Activate ACTIVITY-WP-0025: Authelia SSO ingress for ops and Temporal UI

Mark workplan active. Add Traefik ForwardAuth middleware and Ingress
manifests for activity.coulomb.social and activity-temporal.coulomb.social.
Prefer Authelia SSO identity for ops mutations; document DNS gate and
fleet pattern (docs/ops-sso-access.md).

k8s/railiance/10-infrastructure.yaml

@@ -384,4 +384,5 @@ spec:
             - name: TEMPORAL_ADDRESS
               value: actcore-temporal:7233
             - name: TEMPORAL_CORS_ORIGINS
-              value: http://localhost:8080
+              # Include SSO host (ACTIVITY-WP-0025) and local port-forward.
+              value: https://activity-temporal.coulomb.social,http://localhost:8080,http://127.0.0.1:8080

k8s/railiance/30-authelia-middleware.yaml

@@ -0,0 +1,22 @@
+# Traefik ForwardAuth → Authelia (fleet SSO).
+# Pattern: net-kingdom sso-mfa Authelia at auth.coulomb.social
+# ACTIVITY-WP-0025
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: authelia-forwardauth
+  namespace: activity-core
+  labels:
+    app.kubernetes.io/name: activity-core
+    app.kubernetes.io/part-of: activity-core
+    app.kubernetes.io/component: sso
+spec:
+  forwardAuth:
+    # rd= sends the browser to the Authelia login portal when unauthenticated.
+    address: http://authelia.sso.svc.cluster.local:9091/api/verify?rd=https://auth.coulomb.social/
+    trustForwardHeader: true
+    authResponseHeaders:
+      - Remote-User
+      - Remote-Groups
+      - Remote-Name
+      - Remote-Email

k8s/railiance/31-ingress-ops-sso.yaml

@@ -0,0 +1,34 @@
+# HTTPS SSO front door for activity-core ops console + API.
+# Requires DNS: activity.coulomb.social A → 92.205.62.239
+# ACTIVITY-WP-0025
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: actcore-ops
+  namespace: activity-core
+  labels:
+    app.kubernetes.io/name: actcore-api
+    app.kubernetes.io/part-of: activity-core
+    app.kubernetes.io/component: sso-ingress
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.middlewares: activity-core-authelia-forwardauth@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - activity.coulomb.social
+      secretName: actcore-ops-tls
+  rules:
+    - host: activity.coulomb.social
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: actcore-api
+                port:
+                  number: 8010

k8s/railiance/32-ingress-temporal-sso.yaml

@@ -0,0 +1,34 @@
+# HTTPS SSO front door for Temporal Web UI.
+# Requires DNS: activity-temporal.coulomb.social A → 92.205.62.239
+# ACTIVITY-WP-0025
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: actcore-temporal-ui
+  namespace: activity-core
+  labels:
+    app.kubernetes.io/name: actcore-temporal-ui
+    app.kubernetes.io/part-of: activity-core
+    app.kubernetes.io/component: sso-ingress
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.middlewares: activity-core-authelia-forwardauth@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - activity-temporal.coulomb.social
+      secretName: actcore-temporal-ui-tls
+  rules:
+    - host: activity-temporal.coulomb.social
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: actcore-temporal-ui
+                port:
+                  number: 8080

k8s/railiance/README.md

@@ -111,20 +111,33 @@ kubectl -n activity-core get pods
 kubectl -n activity-core get svc
 ```
 
-## Operator automation console (ACTIVITY-WP-0024)
+## Operator automation console (ACTIVITY-WP-0024 / 0025)
 
-API Service is ClusterIP-only. From a shell with cluster access:
+### SSO (primary, after DNS)
 
 ```bash
-kubectl -n activity-core port-forward svc/actcore-api 8010:8010
-# UI:  http://127.0.0.1:8010/ops/ui
-# JSON: http://127.0.0.1:8010/ops/automations/status?since=sunday
+# DNS A records → 92.205.62.239 (once):
+#   activity.coulomb.social
+#   activity-temporal.coulomb.social
+
+kubectl apply -f k8s/railiance/30-authelia-middleware.yaml
+kubectl apply -f k8s/railiance/31-ingress-ops-sso.yaml
+kubectl apply -f k8s/railiance/32-ingress-temporal-sso.yaml
+kubectl -n activity-core set env deploy/actcore-api \
+  ACTIVITY_CORE_TEMPORAL_UI_URL=https://activity-temporal.coulomb.social
 ```
 
-Mutations require `ACTIVITY_CORE_OPERATOR_TOKEN` in `actcore-runtime-secret`
-(injected via `envFrom` on `actcore-api`). Merge the key into the existing
-secret (do not replace DB URL keys). Header: `X-Operator-Token`. See
-`docs/runbook.md` § Operator automation console.
+- Ops: https://activity.coulomb.social/ops/ui (Authelia SSO)
+- Temporal: https://activity-temporal.coulomb.social
+- Design: `docs/ops-sso-access.md`
 
-Cron/schedule expression changes remain git-owned (definition files + sync);
-the console supports Run now, enable/disable, and Temporal pause/unpause only.
+### Break-glass port-forward
+
+```bash
+export KUBECONFIG=~/.kube/config-hosteurope
+kubectl -n activity-core port-forward svc/actcore-api 8010:8010
+# UI:  http://127.0.0.1:8010/ops/ui
+```
+
+Mutations: SSO headers when behind Authelia, else `X-Operator-Token` from
+`actcore-runtime-secret`. Cron edits remain git-owned.