Story Crater Bot
1f97d744f6
Adds CoreDNS rewrite: git.riotpiao.com → forgejo-gitea-ssh.cicd.svc.cluster.local Separates SSH from HTTPS access: - forgejo.riotpiao.com → HTTPS/Web UI (192.168.1.160, ingress) - git.riotpiao.com → SSH (192.168.1.165:2222, LoadBalancer) Usage: git remote set-url origin ssh://[email protected]:2222/riotpiao.com/homelab.git git push External access requires /etc/hosts entry: 192.168.1.165 git.riotpiao.com
79 lines
3.7 KiB
YAML
79 lines
3.7 KiB
YAML
# k8s/coredns/coredns-configmap.yaml
|
|
# Patches the CoreDNS Corefile to rewrite homelab hostnames to internal services.
|
|
#
|
|
# Why this is needed:
|
|
# Grafana v10+ does OIDC auto-discovery by fetching
|
|
# /.well-known/openid-configuration from Authentik. When Grafana reaches
|
|
# Authentik via the external hostname (authentik.riotpiao.com), the
|
|
# HTTP Host header is preserved and Authentik returns external URLs in the
|
|
# discovery response. Without this rewrite, the hostname doesn't resolve
|
|
# inside the cluster and Grafana falls back to the internal service DNS,
|
|
# causing all OAuth redirects to go to authentik-server.iam.svc.cluster.local.
|
|
#
|
|
# Applied by helmfile presync hook on the ingress-nginx release.
|
|
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: coredns
|
|
namespace: kube-system
|
|
data:
|
|
Corefile: |
|
|
.:53 {
|
|
errors
|
|
health {
|
|
lameduck 5s
|
|
}
|
|
ready
|
|
log . {
|
|
class error
|
|
}
|
|
prometheus :9153
|
|
|
|
# VPN Access: Map api-server.cluster.local to cluster API IP
|
|
# Allows secure cluster access via WireGuard tunnel (Shadowrocket/Talos)
|
|
rewrite name api-server.cluster.local kubernetes.default.svc.cluster.local
|
|
|
|
# Forgejo: route through nginx ingress like every other host below. nginx
|
|
# terminates TLS (wildcard-tls) on :443 and routes both /v2/ (container
|
|
# registry) and web/git to forgejo-gitea-http:3000.
|
|
# Do NOT point this at forgejo-gitea-http directly: that service only serves
|
|
# port 3000, so containerd image pulls (which use https/:443) get
|
|
# `dial tcp <clusterIP>:443: i/o timeout`. SSH stays on its own LB service.
|
|
rewrite name forgejo.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name git.riotpiao.com forgejo-gitea-ssh.cicd.svc.cluster.local
|
|
|
|
# Rewrite homelab hostnames to the nginx ingress controller so in-cluster pods
|
|
# hit nginx TLS termination (cert-manager cert) and preserve the Host header.
|
|
# Routing through nginx — not directly to the backend service — is critical:
|
|
# direct rewrites to the backend bypass nginx TLS and expose each app's own
|
|
# self-signed cert, which nothing in the cluster trusts.
|
|
rewrite name authentik.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name grafana.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name minio.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name minio-api.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name argocd.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name vault.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name loki.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name prometheus.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name homarr.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name portainer.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
rewrite name longhorn.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
|
|
|
|
kubernetes cluster.local in-addr.arpa ip6.arpa {
|
|
pods insecure
|
|
fallthrough in-addr.arpa ip6.arpa
|
|
ttl 30
|
|
}
|
|
forward . 8.8.8.8 1.1.1.1 {
|
|
max_concurrent 1000
|
|
}
|
|
cache 30 {
|
|
disable success cluster.local
|
|
disable denial cluster.local
|
|
}
|
|
loop
|
|
reload
|
|
loadbalance
|
|
}
|