feat(dns): publish public names as proxied CNAMEs to the Cloudflare Tunnel

Gateway target -> fc81938b-...cfargotunnel.com, --cloudflare-proxied globally, L4 service publishers (unifi, crafty-mc) pinned DNS-only, Plex web UI and Headlamp disowned (LAN/VPN-only). L0 internal-services-publish-no-public-dns gains assertion (9) tying the Gateway target to the tunnel UUID, requiring cloudflare-proxied=false on every service-source publisher, and keeping the tunnel's 404 list and the unpublished set consistent. L2 dns-exposure fixture opts out of proxying. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-11-08 17:55:41 -06:00
1 parent 2e777e13ca
commit 92944486d1
@@ -30,5 +30,9 @@ east-west default-deny (docs/09).

 - **Phase 2 (WS-NET):** pin the L2-announced ingress VIP / IP pool (Cilium L2 announcement, docs/09);
  add the HTTP→HTTPS redirect route; confirm the cross-namespace ReferenceGrant pattern with WS-APPS.
- **Public exposure** is a **manual edge port-forward** of 80/443 to the Gateway VIP (single SOHO
-  router, docs/09) — a documented manual step, the analogue of the old pfSense exception.
+- **Public exposure** is via the **Cloudflare Tunnel** (2026-11-08, `platform/cloudflared`): the
+  Gateway's `external-dns.alpha.kubernetes.io/target` is `<tunnel-uuid>.cfargotunnel.com`, so every
+  published name is a proxied CNAME to the tunnel and cloudflared forwards to this Gateway's
+  ClusterIP. No inbound WAN 80/443 forward is needed (the old manual edge port-forward is retired —
+  runbooks/cloudflare-tunnel.md). LAN/VPN-only names (internal apps, plex, headlamp) carry
+  `controller: none` on their route and are 404'd by the tunnel.