Gitea is now served via Traefik on gitea.labzand.com (external-gitea);
the old duckdns host has no route once the router points at the node.
Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <[email protected]>
- ingress.yaml had invalid 'https:' rules key (dropped by apiserver -> OutOfSync);
replaced by IngressRoute on websecure with scheme:https + ServersTransport
(insecureSkipVerify) since Proxmox :8006 is https with self-signed cert
- EndpointSlice apply fails with kubectl 1.31 vs server 1.36 ('unknown field
spec'), so keep v1 Endpoints (auto-mirrored to EndpointSlice); fixed spec
- shared namespace+middleware moved to services/external (app 'external')
Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <[email protected]>
Internal-only for argocd/auth/adguard.labzand.com is now enforced at DNS level:
cloudflare-ddns only publishes ns.labzand.com; internal names resolve solely via
AdGuard rewrites. Delete the *.labzand.com A record in Cloudflare once.
Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <[email protected]>
ipAllowList middleware (192.168.0.0/16) on the websecure routers blocks
external access; separate IngressRoute on web 301-redirects http->https.
Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <[email protected]>
Internal-only hostnames (argocd.labzand.com, auth.labzand.com) via AdGuard
wildcard rewrite; certs still valid via DNS-01 so no browser warnings.
Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <[email protected]>
A router with TLS enabled (from the Ingress tls section) never matches on
the plain web entrypoint, so entrypoints web,websecure on the Ingress itself
still 404'd on :80. Keep the Ingress on websecure only and add an
IngressRoute on web with the redirect-https middleware.
Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <[email protected]>
willemjan