Internal-only for argocd/auth/adguard.labzand.com is now enforced at DNS level:
cloudflare-ddns only publishes ns.labzand.com; internal names resolve solely via
AdGuard rewrites. Delete the *.labzand.com A record in Cloudflare once.
Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <[email protected]>
ipAllowList middleware (192.168.0.0/16) on the websecure routers blocks
external access; separate IngressRoute on web 301-redirects http->https.
Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <[email protected]>
Internal-only hostnames (argocd.labzand.com, auth.labzand.com) via AdGuard
wildcard rewrite; certs still valid via DNS-01 so no browser warnings.
Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <[email protected]>
A router with TLS enabled (from the Ingress tls section) never matches on
the plain web entrypoint, so entrypoints web,websecure on the Ingress itself
still 404'd on :80. Keep the Ingress on websecure only and add an
IngressRoute on web with the redirect-https middleware.
Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <[email protected]>
willemjan