riotpiao.com/tasks/0.5-apex-403.md

0.5 — Diagnose apex 403

Phase: 0 — Unblock

Depends on: 00-decisions.md decision #2

• Diagnose apex 403 — check Cloudflare tunnel Public Hostnames list and WAF event log

Partial evidence (2026-08-18): kubectl get ingress -A has zero rules for bare host riotpiao.com — every ingress is a subdomain (22 hosts, all *.riotpiao.com per the *.riotpiao.homelab.com retirement). No in-cluster origin exists for the apex today. Leans toward "no origin configured" as the cause, but Cloudflare tunnel Public Hostnames list + WAF event log still needed to confirm the tunnel-side config (not visible from kubectl).

Verify

curl -sS -o /dev/null -w '%{http_code}\n' https://riotpiao.com   # 200