# cloudflared ingress configuration.
#
# This list is the tunnel's routing table: for each incoming hostname the
# connector dials the matching origin. The final rule is a catch-all, so a
# hostname absent from this list gets 404 from the connector — DNS alone does
# not route a request into a service.
#
# Management model: this file makes the tunnel LOCALLY managed. cloudflared is
# given a credentials file instead of a token, so Cloudflare stops pushing the
# remotely-managed ingess list and this ConfigMap wins. Revert the Deployment to
# `run --token` to return to the dashboard-managed list.
#
# Origin services self-reference the public hostname. That resolves because
# CoreDNS rewrites each of these names to ingress-nginx
# (terraform/files/coredns/Corefile), so the connector reaches the in-cluster
# ingress instead of looping back out through Cloudflare.
apiVersion: v1
kind: ConfigMap
metadata:
  name: cloudflared-config
  namespace: cloudflared
data:
  config.yml: |
    tunnel: 32d0bf93-e1bd-45b8-93a9-71ff9f83de80
    credentials-file: /etc/cloudflared/creds/credentials.json

    # WARP-to-Tunnel routing. The remotely-managed config had this enabled;
    # dropping the key would break WARP access to private addresses. cloudflared
    # 2026.x has no `enabled` field — the key's presence is what enables it, and
    # `enabled: true` here makes the binary warn about an unused key.
    warp-routing: {}

    ingress:
      - hostname: paperless.riotpiao.com
        service: https://paperless.riotpiao.com
      - hostname: img.riotpiao.com
        service: https://img.riotpiao.com
      - hostname: riotpiao.com
        service: https://riotpiao.com
      - hostname: grafana.riotpiao.com
        service: https://grafana.riotpiao.com
      - hostname: gotify.riotpiao.com
        service: https://gotify.riotpiao.com
      - hostname: igotify.riotpiao.com
        service: https://igotify.riotpiao.com
      - hostname: poimen.riotpiao.com
        service: https://poimen.riotpiao.com
      - hostname: comfyui.riotpiao.com
        service: https://comfyui.riotpiao.com
      - hostname: forgejo.riotpiao.com
        service: https://forgejo.riotpiao.com
      # ZITADEL. Without this rule the connector answers 404 for the hostname
      # even though the DNS CNAME points at the tunnel.
      - hostname: zitadel.riotpiao.com
        service: https://zitadel.riotpiao.com
      # KUBERNETES API, for kubectl from outside the LAN.
      #
      # Origin is the in-cluster Service, not the node IP: that survives a
      # control-plane address change and lets the connectors reach whichever
      # apiserver is local-healthy.
      #
      # noTLSVerify is required. The apiserver serves a certificate for the
      # cluster CA plus its node/LB addresses, so its SANs cannot match this
      # public hostname. Cloudflare terminates the public TLS with the
      # *.riotpiao.com edge certificate, and the connector hop is already
      # inside the cluster, so skipping verification on that short hop is the
      # least-bad option. Do not widen this to other rules.
      #
      # SECURITY: this exposes the API to the internet. Authentication is still
      # ZITADEL OIDC plus client certificates, but put a Cloudflare Access
      # application in front of this hostname as well -- see the note in the
      # PR. Without Access, every scanner on the internet reaches the apiserver.
      - hostname: k8s.riotpiao.com
        service: https://kubernetes.default.svc.cluster.local:443
        originRequest:
          noTLSVerify: true
      - service: http_status:404