ignis: add basic auth via envoy SecurityPolicy

Ignis has no built-in auth; required now that ignis.fireflylab.cc
is a public hostname. Plain k8s Secret (no Vault yet) holding an
htpasswd hash, enforced at gateway via SecurityPolicy.

apps/ignis/chart/templates/basic-auth.yaml

@@ -0,0 +1,22 @@
+{{- if .Values.auth.enabled }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-basic-auth
+type: Opaque
+stringData:
+  .htpasswd: {{ .Values.auth.htpasswd | quote }}
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: {{ .Release.Name }}-basic-auth
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: {{ .Release.Name }}
+  basicAuth:
+    users:
+      name: {{ .Release.Name }}-basic-auth
+{{- end }}

apps/ignis/chart/templates/httproute.yaml

@@ -3,14 +3,17 @@ apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
   name: {{ .Release.Name }}
-  # No built-in auth in Ignis itself — LAN-only exposure, same tradeoff
-  # already accepted for Vault in cluster-platform.
+  # Ignis has no built-in auth — basic-auth enforced at the gateway via
+  # SecurityPolicy (see basic-auth.yaml), required since one hostname is
+  # public-facing (ignis.fireflylab.cc).
 spec:
   parentRefs:
     - name: envoy-gateway
       namespace: envoy-gateway-system
   hostnames:
-    - {{ .Values.httpRoute.hostname | quote }}
+    {{- range .Values.httpRoute.hostnames }}
+    - {{ . | quote }}
+    {{- end }}
   rules:
     - matches:
         - path:

apps/ignis/chart/values.yaml

@@ -37,4 +37,12 @@ persistence:
 
 httpRoute:
   enabled: true
-  hostname: ignis.fireflylab.local
+  hostnames:
+    - ignis.fireflylab.local
+    - ignis.fireflylab.cc
+
+auth:
+  enabled: true
+  # bcrypt htpasswd line, e.g. output of: htpasswd -nB <user>
+  # Generate this yourself — do not put the plaintext password here.
+  htpasswd: "duynguyen:$2y$05$0hgFpQXdm1arjoEG5Gqs5.Q0Bl8YGOgXVLzBXdQjCnBTRgR1sYb9O"

apps/ignis/docker-compose.yml

@@ -1,16 +0,0 @@
-services:
-  ignis:
-    image: nobbe/ignis:latest
-    ports:
-      - "8080:8080"
-    environment:
-      - PUID=1000
-      - PGID=1000
-    volumes:
-      - ./vaults:/vaults
-      - ./data:/app/data
-      - obsidian-app:/app/obsidian-app
-    restart: unless-stopped
-
-volumes:
-  obsidian-app: