rock
63a6784ea9
#88 added a tunnel rule mapping k8s.riotpiao.com to the in-cluster apiserver. Its own comment warned that without a Cloudflare Access application in front, every scanner on the internet reaches the apiserver, and no Access application exists. ArgoCD applied the rule before the exposure could be stopped, so the live ConfigMap was patched and cloudflared restarted to drop it. All paths now return 404. This commit removes the rule from the source so it cannot return. The hostname keeps its DNS record and returns the tunnel's 404 fallback. That is deliberate: publish it again only together with an Access policy.
55 lines
2.3 KiB
YAML
55 lines
2.3 KiB
YAML
# cloudflared ingress configuration.
|
|
#
|
|
# This list is the tunnel's routing table: for each incoming hostname the
|
|
# connector dials the matching origin. The final rule is a catch-all, so a
|
|
# hostname absent from this list gets 404 from the connector — DNS alone does
|
|
# not route a request into a service.
|
|
#
|
|
# Management model: this file makes the tunnel LOCALLY managed. cloudflared is
|
|
# given a credentials file instead of a token, so Cloudflare stops pushing the
|
|
# remotely-managed ingess list and this ConfigMap wins. Revert the Deployment to
|
|
# `run --token` to return to the dashboard-managed list.
|
|
#
|
|
# Origin services self-reference the public hostname. That resolves because
|
|
# CoreDNS rewrites each of these names to ingress-nginx
|
|
# (terraform/files/coredns/Corefile), so the connector reaches the in-cluster
|
|
# ingress instead of looping back out through Cloudflare.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: cloudflared-config
|
|
namespace: cloudflared
|
|
data:
|
|
config.yml: |
|
|
tunnel: 32d0bf93-e1bd-45b8-93a9-71ff9f83de80
|
|
credentials-file: /etc/cloudflared/creds/credentials.json
|
|
|
|
# WARP-to-Tunnel routing. The remotely-managed config had this enabled;
|
|
# dropping the key would break WARP access to private addresses. cloudflared
|
|
# 2026.x has no `enabled` field — the key's presence is what enables it, and
|
|
# `enabled: true` here makes the binary warn about an unused key.
|
|
warp-routing: {}
|
|
|
|
ingress:
|
|
- hostname: paperless.riotpiao.com
|
|
service: https://paperless.riotpiao.com
|
|
- hostname: img.riotpiao.com
|
|
service: https://img.riotpiao.com
|
|
- hostname: riotpiao.com
|
|
service: https://riotpiao.com
|
|
- hostname: grafana.riotpiao.com
|
|
service: https://grafana.riotpiao.com
|
|
- hostname: gotify.riotpiao.com
|
|
service: https://gotify.riotpiao.com
|
|
- hostname: igotify.riotpiao.com
|
|
service: https://igotify.riotpiao.com
|
|
- hostname: poimen.riotpiao.com
|
|
service: https://poimen.riotpiao.com
|
|
- hostname: forgejo.riotpiao.com
|
|
service: https://forgejo.riotpiao.com
|
|
# ZITADEL. Without this rule the connector answers 404 for the hostname
|
|
# even though the DNS CNAME points at the tunnel.
|
|
- hostname: zitadel.riotpiao.com
|
|
service: https://zitadel.riotpiao.com
|
|
- service: http_status:404
|