k8s/services: add ingress networking portainer llm and project guides

- Nginx ingress + TLS termination (homelab-ca) - Portainer container UI - CoreDNS internal DNS rewrites - DuckDNS DDNS updater - Ollama LLM inference - 8 project-usage guides (team reference)
2026-07-11 19:17:54 -07:00
parent 1c02e2b831
commit 6d5a0ba205
26 changed files with 3280 additions and 0 deletions
@@ -0,0 +1,67 @@
+# k8s/coredns/coredns-configmap.yaml
+# Patches the CoreDNS Corefile to rewrite homelab hostnames to internal services.
+#
+# Why this is needed:
+#   Grafana v10+ does OIDC auto-discovery by fetching
+#   /.well-known/openid-configuration from Authentik. When Grafana reaches
+#   Authentik via the external hostname (authentik.riotpiao.homelab.com), the
+#   HTTP Host header is preserved and Authentik returns external URLs in the
+#   discovery response. Without this rewrite, the hostname doesn't resolve
+#   inside the cluster and Grafana falls back to the internal service DNS,
+#   causing all OAuth redirects to go to authentik-server.iam.svc.cluster.local.
+#
+# Applied by helmfile presync hook on the ingress-nginx release.
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: coredns
+  namespace: kube-system
+data:
+  Corefile: |
+    .:53 {
+        errors
+        health {
+            lameduck 5s
+        }
+        ready
+        log . {
+            class error
+        }
+        prometheus :9153
+
+        # Forgejo: route to HTTP service (LoadBalancer handles both HTTPS:443 + SSH:2222 via same IP)
+        rewrite name forgejo.riotpiao.homelab.com forgejo-gitea-http.cicd.svc.cluster.local
+
+        # Rewrite homelab hostnames to the nginx ingress controller so in-cluster pods
+        # hit nginx TLS termination (cert-manager cert) and preserve the Host header.
+        # Routing through nginx — not directly to the backend service — is critical:
+        # direct rewrites to the backend bypass nginx TLS and expose each app's own
+        # self-signed cert, which nothing in the cluster trusts.
+        rewrite name authentik.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+        rewrite name grafana.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+        rewrite name minio.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+        rewrite name minio-api.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+        rewrite name argocd.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+        rewrite name vault.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+        rewrite name loki.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+        rewrite name prometheus.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+        rewrite name portainer.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+        rewrite name longhorn.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+
+        kubernetes cluster.local in-addr.arpa ip6.arpa {
+            pods insecure
+            fallthrough in-addr.arpa ip6.arpa
+            ttl 30
+        }
+        forward . 8.8.8.8 1.1.1.1 {
+           max_concurrent 1000
+        }
+        cache 30 {
+           disable success cluster.local
+           disable denial cluster.local
+        }
+        loop
+        reload
+        loadbalance
+    }