From 4d27cc057b809d28ccdb64013cef10b1239929f5 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Wed, 19 Aug 2026 23:25:41 -0700
Subject: [PATCH] fix: resolve forgejo.riotpiao.com to the ingress LB on nodes

The pinned ClusterIP died when the rev-6 upgrade recreated the Service, timing
out every node image pull.
---
 terraform/variables.tf | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/terraform/variables.tf b/terraform/variables.tf
index 8693c03..2faf212 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -179,8 +179,18 @@ variable "cluster_config" {
 
 variable "forgejo_registry_ip" {
   type        = string
-  default     = "10.107.155.96"
-  description = "Forgejo registry (container repo) ClusterIP for host DNS rewrite"
+  default     = "192.168.1.160"
+  description = <<-EOT
+    Address the nodes resolve forgejo.riotpiao.com to, via extraHostEntries.
+    Used by kubelet/containerd for image pulls.
+
+    This is the ingress-nginx LoadBalancer IP, pinned by the Cilium pool
+    192.168.1.160/28, NOT a ClusterIP. It was previously the ingress-nginx
+    ClusterIP 10.107.155.96; the rev-6 Helm upgrade on 2026-08-13 recreated the
+    Service and reassigned that address, leaving every node with a dead hosts
+    entry and every image pull failing on i/o timeout. A ClusterIP rots on any
+    Service recreation; the LB IP does not.
+  EOT
 }
 
 variable "forgejo_hostname" {