jakman85andClaude Opus 5
2d7d302c7e
Prod reconciled from http://192.168.2.132:3000 — a podman container on the operator's WORKSTATION, holding a DHCP lease on WIFI. Production's source of truth was a laptop: a lease change or a closed lid stalls all reconciliation. Dev was pointed there too (deliberately, to break a strand risk during its DNS migration), so BOTH clusters depended on it simultaneously. Prod now reconciles from https://gitea.prod.home.keithjackson.dev/... — the Gitea prod itself runs, which apps-wave-0 has been serving for 28h. THE SELF-REFERENCE IS THE WHOLE DIFFICULTY, and it is why this is a commit rather than a kubectl patch. The root Kustomization renders ./clusters/prod, which CONTAINS the patch that sets GitRepository.spec.url — so a live patch is reverted on the next reconcile unless the AUTHORED value moves with it. Dev hit the identical trap on 2026-09-05. The ordered cutover: 1. push the repo to prod's Gitea (18 branches, refs verified identical, 499 commits of history — a real move, not a shallow copy); 2. fast-forward prod Gitea's `main` toc8c1d29, the EXACT commit prod was already running, so swapping the source changed nothing else. Its main had been at4809199, and repointing to that would have ROLLED PROD BACKWARDS, undoing the per-environment BASE_DOMAIN work and sending prod at the apex — the collision with live dev that two days of work exists to prevent; 3. live-patch spec.url to open a window (source changed, content identical: Ready=True at the same revision on the first poll); 4. land THIS commit through that window so the authored value agrees. VERIFIED FROM INSIDE PROD, not from the workstation: a throwaway pod resolved gitea.prod.home.keithjackson.dev through in-cluster CoreDNS to the Gateway VIP (192.168.2.20) and cloned main over the public Let's Encrypt cert with NO CA supplied. That exercises split-horizon DNS, the Gateway, Gitea and TLS on the pod network — the path Flux actually uses. A workstation clone proves none of it. The bootstrap Gitea is retained as a recovery path, not deleted (bootstrap/gitea/bootstrap-gitea.sh). Dev still reconciles from it on branch `dev-live` and returns to its own Gitea at step D4 of the §10a migration runbook. Refs R-GITOPS-01, R-ENV-02. Co-Authored-By: Claude Opus 5 <[email protected]>