jakman85andClaude Opus 5.5
92944486d1
Gateway target -> fc81938b-...cfargotunnel.com, --cloudflare-proxied globally, L4 service publishers (unifi, crafty-mc) pinned DNS-only, Plex web UI and Headlamp disowned (LAN/VPN-only). L0 internal-services-publish-no-public-dns gains assertion (9) tying the Gateway target to the tunnel UUID, requiring cloudflare-proxied=false on every service-source publisher, and keeping the tunnel's 404 list and the unpublished set consistent. L2 dns-exposure fixture opts out of proxying. Co-Authored-By: Claude Opus 5.5 <[email protected]>
43 lines
1.9 KiB
YAML
43 lines
1.9 KiB
YAML
---
|
|
# North-south ingress for Headlamp at headlamp.home.keithjackson.dev. Attaches to the shared Gateway
|
|
# (docs/09); TLS terminated at the Gateway by the *.home.keithjackson.dev wildcard cert (already
|
|
# covers this host). Same-namespace backend, so no ReferenceGrant is needed; the parentRef is
|
|
# permitted because the headlamp namespace carries gateway-access=shared. CR of the Gateway API CRDs
|
|
# — CARRIED BY platform-config (dependsOn platform) so the CRDs exist first (like grafana-httproute).
|
|
#
|
|
# auth-mode annotation records that Headlamp authenticates via native Keycloak OIDC (R-IDP-02); this
|
|
# route is NOT protected by oauth2-proxy forward-auth (Headlamp runs its own OIDC login + per-user
|
|
# token forwarding), so it must NOT carry an oauth2-proxy ExtAuth filter.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: headlamp
|
|
namespace: headlamp
|
|
labels:
|
|
app.kubernetes.io/name: headlamp
|
|
annotations:
|
|
homelab.keithjackson.dev/auth-mode: oidc
|
|
homelab.keithjackson.dev/auth-groups: platform-admins
|
|
# LAN/VPN-ONLY (operator decision 2026-11-08). Disowned from external-dns, so the public
|
|
# headlamp record and its TXT are DELETED and nothing republishes them; LAN/VPN clients keep
|
|
# resolving the name via PiHole's split-horizon wildcard (-> the Gateway VIP). The Cloudflare
|
|
# Tunnel also maps headlamp.${BASE_DOMAIN} to http_status:404 (platform/cloudflared/config.yaml).
|
|
# Same mechanism the renderer emits for `exposure: internal` services; asserted by
|
|
# conformance/tests/l0-static/internal-services-publish-no-public-dns (9c).
|
|
external-dns.alpha.kubernetes.io/controller: none
|
|
spec:
|
|
parentRefs:
|
|
- name: shared
|
|
namespace: gateway
|
|
sectionName: https
|
|
hostnames:
|
|
- headlamp.${BASE_DOMAIN}
|
|
rules:
|
|
- matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
backendRefs:
|
|
- name: headlamp
|
|
port: 80
|