jakman85andClaude Opus 5
fbaeb3e038
Remote Plex clients had no path in, for two measured reasons: Plex advertised no remote connection at all (customConnections and ManualPortMappingMode both ABSENT while PublishServerOnPlexOnlineKey=1), and its Service was ClusterIP, so 32400 had no off-cluster path. The L7 Gateway was NOT the problem -- it serves Plex correctly (200, claimed=1, 401 on protected endpoints) -- but Plex clients discover servers through plex.tv, not DNS, so an HTTPRoute cannot put this server on a client's connection list. Operator chose the native path over ADVERTISE_IP: Plex terminates its own TLS with *.plex.direct and streams bypass the Envoy L7 hop. Adds a hand-written non-catalog unit (the SD schema cannot express a LoadBalancer Service or a pinned lbipam VIP), registered in render.py's EXTRA_UNITS so --emit-waves places it in plex's own wave. externalTrafficPolicy: Cluster, inheriting crafty's 8-day-outage lesson rather than re-deriving it. Known consequence, documented: SNAT puts remote clients inside ALLOWED_NETWORKS, so Plex meters them as LAN. Not an auth change. Remote access does NOT work until the operator does two manual steps that cannot live in this repo -- the WAN tcp/32400 forward and Plex's "manually specify public port" toggle (no env var exists for it; verified NONE in the image's init surface). runbooks/plex-remote-access.md is the procedure. Touches clusters/** -- a sensitive path -- so the approval-policy stage will block pending an operator /approve-override. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
30 lines
1.1 KiB
YAML
30 lines
1.1 KiB
YAML
---
|
|
# Wave 0 of the app tier — GENERATED by `catalog/render.py --emit-waves`.
|
|
# Reconciled by the Flux Kustomization `apps-wave-0` (clusters/base/apps-wave-0.yaml), which dependsOn `platform-config` and health-gates
|
|
# (wait:true) ONLY this wave — a crashloop here cannot stall an earlier wave.
|
|
# DO NOT hand-edit: re-run `render.py --emit-waves` after onboarding a service.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- gitea-bootstrap-secret.sops.yaml
|
|
- gitea.yaml
|
|
- jackett-oauth2-proxy-credentials.sops.yaml
|
|
- jackett.yaml
|
|
- nextcloud-db-app.sops.yaml
|
|
- nextcloud-db-backup-credentials-prod.sops.yaml
|
|
- nextcloud-db-backup-credentials.sops.yaml
|
|
- nextcloud-db.yaml
|
|
- pihole-dns.yaml
|
|
- pihole-oauth2-proxy-credentials.sops.yaml
|
|
- pihole.yaml
|
|
- plex-claim-secret.sops.yaml
|
|
- plex-remote.yaml
|
|
- plex.yaml
|
|
- qbittorrent-bootstrap-secret.sops.yaml
|
|
- qbittorrent-oauth2-proxy-credentials.sops.yaml
|
|
- qbittorrent.yaml
|
|
- semaphore-db-app.sops.yaml
|
|
- semaphore-db-backup-credentials-prod.sops.yaml
|
|
- semaphore-db-backup-credentials.sops.yaml
|
|
- semaphore-db.yaml
|