# platform/externaldns

**ExternalDNS** — automatic public DNS records for `public` services (Cloudflare).

- **Spec:** [docs/09 — DNS & Ingress](../../../home-network-k3s/docs/09-dns-and-ingress.md)
  (ExternalDNS is named in [docs/01](../../../home-network-k3s/docs/01-architecture-overview.md); no
  dedicated ADR)
- **Serves:** R-DNS-01/02/03
- **Owner:** WS-NET (token from WS-SEC)

## What this stub is

Flux `HelmRelease` watching Gateway/HTTPRoute + Service resources, publishing
`<service>.home.keithjackson.dev` records in Cloudflare from declared intent (no manual record
editing, R-DNS-02).

## Split-horizon note (docs/09)

A wildcard `*.keithjackson.dev` matches only one label deep, so `<svc>.home.keithjackson.dev` needs
its own record. **`internal` services need NO public record** — PiHole resolves them to the internal
Gateway VIP (split-horizon). ExternalDNS manages **`public`** services' records only.

## Secrets

Cloudflare API token referenced **by name** (`cloudflare-api-token`, shared with cert-manager),
**SOPS-encrypted** (WS-SEC, OQ-4).

## TODO (later phases)

- **Phase 2 (WS-NET):** confirm `gateway-httproute` source; prove an auto record for a test route
  (R-DNS-02, Phase-2 exit gate).
- **Phase 6 (WS-APPS):** PiHole provides the internal split-horizon answers as it onboards.