Story Crater Bot
6d5a0ba205
- Nginx ingress + TLS termination (homelab-ca) - Portainer container UI - CoreDNS internal DNS rewrites - DuckDNS DDNS updater - Ollama LLM inference - 8 project-usage guides (team reference)
68 lines
3.0 KiB
YAML
68 lines
3.0 KiB
YAML
# k8s/coredns/coredns-configmap.yaml
|
|
# Patches the CoreDNS Corefile to rewrite homelab hostnames to internal services.
|
|
#
|
|
# Why this is needed:
|
|
# Grafana v10+ does OIDC auto-discovery by fetching
|
|
# /.well-known/openid-configuration from Authentik. When Grafana reaches
|
|
# Authentik via the external hostname (authentik.riotpiao.homelab.com), the
|
|
# HTTP Host header is preserved and Authentik returns external URLs in the
|
|
# discovery response. Without this rewrite, the hostname doesn't resolve
|
|
# inside the cluster and Grafana falls back to the internal service DNS,
|
|
# causing all OAuth redirects to go to authentik-server.iam.svc.cluster.local.
|
|
#
|
|
# Applied by helmfile presync hook on the ingress-nginx release.
|
|
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: coredns
|
|
namespace: kube-system
|
|
data:
|
|
Corefile: |
|
|
.:53 {
|
|
errors
|
|
health {
|
|
lameduck 5s
|
|
}
|
|
ready
|
|
log . {
|
|
class error
|
|
}
|
|
prometheus :9153
|
|
|
|
# Forgejo: route to HTTP service (LoadBalancer handles both HTTPS:443 + SSH:2222 via same IP)
|
|
rewrite name forgejo.riotpiao.homelab.com forgejo-gitea-http.cicd.svc.cluster.local
|
|
|
|
# Rewrite homelab hostnames to the nginx ingress controller so in-cluster pods
|
|
# hit nginx TLS termination (cert-manager cert) and preserve the Host header.
|
|
# Routing through nginx — not directly to the backend service — is critical:
|
|
# direct rewrites to the backend bypass nginx TLS and expose each app's own
|
|
# self-signed cert, which nothing in the cluster trusts.
|
|
rewrite name authentik.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name grafana.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name minio.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name minio-api.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name argocd.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name vault.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name loki.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name prometheus.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name portainer.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name longhorn.riotpiao.homelab.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
|
|
kubernetes cluster.local in-addr.arpa ip6.arpa {
|
|
pods insecure
|
|
fallthrough in-addr.arpa ip6.arpa
|
|
ttl 30
|
|
}
|
|
forward . 8.8.8.8 1.1.1.1 {
|
|
max_concurrent 1000
|
|
}
|
|
cache 30 {
|
|
disable success cluster.local
|
|
disable denial cluster.local
|
|
}
|
|
loop
|
|
reload
|
|
loadbalance
|
|
}
|