
@@ -51,11 +51,14 @@ let
 
   # Per-host tweaks on top of the default check.
   gatusOverrides = {
-    # Behind basic auth, so 401 means it's up
-    "longhorn.rubenhensen.nl".conditions = [
-      "[STATUS] == 401"
-      "[CERTIFICATE_EXPIRATION] > 168h"
-    ];
+    # Envoy sends visitors to authentik first, so a redirect means it's up
+    "longhorn.rubenhensen.nl" = {
+      client.ignore-redirect = true;
+      conditions = [
+        "[STATUS] == 302"
+        "[CERTIFICATE_EXPIRATION] > 168h"
+      ];
+    };
     # mod_auth_openidc answers 401 instead of redirecting to the login
     # page unless the client asks for HTML
     "rss.rubenhensen.nl".headers.Accept = "text/html";