fix(privacyidea): correct image to ghcr.io/gpappsoft, port 5001→8080

privacyidea/privacyidea:3.12 and privacyidea/otpserver:3.12.2 do not
exist on Docker Hub. Correct image is ghcr.io/gpappsoft/privacyidea-docker:3.12.2
which listens on port 8080.

Update all port references: deployment, service, ingress, netpol-mfa,
netpol-sso (keycape→privacyIDEA egress rule).

Also: creds-bootstrap-agent.sh — restart privacyIDEA deployment after
applying new secrets so the pod picks up updated env vars.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sso-mfa/bootstrap/creds-bootstrap-agent.sh

@@ -188,8 +188,17 @@ if [[ "$DRY_RUN" == false ]]; then
         fi
     done
     [[ "$ALL_OK" == true ]] || die "One or more required secrets are missing — check creds-apply output above"
+
+    # Restart privacyIDEA if the deployment exists, so it picks up the newly
+    # generated secrets. Without this, a running pod would have stale env vars.
+    if kubectl get deployment privacyidea -n mfa &>/dev/null 2>&1; then
+        log "restarting privacyIDEA deployment to pick up new secrets..."
+        kubectl rollout restart deployment/privacyidea -n mfa
+        ok "privacyIDEA restart triggered"
+    fi
 else
     echo "  [dry-run] would verify K8s secrets"
+    echo "  [dry-run] would restart privacyIDEA if deployment exists"
 fi
 
 # ── Phase 5: Post-apply bootstrap — wait for privacyIDEA ──────────────────────

sso-mfa/k8s/network-policies/netpol-mfa.yaml

@@ -1,8 +1,8 @@
 # NetworkPolicies for the mfa namespace (privacyIDEA)
 #
 # Allowed paths:
-#   INGRESS: Traefik (kube-system) → privacyIDEA :5001  (user-facing portal)
+#   INGRESS: Traefik (kube-system) → privacyIDEA :8080  (user-facing portal)
-#   INGRESS: KeyCape (sso) → privacyIDEA :5001           (Provider API calls)
+#   INGRESS: KeyCape (sso) → privacyIDEA :8080           (Provider API calls)
 #   EGRESS:  privacyIDEA → databases :5432                (PostgreSQL)
 #   EGRESS:  all pods → kube-dns :53                      (UDP+TCP)
 #
@@ -42,7 +42,7 @@ spec:
             matchLabels:
               app.kubernetes.io/name: traefik
       ports:
-        - port: 5001
+        - port: 8080
           protocol: TCP
 ---
 # ── Allow ingress from KeyCape (Provider API calls) ──────────────────────────
@@ -66,7 +66,7 @@ spec:
             matchLabels:
               app.kubernetes.io/name: keycape
       ports:
-        - port: 5001
+        - port: 8080
           protocol: TCP
 ---
 # ── Allow egress to PostgreSQL ───────────────────────────────────────────────

sso-mfa/k8s/network-policies/netpol-sso.yaml

@@ -13,7 +13,7 @@
 # Allowed egress paths:
 #   keycape  → authelia :9091  (OIDC callback orchestration)
 #   keycape  → lldap    :3890  (LDAP user lookups)
-#   keycape  → mfa      :5001  (privacyIDEA MFA check and token validation)
+#   keycape  → mfa      :8080  (privacyIDEA MFA check and token validation)
 #   authelia → lldap    :3890  (LDAP authentication backend)
 #   all pods → kube-dns :53    (DNS resolution)
 #
@@ -201,7 +201,7 @@ spec:
         - port: 3890
           protocol: TCP
 ---
-# ── KeyCape egress → privacyIDEA (mfa namespace) :5001 ───────────────────────
+# ── KeyCape egress → privacyIDEA (mfa namespace) :8080 ───────────────────────
 # KeyCape calls privacyIDEA to check and validate MFA tokens.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
@@ -220,7 +220,7 @@ spec:
             matchLabels:
               net-kingdom/component: mfa
       ports:
-        - port: 5001
+        - port: 8080
           protocol: TCP
 ---
 # ── Authelia egress → LLDAP (within sso namespace) ───────────────────────────

sso-mfa/k8s/privacyidea/deployment.yaml

@@ -10,8 +10,8 @@
 #   5. enckey-bootstrap.sh — extract enckey + audit keys, create DR Secrets
 #   6. bootstrap-admin.sh  — create pi-admin (+ MFA enrolment) and trigger-admin
 #
-# Container port: 5001.
+# Container port: 8080.
-# privacyidea/otpserver listens on port 5001 internally.
+# ghcr.io/gpappsoft/privacyidea-docker listens on port 8080 (gunicorn).
 
 apiVersion: apps/v1
 kind: Deployment
@@ -53,14 +53,15 @@ spec:
       containers:
         - name: privacyidea
           # Pin to a specific release; update via image update policy.
-          # Official image: https://hub.docker.com/r/privacyidea/otpserver
+          # Official image: https://github.com/gpappsoft/privacyidea-docker
-          # privacyidea/privacyidea:3.12 does not exist — correct repo is otpserver.
+          # privacyidea/privacyidea:3.12 and privacyidea/otpserver:3.12.2 do not exist.
-          image: privacyidea/otpserver:3.12.2
+          # Correct image: ghcr.io/gpappsoft/privacyidea-docker:3.12.2 (port 8080)
+          image: ghcr.io/gpappsoft/privacyidea-docker:3.12.2
           imagePullPolicy: IfNotPresent
 
           ports:
             - name: http
-              containerPort: 5001
+              containerPort: 8080
               protocol: TCP
 
           # ── Environment — sensitive values from Secret ──────────────────
@@ -86,20 +87,20 @@ spec:
           # Startup probe: give PI up to 3 min to run DB migrations on first boot.
           startupProbe:
             tcpSocket:
-              port: 5001
+              port: 8080
             initialDelaySeconds: 15
             periodSeconds: 10
             failureThreshold: 18   # 18 × 10s = 3 min
           livenessProbe:
             tcpSocket:
-              port: 5001
+              port: 8080
             initialDelaySeconds: 0
             periodSeconds: 15
             failureThreshold: 3
           readinessProbe:
             httpGet:
               path: /token/
-              port: 5001
+              port: 8080
             initialDelaySeconds: 0
             periodSeconds: 10
             failureThreshold: 3
@@ -143,6 +144,6 @@ spec:
     app.kubernetes.io/name: privacyidea
   ports:
     - name: http
-      port: 5001
+      port: 8080
-      targetPort: 5001
+      targetPort: 8080
       protocol: TCP

sso-mfa/k8s/privacyidea/ingress.yaml

@@ -46,7 +46,7 @@ spec:
               service:
                 name: privacyidea
                 port:
-                  number: 5001
+                  number: 8080
   tls:
     - secretName: pink-tls
       hosts:
@@ -83,7 +83,7 @@ spec:
               service:
                 name: privacyidea
                 port:
-                  number: 5001
+                  number: 8080
   tls:
     - secretName: pink-tls
       hosts:
@@ -114,7 +114,7 @@ spec:
               service:
                 name: privacyidea
                 port:
-                  number: 5001
+                  number: 8080
   tls:
     - secretName: pink-account-tls
       hosts: