From 23fc334b8ae1bd5f3c7a2c96c0aa167145e0ad62 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Sun, 16 Aug 2026 00:59:14 -0700
Subject: [PATCH] fix(agent-pod): pin api.riotpiao.com via hostAliases

api.riotpiao.com has no in-cluster DNS record (getaddrinfo ENOTFOUND
from inside the pod, confirmed against google.com resolving fine and
kong-proxy.api.svc.cluster.local resolving fine) -- it only resolves
via the home network's own DNS. Node's fetch/undici also silently
drops a manually-set Host header (forbidden header per WHATWG fetch
spec), so overriding Host per-request isn't viable either. hostAliases
pinning the hostname to ingress-nginx-controller's ClusterIP lets
pi's models.json baseUrl work completely unchanged -- TLS SNI/Host
still say api.riotpiao.com so cert validation and Kong's Host-based
routing both still work.
---
 k8s/apps/agent-pod/deployment.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/k8s/apps/agent-pod/deployment.yaml b/k8s/apps/agent-pod/deployment.yaml
index 51edd75..9cb0f05 100644
--- a/k8s/apps/agent-pod/deployment.yaml
+++ b/k8s/apps/agent-pod/deployment.yaml
@@ -13,6 +13,14 @@ spec:
       labels:
         app: agent-pod
     spec:
+      # api.riotpiao.com has no in-cluster DNS record (only resolves from the
+      # home network's own resolver) -- pin it to ingress-nginx-controller's
+      # ClusterIP so pi's models.json baseUrl works unchanged. TLS still
+      # terminates correctly since SNI/Host still say api.riotpiao.com.
+      hostAliases:
+        - ip: "10.101.128.185"
+          hostnames:
+            - "api.riotpiao.com"
       containers:
         - name: pi
           image: node:22-slim