Commit Graph
8 Commits
Author SHA1 Message Date
willemjan ef58a7c0ca fix: drop lan-only ipAllowList (klipper-lb SNATs all LB traffic to 10.42.0.1, so Traefik never sees real client IPs)
Internal-only for argocd/auth/adguard.labzand.com is now enforced at DNS level:
cloudflare-ddns only publishes ns.labzand.com; internal names resolve solely via
AdGuard rewrites. Delete the *.labzand.com A record in Cloudflare once.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <[email protected]>
2026-11-14 17:35:35 +01:00
willemjan 43fdc020f4 feat: lan-only + force-ssl for argocd/authentik/adguard labzand.com ingresses
ipAllowList middleware (192.168.0.0/16) on the websecure routers blocks
external access; separate IngressRoute on web 301-redirects http->https.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <[email protected]>
2026-11-14 16:37:02 +01:00
willemjan e857cb989c feat: adguard admin console on adguard.labzand.com (internal-only, labzand wildcard cert)
Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <[email protected]>
2026-11-06 20:43:20 +01:00
willemjan fada4e68b4 fix mounts 2026-10-16 17:17:14 +02:00
willemjan 9b1b4445ff Update services/adguard/app.yaml 2026-10-15 18:52:51 +00:00
willemjan 7ee1f967ae fix mounts adguard 2026-10-15 15:29:14 +02:00
willemjan a701b1e85b fix: volume mounts adguard 2026-10-15 15:16:24 +02:00
willemjan b5d859b6cb added adguard and agrocd self management 2026-10-15 09:23:32 +02:00