willemjan ef58a7c0ca fix: drop lan-only ipAllowList (klipper-lb SNATs all LB traffic to 10.42.0.1, so Traefik never sees real client IPs) ...

Internal-only for argocd/auth/adguard.labzand.com is now enforced at DNS level:
cloudflare-ddns only publishes ns.labzand.com; internal names resolve solely via
AdGuard rewrites. Delete the *.labzand.com A record in Cloudflare once.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <[email protected]>

2026-11-14 17:35:35 +01:00

..

cert.yaml

feat: move argocd/authentik to *.labzand.com with Cloudflare DNS-01 wildcard certs

2026-11-06 20:37:30 +01:00

ingress.yaml

fix: drop lan-only ipAllowList (klipper-lb SNATs all LB traffic to 10.42.0.1, so Traefik never sees real client IPs)

2026-11-14 17:35:35 +01:00

ingressroute-redirect.yaml

feat: lan-only + force-ssl for argocd/authentik/adguard labzand.com ingresses

2026-11-14 16:37:02 +01:00

install.yaml

added argocd install to git

2026-10-15 09:06:12 +02:00

middleware.yaml

fix: drop lan-only ipAllowList (klipper-lb SNATs all LB traffic to 10.42.0.1, so Traefik never sees real client IPs)

2026-11-14 17:35:35 +01:00