integration: merge minio-client fix, local-path backend, and local cloudflared ingress #70

2026-10-26T03:24:12Z

rock commented

2026-10-26 03:24:12 +00:00

Combines three open PRs with conflicts resolved locally.

Closes #56
Closes #58
Closes #69

Conflict resolution in k8s/apps/paperless/backup-cronjob.yaml and k8s/infra/minio/minio-provision-paperless-job.yaml: kept the digest-pinned bitnamilegacy/minio-client image from main and added the explanatory comment from #56.

Structural gate: 0 error, 3 warning (unpinned images pre-existing in main: cloudflared:latest, postgres:16-alpine, debian:bookworm init container).

Combines three open PRs with conflicts resolved locally. Closes #56 Closes #58 Closes #69 Conflict resolution in k8s/apps/paperless/backup-cronjob.yaml and k8s/infra/minio/minio-provision-paperless-job.yaml: kept the digest-pinned bitnamilegacy/minio-client image from main and added the explanatory comment from #56. Structural gate: 0 error, 3 warning (unpinned images pre-existing in main: cloudflared:latest, postgres:16-alpine, debian:bookworm init container).

rock added 6 commits 2026-10-26 03:24:13 +00:00

fix(minio): replace the dead minio/mc image in the provision hook and backup job 71b3cef2eb

feat(storage): add local-path-provisioner as the fleet's persistent-storage backend ebb1b9b02d

feat(cloudflared): manage tunnel ingress locally via ConfigMap 227a67a8c1

The tunnel was remotely managed from the Zero Trust dashboard: the
Deployment ran 'run --token' and ignored the ConfigMap that already
existed in the tree. Switch to a locally-managed tunnel so the ingress
routing table lives in git.

- deployment: mount cloudflared-config (config.yml) and the
  cloudflared-credentials Secret; drop TUNNEL_TOKEN env
- configmap.yaml: per-hostname ingress rules to ingress-nginx via the
  CoreDNS rewrite, plus a 404 catch-all
- secret-generator: register the SOPS-encrypted credentials file
- homelab-ca: add the cloudflared namespace copy so the connector trusts
  the ingress certificate (force-ssl-redirect makes plaintext impossible)

Credentials were extracted from the live cloudflared-token Secret and
re-encrypted with SOPS; no plaintext secret is committed.

merge: fix/minio-mc-image (keep digest pin + comment) 3e079b1cf7

merge: feat/local-path-backend 52bca6b1b6

merge: harness/zitadel-iam-wiring 3ec46d26f0

rock merged commit f9af686c36 into main

2026-10-26 03:24:34 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#70