ADR-0016 (Proposed): public ingress via Cloudflare Tunnel

Record the operator's 2026-11-08 decision to move public HTTP(S) ingress
from edge port-forwarding of 80/443 to an outbound-only Cloudflare Tunnel
(in-cluster cloudflared, proxied CNAMEs via ExternalDNS). Motivation: the
GFiber router cannot hairpin NAT and advertises Google IPv6 DNS via RA, so
LAN clients bypass Pi-hole split horizon and fail.

Docs 00/01/03/07/08/09/13/14, GLOSSARY and definition-of-done brought into
line. R-DNS-01..03 and R-TLS-01..03 wording unchanged. New requirements:
R-DNS-04 (no 80/443 forward, resolver-independent LAN reachability),
R-DNS-05 (only `public` services at the tunnel; 404 catch-all; no public
record for `internal`), R-SEC-04 (Kubernetes API never publicly reachable).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

GLOSSARY.md

@@ -26,8 +26,11 @@ two things (e.g. "VM"), this file disambiguates.
   the port level (R-NET-01).
 - **Egress class** — a service's declared outbound path: `internet` (standard WAN) or `vpn`
   (commercial VPN tunnel). See [`docs/03-networking-isolation-and-egress.md`](docs/03-networking-isolation-and-egress.md).
-- **Exposure class** — how a service is reachable: `internal` (LAN-only) or `public` (edge
-  port-forwarded).
+- **Exposure class** — how a service is reachable: `internal` (LAN/VPN-only) or `public` (published
+  through the Cloudflare Tunnel, ADR-0016).
+- **Cloudflare Tunnel** — the outbound-only connection from in-cluster cloudflared to Cloudflare that
+  carries all public HTTP(S) ingress; public records are proxied CNAMEs to `<uuid>.cfargotunnel.com`
+  (ADR-0016).
 - **Kill-switch** — the guarantee that a `vpn`-class workload leaks nothing to the plain internet if
   the tunnel drops (R-NET-06); fail-closed.
 - **Multi-WAN** — multiple upstream internet uplinks with routing-rule-based selection; physical WAN