# ExternalDNS Helm values — PLACEHOLDER (Phase 0). Authoritative values inline in helmrelease.yaml.
#
# provider.name: cloudflare
# sources: [gateway-httproute, service]        # Cilium Gateway API + Services (docs/09)
# domainFilters: [home.keithjackson.dev]        # only the platform zone
# policy: sync                                  # create/update/delete records with services
# Cloudflare token: SOPS-encrypted `cloudflare-api-token` (WS-SEC, OQ-4) — name only.
# NOTE: `internal` services need NO public record (PiHole split-horizon, docs/09).