feat(dns): PiHole answers an explicit LAN name list, not a zone wildcard

Public names are proxied CNAMEs to the Cloudflare Tunnel since PR #156 and work from the LAN, so they should resolve publicly there too. Replace the address=/${BASE_DOMAIN}/ wildcard with explicit entries: the LAN-only names (derived from every controller:none HTTPRoute), gitea/nextcloud (off Cloudflare's 100 MB / 100 s limits), keycloak/auth, and the L4 VIPs. Add L0 check pihole-lan-names, mutation-tested. Correct docs that still described public names as CNAME to wan. and the cloudflared entrypoint comment. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-11-08 19:51:49 -06:00
1 parent 020e736541
commit 8fe8d5df8a
@@ -0,0 +1,45 @@
+# =============================================================================
+# L0 STATIC — PiHole answers an explicit LAN name list, and no LAN-only name is left out of it
+# Catalog: docs/14 L0 row ("Pre-apply, in CI") — runs WITHOUT a cluster.
+#
+# Since PR #156 every public name is a proxied CNAME to the Cloudflare Tunnel and works from the
+# LAN, so PiHole's zone wildcard was replaced by an explicit list (catalog/pihole.yaml). That makes
+# the list load-bearing: a route disowned from public DNS and absent from it resolves nowhere. This
+# test derives the required names from the tree (every `controller: none` HTTPRoute, every hostname
+# the tunnel 404s, the L4 Services' own VIPs) and asserts the list covers them, carries no
+# zone-wide entry, and pins gitea and nextcloud to the Gateway VIP. It proves itself non-vacuous by
+# mutation. Rationale and the honest NOT-proven list: check.sh.
+#
+# WHY SCOPE, NOT REQUIREMENTS: the property spans catalog/, apps/, platform/ and runbooks/; a new
+# internal service in any of them can break it, and ci/touched-requirements.sh maps apps/* to no
+# requirement at all, so a requirement-scoped selection would skip it on precisely those changes.
+# =============================================================================
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: pihole-lan-names
+  labels:
+    conformance.home.k3s/R-DNS-03: "true"
+  annotations:
+    conformance.home.k3s/requirements: "R-DNS-03"
+    conformance.home.k3s/layer: "L0"
+    conformance.home.k3s/scope: "whole-repo"
+    conformance.home.k3s/safety-critical: "true"
+    conformance.home.k3s/executable: "true"
+    conformance.home.k3s/intent: >-
+      PiHole answers an explicit list of LAN names rather than the whole zone; every HTTPRoute
+      disowned from public DNS has an entry to the Gateway VIP; every hostname the Cloudflare
+      Tunnel 404s has an entry, with the L4 names on their own VIPs; and gitea and nextcloud stay
+      on the LAN path, off Cloudflare's request-size and timeout limits.
+spec:
+  steps:
+    - name: assert-pihole-explicit-lan-names
+      description: >-
+        Parse FTLCONF_misc_dnsmasq_lines from catalog/pihole.yaml and the rendered
+        apps/wave-0/pihole.yaml, derive the required names from every `controller: none` HTTPRoute,
+        the http_status:404 hostnames in platform/cloudflared/config.yaml and the L4 Services'
+        lbipam annotations, assert the list covers them and contains no zone-wide entry, and run
+        the evaluator on mutated lists to prove it is not vacuous.
+      try:
+        - script:
+            content: bash ./check.sh