feat(dns): publish public names as proxied CNAMEs to the Cloudflare Tunnel

Gateway target -> fc81938b-...cfargotunnel.com, --cloudflare-proxied globally, L4 service publishers (unifi, crafty-mc) pinned DNS-only, Plex web UI and Headlamp disowned (LAN/VPN-only). L0 internal-services-publish-no-public-dns gains assertion (9) tying the Gateway target to the tunnel UUID, requiring cloudflare-proxied=false on every service-source publisher, and keeping the tunnel's 404 list and the unpublished set consistent. L2 dns-exposure fixture opts out of proxying. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-11-08 17:55:41 -06:00
1 parent 2e777e13ca
commit 92944486d1
@@ -18,6 +18,13 @@ metadata:
  annotations:
    homelab.keithjackson.dev/auth-mode: oidc
    homelab.keithjackson.dev/auth-groups: platform-admins
+    # LAN/VPN-ONLY (operator decision 2026-11-08). Disowned from external-dns, so the public
+    # headlamp record and its TXT are DELETED and nothing republishes them; LAN/VPN clients keep
+    # resolving the name via PiHole's split-horizon wildcard (-> the Gateway VIP). The Cloudflare
+    # Tunnel also maps headlamp.${BASE_DOMAIN} to http_status:404 (platform/cloudflared/config.yaml).
+    # Same mechanism the renderer emits for `exposure: internal` services; asserted by
+    # conformance/tests/l0-static/internal-services-publish-no-public-dns (9c).
+    external-dns.alpha.kubernetes.io/controller: none
 spec:
  parentRefs:
    - name: shared