jakman85andClaude Opus 5.5
8fe8d5df8a
Public names are proxied CNAMEs to the Cloudflare Tunnel since PR #156 and work from the LAN, so they should resolve publicly there too. Replace the address=/${BASE_DOMAIN}/ wildcard with explicit entries: the LAN-only names (derived from every controller:none HTTPRoute), gitea/nextcloud (off Cloudflare's 100 MB / 100 s limits), keycloak/auth, and the L4 VIPs. Add L0 check pihole-lan-names, mutation-tested. Correct docs that still described public names as CNAME to wan. and the cloudflared entrypoint comment. Co-Authored-By: Claude Opus 5.5 <[email protected]>
46 lines
2.6 KiB
YAML
46 lines
2.6 KiB
YAML
# =============================================================================
|
|
# L0 STATIC — PiHole answers an explicit LAN name list, and no LAN-only name is left out of it
|
|
# Catalog: docs/14 L0 row ("Pre-apply, in CI") — runs WITHOUT a cluster.
|
|
#
|
|
# Since PR #156 every public name is a proxied CNAME to the Cloudflare Tunnel and works from the
|
|
# LAN, so PiHole's zone wildcard was replaced by an explicit list (catalog/pihole.yaml). That makes
|
|
# the list load-bearing: a route disowned from public DNS and absent from it resolves nowhere. This
|
|
# test derives the required names from the tree (every `controller: none` HTTPRoute, every hostname
|
|
# the tunnel 404s, the L4 Services' own VIPs) and asserts the list covers them, carries no
|
|
# zone-wide entry, and pins gitea and nextcloud to the Gateway VIP. It proves itself non-vacuous by
|
|
# mutation. Rationale and the honest NOT-proven list: check.sh.
|
|
#
|
|
# WHY SCOPE, NOT REQUIREMENTS: the property spans catalog/, apps/, platform/ and runbooks/; a new
|
|
# internal service in any of them can break it, and ci/touched-requirements.sh maps apps/* to no
|
|
# requirement at all, so a requirement-scoped selection would skip it on precisely those changes.
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: pihole-lan-names
|
|
labels:
|
|
conformance.home.k3s/R-DNS-03: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-DNS-03"
|
|
conformance.home.k3s/layer: "L0"
|
|
conformance.home.k3s/scope: "whole-repo"
|
|
conformance.home.k3s/safety-critical: "true"
|
|
conformance.home.k3s/executable: "true"
|
|
conformance.home.k3s/intent: >-
|
|
PiHole answers an explicit list of LAN names rather than the whole zone; every HTTPRoute
|
|
disowned from public DNS has an entry to the Gateway VIP; every hostname the Cloudflare
|
|
Tunnel 404s has an entry, with the L4 names on their own VIPs; and gitea and nextcloud stay
|
|
on the LAN path, off Cloudflare's request-size and timeout limits.
|
|
spec:
|
|
steps:
|
|
- name: assert-pihole-explicit-lan-names
|
|
description: >-
|
|
Parse FTLCONF_misc_dnsmasq_lines from catalog/pihole.yaml and the rendered
|
|
apps/wave-0/pihole.yaml, derive the required names from every `controller: none` HTTPRoute,
|
|
the http_status:404 hostnames in platform/cloudflared/config.yaml and the L4 Services'
|
|
lbipam annotations, assert the list covers them and contains no zone-wide entry, and run
|
|
the evaluator on mutated lists to prove it is not vacuous.
|
|
try:
|
|
- script:
|
|
content: bash ./check.sh
|