feat: serverless 2.0.0 architecture with Authentik auth proxy

Implements a complete serverless development container platform:

## Architecture
- Authentik forward auth for authentication/authorization
- NGINX routing proxy extracts GitHub repo from URL path
- Knative Service auto-scales dev container instances from 0
- Dynamic GitHub repo routing via /github/{owner}/{repo}

## Components
- routing-proxy: NGINX-based service for repo extraction and forwarding
- deployment.yaml: Complete K8s manifests (proxy, Knative, ingress, secrets)
- authentik-config.yaml: Authentik application and provider configs
- serverless scripts: Dynamic repo initialization and startup handling
- Comprehensive documentation and Makefile for ops

## Key Features
- Scale to zero when not in use (cost-effective)
- Per-request isolation (each repo gets own container)
- Built-in file manager for upload/download
- Support for private repos via GitHub tokens
- User attribution via Authentik headers
- WebSocket support for VNC connections

Example usage: https://devcontainer.farh.net/github/microsoft/vscode

Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>

serverless/routing-proxy/Dockerfile

@@ -0,0 +1,16 @@
+# Lightweight routing proxy for dynamic GitHub repo routing
+FROM nginx:1.27-alpine
+
+# Install envsubst for template rendering
+RUN apk add --no-cache gettext
+
+# Copy nginx configuration template
+COPY nginx.conf.template /etc/nginx/nginx.conf.template
+COPY entrypoint.sh /entrypoint.sh
+
+RUN chmod +x /entrypoint.sh
+
+EXPOSE 8080
+
+ENTRYPOINT ["/entrypoint.sh"]
+CMD ["nginx", "-g", "daemon off;"]

serverless/routing-proxy/entrypoint.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+
+# Set default values for environment variables
+DEVCONTAINER_SERVICE_URL=${DEVCONTAINER_SERVICE_URL:-"devcontainer-serverless.devcontainers.svc.cluster.local"}
+
+# Create temp directories
+mkdir -p /tmp/client_temp /tmp/proxy_temp /tmp/fastcgi_temp /tmp/uwsgi_temp /tmp/scgi_temp
+
+# Substitute environment variables in nginx config
+envsubst '$DEVCONTAINER_SERVICE_URL' < /etc/nginx/nginx.conf.template > /etc/nginx/nginx.conf
+
+echo "Starting routing proxy..."
+echo "Routing to: $DEVCONTAINER_SERVICE_URL"
+
+# Start nginx
+exec "$@"

serverless/routing-proxy/nginx.conf.template

@@ -0,0 +1,124 @@
+worker_processes auto;
+error_log /var/log/nginx/error.log warn;
+pid /tmp/nginx.pid;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    # Logging format
+    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                    '$status $body_bytes_sent "$http_referer" '
+                    '"$http_user_agent" "$http_x_forwarded_for" '
+                    'repo="$github_repo" user="$authentik_user"';
+
+    access_log /var/log/nginx/access.log main;
+
+    # Basic settings
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout 65;
+    types_hash_max_size 2048;
+    client_max_body_size 100M;  # Allow large file uploads via file manager
+
+    # Temp directories (writable in container)
+    client_body_temp_path /tmp/client_temp;
+    proxy_temp_path /tmp/proxy_temp;
+    fastcgi_temp_path /tmp/fastcgi_temp;
+    uwsgi_temp_path /tmp/uwsgi_temp;
+    scgi_temp_path /tmp/scgi_temp;
+
+    # Upstream Knative service (will be resolved by Knative networking)
+    upstream devcontainer_serverless {
+        server ${DEVCONTAINER_SERVICE_URL};
+    }
+
+    # Map to extract GitHub repo from URL path
+    map $request_uri $github_repo {
+        ~^/github/([^/]+/[^/]+)(/.*)?$ https://github.com/$1;
+        default "";
+    }
+
+    # Extract Authentik user info from headers (set by Authentik forward auth)
+    map $http_x_authentik_username $authentik_user {
+        default $http_x_authentik_username;
+    }
+
+    server {
+        listen 8080;
+        server_name _;
+
+        # Health check endpoint
+        location /health {
+            access_log off;
+            return 200 "OK\n";
+            add_header Content-Type text/plain;
+        }
+
+        # GitHub repo routing
+        location ~ ^/github/([^/]+/[^/]+)(/.*)?$ {
+            # Validate the repo format
+            if ($github_repo = "") {
+                return 400 "Invalid GitHub repository format. Use: /github/owner/repo\n";
+            }
+
+            # Log the routing decision
+            access_log /var/log/nginx/routing.log main;
+
+            # Set headers for the devcontainer
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+
+            # Custom headers for dynamic repo routing
+            proxy_set_header X-GitHub-Repo $github_repo;
+            proxy_set_header X-Authentik-User $authentik_user;
+            proxy_set_header X-Request-Path $request_uri;
+
+            # Preserve Authentik auth headers
+            proxy_set_header X-Authentik-Username $http_x_authentik_username;
+            proxy_set_header X-Authentik-Email $http_x_authentik_email;
+            proxy_set_header X-Authentik-Name $http_x_authentik_name;
+            proxy_set_header X-Authentik-Groups $http_x_authentik_groups;
+
+            # Proxy settings for long-running connections (VNC)
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_read_timeout 86400;  # 24 hours
+            proxy_send_timeout 86400;
+            proxy_connect_timeout 30;
+
+            # Buffer settings for file uploads
+            proxy_buffering off;
+            proxy_request_buffering off;
+
+            # Forward to the devcontainer
+            proxy_pass http://devcontainer_serverless$2;
+        }
+
+        # Root path - show available repositories or redirect to auth
+        location = / {
+            return 200 "DevContainer Serverless\nUsage: /github/{owner}/{repo}\nExample: /github/microsoft/vscode\n";
+            add_header Content-Type text/plain;
+        }
+
+        # Anything else
+        location / {
+            return 404 "Not found. Use /github/{owner}/{repo} to access repositories.\n";
+            add_header Content-Type text/plain;
+        }
+    }
+
+    # WebSocket upgrade handling
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        '' close;
+    }
+}