# k8s/coredns/coredns-configmap.yaml
# Patches the CoreDNS Corefile to rewrite homelab hostnames to internal services.
#
# Why this is needed:
#   Grafana v10+ does OIDC auto-discovery by fetching
#   /.well-known/openid-configuration from Authentik. When Grafana reaches
#   Authentik via the external hostname (authentik.riotpiao.homelab.com), the
#   HTTP Host header is preserved and Authentik returns external URLs in the
#   discovery response. Without this rewrite, the hostname doesn't resolve
#   inside the cluster and Grafana falls back to the internal service DNS,
#   causing all OAuth redirects to go to authentik-server.iam.svc.cluster.local.
#
# Applied by helmfile presync hook on the ingress-nginx release.

apiVersion: v1
kind: ConfigMap
metadata:
  name: coredns
  namespace: kube-system
data:
  Corefile: |
    .:53 {
        errors
        health {
            lameduck 5s
        }
        ready
        log . {
            class error
        }
        prometheus :9153

        # Forgejo: route through nginx ingress like every other host below. nginx
        # terminates TLS (wildcard-tls) on :443 and routes both /v2/ (container
        # registry) and web/git to forgejo-gitea-http:3000.
        # Do NOT point this at forgejo-gitea-http directly: that service only serves
        # port 3000, so containerd image pulls (which use https/:443) get
        # `dial tcp <clusterIP>:443: i/o timeout`. SSH stays on its own LB service.
        rewrite name forgejo.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local

        # Rewrite homelab hostnames to the nginx ingress controller so in-cluster pods
        # hit nginx TLS termination (cert-manager cert) and preserve the Host header.
        # Routing through nginx — not directly to the backend service — is critical:
        # direct rewrites to the backend bypass nginx TLS and expose each app's own
        # self-signed cert, which nothing in the cluster trusts.
        rewrite name authentik.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
        rewrite name grafana.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
        rewrite name minio.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
        rewrite name minio-api.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
        rewrite name argocd.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
        rewrite name vault.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
        rewrite name loki.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
        rewrite name prometheus.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
        rewrite name portainer.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
        rewrite name longhorn.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local

        kubernetes cluster.local in-addr.arpa ip6.arpa {
            pods insecure
            fallthrough in-addr.arpa ip6.arpa
            ttl 30
        }
        forward . 8.8.8.8 1.1.1.1 {
           max_concurrent 1000
        }
        cache 30 {
           disable success cluster.local
           disable denial cluster.local
        }
        loop
        reload
        loadbalance
    }