willemjan/cluster
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: drop lan-only ipAllowList (klipper-lb SNATs all LB traffic to 10.42.0.1, so Traefik never sees real client IPs)

Browse Source 
Internal-only for argocd/auth/adguard.labzand.com is now enforced at DNS level:
cloudflare-ddns only publishes ns.labzand.com; internal names resolve solely via
AdGuard rewrites. Delete the *.labzand.com A record in Cloudflare once.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <[email protected]>
This commit is contained in:
willemjan
2026-11-14 17:35:35 +01:00
parent 43fdc020f4
commit ef58a7c0ca
7 changed files with 11 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/cloudfare-ddns/configmap.yaml
+5 -2
View File
@@ -6,5 +6,8 @@ metadata:
data:
# Comma-separated list of domains to update
# Format: subdomain.domain.tld,subdomain2.domain.tld
DOMAINS: "*.labzand.com"
ZONE_ID: "6093605ad5a8db13e9c9d9faad240ca6"
# Alleen namen die écht publiek bereikbaar moeten zijn (via router -> cluster).
# Interne-only namen (argocd/auth/adguard.labzand.com) bewust NIET hier:
# die krijgen geen publiek A-record en resolven alleen intern via AdGuard.
DOMAINS: "ns.labzand.com"
ZONE_ID: "6093605ad5a8db13e9c9d9faad240ca6"