riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 23 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

feat(cloudflared): manage tunnel ingress locally via ConfigMap #69

Closed
rock wants to merge 0 commits from harness/zitadel-iam-wiring into main
pull from: harness/zitadel-iam-wiring
merge into: :main
Conversation 0 Commits - Files Changed -
rock commented 2026-10-26 03:00:23 +00:00
Owner
Copy Link
Copy Source

The tunnel was remotely managed from the Zero Trust dashboard: the Deployment ran run --token and ignored the ConfigMap already in the tree. This switches to a locally-managed tunnel so the ingress routing table lives in git.

  • deployment: mount cloudflared-config (config.yml) and the cloudflared-credentials Secret; drop TUNNEL_TOKEN
  • configmap.yaml: per-hostname ingress rules to ingress-nginx via the CoreDNS rewrite, plus a 404 catch-all
  • secret-generator: register the SOPS-encrypted credentials file
  • homelab-ca: add the cloudflared namespace copy so the connector trusts the ingress certificate (force-ssl-redirect makes plaintext impossible)

Credentials were extracted from the live cloudflared-token Secret and re-encrypted with SOPS; no plaintext secret is committed.

Adds zitadel.riotpiao.com to the ingress list — the remotely-managed config lacked it, which is why that hostname returns 404 today.

The tunnel was remotely managed from the Zero Trust dashboard: the Deployment ran `run --token` and ignored the ConfigMap already in the tree. This switches to a locally-managed tunnel so the ingress routing table lives in git. - deployment: mount `cloudflared-config` (config.yml) and the `cloudflared-credentials` Secret; drop `TUNNEL_TOKEN` - configmap.yaml: per-hostname ingress rules to ingress-nginx via the CoreDNS rewrite, plus a 404 catch-all - secret-generator: register the SOPS-encrypted credentials file - homelab-ca: add the cloudflared namespace copy so the connector trusts the ingress certificate (`force-ssl-redirect` makes plaintext impossible) Credentials were extracted from the live `cloudflared-token` Secret and re-encrypted with SOPS; no plaintext secret is committed. Adds `zitadel.riotpiao.com` to the ingress list — the remotely-managed config lacked it, which is why that hostname returns 404 today.
rock added 1 commit 2026-10-26 03:00:24 +00:00
feat(cloudflared): manage tunnel ingress locally via ConfigMap 227a67a8c1 
The tunnel was remotely managed from the Zero Trust dashboard: the
Deployment ran 'run --token' and ignored the ConfigMap that already
existed in the tree. Switch to a locally-managed tunnel so the ingress
routing table lives in git.

- deployment: mount cloudflared-config (config.yml) and the
  cloudflared-credentials Secret; drop TUNNEL_TOKEN env
- configmap.yaml: per-hostname ingress rules to ingress-nginx via the
  CoreDNS rewrite, plus a 404 catch-all
- secret-generator: register the SOPS-encrypted credentials file
- homelab-ca: add the cloudflared namespace copy so the connector trusts
  the ingress certificate (force-ssl-redirect makes plaintext impossible)

Credentials were extracted from the live cloudflared-token Secret and
re-encrypted with SOPS; no plaintext secret is committed.
rock closed this pull request 2026-10-26 03:26:52 +00:00

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
area/auth
Authentication & authorization
 area/authentik
Authentik OIDC provider config
 area/downstream
Downstream service changes
 area/event-bus
Event routing and notification pipeline
 area/gateway
API gateway code (homelab-frontend)
 area/notifications
Gotify, SMTP, push notifications
 area/observer
Poimen goal-driven observation and pattern detection
 priority/high
Must have
 priority/medium
Should have
 status/blocked
Blocked by dependency
 status/done
Completed
 status/in-progress
Currently being worked on
 status/review
Ready for review
 status/todo
Not started
 type/docs
Documentation
 type/feature
New feature
 type/infra
Infrastructure change
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
poimen rock (Rock)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#69