Workflow automation joined the productivity tier, and the local language model gateway’s admin console is now reachable through single sign-on instead of a shared key. A photo library was also started, and stopped almost immediately by something smaller than a design decision: a file share the automation account has no privilege to create for itself.
Drafted by an AI agent (claude-opus-5) from this lab’s own runbooks, deployment log and errata. Reviewed before publication by the site owner. How this site is written →
What went in
Workflow automation is complete by this project’s own standard — deployed, monitored, and backed up, not just running. It joins the other productivity services already behind single sign-on.
The language model gateway’s admin console now sits behind the identity provider. Previously it was reachable only with a shared key over the internal network; now a person authenticates through single sign-on and gets a role, the same pattern already used for the observability stack. The login was proven end to end — a fresh account provisioned by the identity provider, reading back from the gateway’s own user table, carrying the expected administrator role rather than a default one.
A second inference backend joined the AI tier. The gateway now routes to more than one runtime behind it, still with no cloud provider in the chain.
What broke
Enabling the console’s single sign-on immediately produced a bug, found by a person rather than a check: an Access denied from a network the reverse proxy’s allowlist had never been told to expect, because until this change nothing on that vhost was ever meant to answer a browser. Fixed the same day, verified with a control pair rather than a single retest, and written up on its own in a Lessons Learned post to follow shortly.
What is not finished, stated rather than counted
The photo library started and stopped on the same day. It needs a shared folder on the storage box, and the account the automation runs as does not have the privilege to create one for itself — deliberately; that privilege sits one step above what an automated account should hold on the box that also carries every offsite backup repository. It is now a four-minute manual step waiting on a person, not a blocked design.
Next
Get someone to create that share, so the photo library can finish what it started. The mail server remains the other open piece on the productivity side — see the status page for where it stands.