jakman85andClaude Opus 5.5
8fe8d5df8a
Public names are proxied CNAMEs to the Cloudflare Tunnel since PR #156 and work from the LAN, so they should resolve publicly there too. Replace the address=/${BASE_DOMAIN}/ wildcard with explicit entries: the LAN-only names (derived from every controller:none HTTPRoute), gitea/nextcloud (off Cloudflare's 100 MB / 100 s limits), keycloak/auth, and the L4 VIPs. Add L0 check pihole-lan-names, mutation-tested. Correct docs that still described public names as CNAME to wan. and the cloudflared entrypoint comment. Co-Authored-By: Claude Opus 5.5 <[email protected]>
43 lines
1.9 KiB
YAML
43 lines
1.9 KiB
YAML
---
|
|
# North-south ingress for Headlamp at headlamp.home.keithjackson.dev. Attaches to the shared Gateway
|
|
# (docs/09); TLS terminated at the Gateway by the *.home.keithjackson.dev wildcard cert (already
|
|
# covers this host). Same-namespace backend, so no ReferenceGrant is needed; the parentRef is
|
|
# permitted because the headlamp namespace carries gateway-access=shared. CR of the Gateway API CRDs
|
|
# — CARRIED BY platform-config (dependsOn platform) so the CRDs exist first (like grafana-httproute).
|
|
#
|
|
# auth-mode annotation records that Headlamp authenticates via native Keycloak OIDC (R-IDP-02); this
|
|
# route is NOT protected by oauth2-proxy forward-auth (Headlamp runs its own OIDC login + per-user
|
|
# token forwarding), so it must NOT carry an oauth2-proxy ExtAuth filter.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: headlamp
|
|
namespace: headlamp
|
|
labels:
|
|
app.kubernetes.io/name: headlamp
|
|
annotations:
|
|
homelab.keithjackson.dev/auth-mode: oidc
|
|
homelab.keithjackson.dev/auth-groups: platform-admins
|
|
# LAN/VPN-ONLY (operator decision 2026-11-08). Disowned from external-dns, so the public
|
|
# headlamp record and its TXT are DELETED and nothing republishes them; LAN/VPN clients keep
|
|
# resolving the name via PiHole's explicit entry for it (-> the Gateway VIP). The Cloudflare
|
|
# Tunnel also maps headlamp.${BASE_DOMAIN} to http_status:404 (platform/cloudflared/config.yaml).
|
|
# Same mechanism the renderer emits for `exposure: internal` services; asserted by
|
|
# conformance/tests/l0-static/internal-services-publish-no-public-dns (9c).
|
|
external-dns.alpha.kubernetes.io/controller: none
|
|
spec:
|
|
parentRefs:
|
|
- name: shared
|
|
namespace: gateway
|
|
sectionName: https
|
|
hostnames:
|
|
- headlamp.${BASE_DOMAIN}
|
|
rules:
|
|
- matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
backendRefs:
|
|
- name: headlamp
|
|
port: 80
|