rock
7f96da880f
Commit a02bee5 had both the Ingress rule and the cloudflared tunnel
hostname for authentik.riotpiao.com. Both were lost, so the tunnel
answered 404 for the hostname and the ingress had no matching rule.
The CoreDNS rewrite and the authentik-server Service were still intact;
only the two routing entries were missing. Re-add the Ingress (namespace
iam, service authentik-server port 80, TLS terminated by the wildcard
default-ssl-certificate) and the tunnel hostname.
61 lines
2.6 KiB
YAML
61 lines
2.6 KiB
YAML
# cloudflared ingress configuration.
|
|
#
|
|
# This list is the tunnel's routing table: for each incoming hostname the
|
|
# connector dials the matching origin. The final rule is a catch-all, so a
|
|
# hostname absent from this list gets 404 from the connector — DNS alone does
|
|
# not route a request into a service.
|
|
#
|
|
# Management model: this file makes the tunnel LOCALLY managed. cloudflared is
|
|
# given a credentials file instead of a token, so Cloudflare stops pushing the
|
|
# remotely-managed ingess list and this ConfigMap wins. Revert the Deployment to
|
|
# `run --token` to return to the dashboard-managed list.
|
|
#
|
|
# Origin services self-reference the public hostname. That resolves because
|
|
# CoreDNS rewrites each of these names to ingress-nginx
|
|
# (terraform/files/coredns/Corefile), so the connector reaches the in-cluster
|
|
# ingress instead of looping back out through Cloudflare.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: cloudflared-config
|
|
namespace: cloudflared
|
|
data:
|
|
config.yml: |
|
|
tunnel: 32d0bf93-e1bd-45b8-93a9-71ff9f83de80
|
|
credentials-file: /etc/cloudflared/creds/credentials.json
|
|
|
|
# WARP-to-Tunnel routing. The remotely-managed config had this enabled;
|
|
# dropping the key would break WARP access to private addresses. cloudflared
|
|
# 2026.x has no `enabled` field — the key's presence is what enables it, and
|
|
# `enabled: true` here makes the binary warn about an unused key.
|
|
warp-routing: {}
|
|
|
|
ingress:
|
|
- hostname: paperless.riotpiao.com
|
|
service: https://paperless.riotpiao.com
|
|
- hostname: img.riotpiao.com
|
|
service: https://img.riotpiao.com
|
|
- hostname: riotpiao.com
|
|
service: https://riotpiao.com
|
|
- hostname: grafana.riotpiao.com
|
|
service: https://grafana.riotpiao.com
|
|
- hostname: gotify.riotpiao.com
|
|
service: https://gotify.riotpiao.com
|
|
- hostname: igotify.riotpiao.com
|
|
service: https://igotify.riotpiao.com
|
|
- hostname: poimen.riotpiao.com
|
|
service: https://poimen.riotpiao.com
|
|
- hostname: comfyui.riotpiao.com
|
|
service: https://comfyui.riotpiao.com
|
|
- hostname: forgejo.riotpiao.com
|
|
service: https://forgejo.riotpiao.com
|
|
# ZITADEL. Without this rule the connector answers 404 for the hostname
|
|
# even though the DNS CNAME points at the tunnel.
|
|
- hostname: zitadel.riotpiao.com
|
|
service: https://zitadel.riotpiao.com
|
|
# AUTHENTIK. Same reasoning as ZITADEL: a hostname absent from this table
|
|
# gets 404 from the connector. CoreDNS rewrites the name to ingress-nginx.
|
|
- hostname: authentik.riotpiao.com
|
|
service: https://authentik.riotpiao.com
|
|
- service: http_status:404
|