From bebbd3a6906212560afc52693e1c9254debfb15b Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Tue, 25 Aug 2026 18:53:52 -0700
Subject: [PATCH] fix: add CoreDNS rewrite for img.riotpiao.com

Cloudflare Tunnel's origin service for img.riotpiao.com self-references
the same public hostname (same pattern as paperless/forgejo/authentik) -
without this rewrite, cloudflared's in-cluster DNS resolution has
nowhere to loop back to, and TLS to the raw ingress-nginx service name
fails cert validation (cert is only valid for *.riotpiao.com).
---
 terraform/files/coredns/Corefile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/terraform/files/coredns/Corefile b/terraform/files/coredns/Corefile
index de60dd0..ccab77d 100644
--- a/terraform/files/coredns/Corefile
+++ b/terraform/files/coredns/Corefile
@@ -34,6 +34,7 @@
     rewrite name portainer.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name longhorn.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name paperless.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    rewrite name img.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
 
     kubernetes cluster.local in-addr.arpa ip6.arpa {
         pods insecure