fix(coredns): own Corefile+hostname rewrites via Talos inlineManifest (single-source terraform/files/coredns/Corefile), drop ArgoCD coredns-config app — in-cluster *.riotpiao.com now resolves to nginx ingress so MinIO/OIDC discovery works; update cp-2 IP .213->.214

terraform/files/coredns/Corefile

@@ -0,0 +1,52 @@
+.:53 {
+    errors
+    health {
+        lameduck 5s
+    }
+    ready
+    log . {
+        class error
+    }
+    prometheus :9153
+
+    # VPN access: map api-server.cluster.local to the cluster API service.
+    rewrite name api-server.cluster.local kubernetes.default.svc.cluster.local
+
+    # Forgejo: route through nginx ingress (TLS on :443, /v2/ registry + web).
+    # Do NOT point at forgejo-gitea-http directly (port 3000 only) — image pulls
+    # use https/:443 and would time out. SSH stays on its own LB service.
+    rewrite name forgejo.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    rewrite name git.riotpiao.com forgejo-gitea-ssh.cicd.svc.cluster.local
+
+    # Homelab hostnames -> nginx ingress controller so in-cluster pods hit nginx
+    # TLS termination (cert-manager cert) and preserve the Host header. Routing
+    # via nginx (not the backend service) is critical: a direct rewrite bypasses
+    # nginx TLS and exposes each app's own self-signed cert, trusted by nothing.
+    rewrite name authentik.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    rewrite name grafana.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    rewrite name minio.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    rewrite name minio-api.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    rewrite name argocd.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    rewrite name vault.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    rewrite name loki.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    rewrite name prometheus.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    rewrite name homarr.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    rewrite name portainer.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    rewrite name longhorn.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+
+    kubernetes cluster.local in-addr.arpa ip6.arpa {
+        pods insecure
+        fallthrough in-addr.arpa ip6.arpa
+        ttl 30
+    }
+    forward . 8.8.8.8 1.1.1.1 {
+       max_concurrent 1000
+    }
+    cache 30 {
+       disable success cluster.local
+       disable denial cluster.local
+    }
+    loop
+    reload
+    loadbalance
+}

terraform/main.tf

@@ -41,6 +41,7 @@ resource "local_file" "controlplane_configs" {
     forgejo_hostname    = var.forgejo_hostname
     zone                = each.value.zone
     allow_scheduling    = each.value.allow_scheduling
+    coredns_corefile    = file("${path.module}/files/coredns/Corefile")
 
     # Cloudflare Tunnel cert SANs (talos :50000 and kube-apiserver :6443)
     cloudflare_talos_sans     = each.value.cloudflare_talos_sans

terraform/templates/controlplane.tftpl

@@ -164,3 +164,18 @@ cluster:
         kind: Namespace
         metadata:
           name: kube-system
+    # CoreDNS Corefile with homelab hostname rewrites (single source of truth in
+    # terraform/files/coredns/Corefile). In-cluster pods resolve *.riotpiao.com to
+    # the nginx ingress controller so OIDC auto-discovery against
+    # authentik.riotpiao.com works and the Host header is preserved. Owned by
+    # Talos — do NOT also manage the coredns ConfigMap via ArgoCD.
+    - name: coredns-config
+      contents: |
+        apiVersion: v1
+        kind: ConfigMap
+        metadata:
+          name: coredns
+          namespace: kube-system
+        data:
+          Corefile: |
+            ${indent(12, coredns_corefile)}