fix: drop lan-only ipAllowList (klipper-lb SNATs all LB traffic to 10.42.0.1, so Traefik never sees real client IPs)

Internal-only for argocd/auth/adguard.labzand.com is now enforced at DNS level: cloudflare-ddns only publishes ns.labzand.com; internal names resolve solely via AdGuard rewrites. Delete the *.labzand.com A record in Cloudflare once. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <[email protected]>
2026-11-14 17:35:35 +01:00
parent 43fdc020f4
commit ef58a7c0ca
7 changed files with 11 additions and 46 deletions
@@ -6,7 +6,6 @@ metadata:
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"
-    traefik.ingress.kubernetes.io/router.middlewares: argocd-lan-only@kubernetescrd
 spec:
  ingressClassName: traefik
  rules: