rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(cloudflared): wire tunnel token secret and document bootstrap

Browse Source 
- Create SOPS-encrypted cloudflared-secrets.enc.yaml with tunnel token
- Add Cloudflare vars to .env.example (CLOUDFLARE_CONNECTOR_TOKEN, ACCOUNT_ID, TUNNEL_ID, API_TOKEN)
- Document Phase 0 cloudflared-token Secret creation in BOOTSTRAP.md (manual step until CMP plugin wires it)
- Note: Cloudflare-side TCP routing (cp1.homelab -> 192.168.1.213:6443, etc.) must be configured manually in Zero Trust dashboard

Tunnel already deployed as ArgoCD Application in k8s/argocd/apps/60-applications.yaml (wave 8); this closes the missing Secret gap and documents the bootstrap path.
This commit is contained in:
Story Crater Bot
2026-07-20 10:50:20 -07:00
parent a207c56637
commit 063308308f
4 changed files with 57 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CLAUDE.example.md
+17 -3
View File
@@ -2,6 +2,18 @@
**Homelab:** A bare-metal three-node Kubernetes cluster running Talos Linux with a full observability stack, SSO via Authentik, secret management via Vault, and CI/CD infrastructure (Forgejo + Argo CD, deployed).
## Cluster Topology (3 control-plane HA, since 2026-07-20)
| Node | IP | Zone | Scheduling | Storage |
|------|----|----|-----------|---------|
| `talos-cp-1` | .213 | az-a | schedulable (all workloads) | sole Longhorn node |
| `talos-cp-2` | .163 | az-b | dedicated (`NoSchedule`) | none |
| `talos-cp-3` | .166 | az-c | dedicated (`NoSchedule`) | none |
3 voting etcd members peering on the LAN. Only `talos-cp-1` runs workloads and
holds storage → stateful services are single-instance (e.g. CNPG `ddb-cluster`
= 1 instance). API endpoint is single-homed to `.213` (no VIP yet).
## Service Integration Routes
**New service? Pick your stack below:**
@@ -31,9 +43,9 @@ Apps: cicd (Forgejo + Argo CD), sqs (Kafka + kmsvc), temporal, story-crater-back
**Architecture principles:**
- Immutable OS (Talos — no SSH, declarative config)
- Secrets in Vault (never commit `.env`, credentials in Secret volumes)
- Helmfile = single source of truth (`helmfile.yaml.gotmpl`)
- Pull-based GitOps (Argo CD, no kubeconfig in CI)
- Secrets in Vault + SOPS-encrypted (`*.enc.yaml`, age); never commit `.env`
- ArgoCD app-of-apps = CD source of truth (`k8s/argocd/root` → `k8s/argocd/apps/*`); helmfile is deprecated. Two-phase bootstrap in `k8s/argocd/bootstrap/BOOTSTRAP.md`
- Pull-based GitOps (Argo CD, no kubeconfig in CI); iterate = `git push` to Forgejo → auto-sync
- Federated OIDC (Authentik provider for all services)
@@ -53,6 +65,8 @@ Apps: cicd (Forgejo + Argo CD), sqs (Kafka + kmsvc), temporal, story-crater-back
3. **Secrets via volumes** — Never `--env` flag in pod specs (exposes in `kubectl describe`)
4. **External services via Ingress** — All public endpoints via TLS (homelab-ca)
5. **Never commit `.env`** — Only `.env.example` in git; real secrets in Vault
6. **Never rename or wipe `talos-cp-1` (.213)** — sole Longhorn storage node; renaming orphans its node CR and faults every volume (permanent data loss). Rename/reprovision only the dedicated CPs.
7. **Control-plane etcd advertises on the LAN** — keep `cluster.etcd.advertisedSubnets: ["192.168.1.0/24"]`, else Talos advertises on WireGuard and new members hang as etcd learners.
## Git & Release