From 7d7b5fb6f203efbb1d706714cb16d0e5f85ff2e6 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Tue, 25 Aug 2026 21:43:19 +1000 Subject: [PATCH] Identity gateway migrated to traefik-external (198.18.199.0); watchstate added to wildcard cert reflector lists --- apps/base/bind-internal/authoritative/records.yaml | 4 ++-- apps/base/cert-manager/certificate_wildcard-unkin-net.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/apps/base/bind-internal/authoritative/records.yaml b/apps/base/bind-internal/authoritative/records.yaml index 3f7a30a..9135948 100644 --- a/apps/base/bind-internal/authoritative/records.yaml +++ b/apps/base/bind-internal/authoritative/records.yaml @@ -16,9 +16,9 @@ spec: type: A ttl: 600 values: - # traefik-internal gateway VIP; the authentik Gateway serves the + # traefik-EXTERNAL (DMZ) gateway VIP; the authentik Gateway serves the # identity.unkin.net hostname there. - - 198.18.200.4 + - 198.18.199.0 --- # PRODUCTION CUTOVER RECORD — intentionally commented out. # git.unkin.net currently resolves to the LIVE VM forge (HAProxy VRRP VIP diff --git a/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml b/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml index 717357d..93afdbc 100644 --- a/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml +++ b/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml @@ -14,9 +14,9 @@ spec: secretTemplate: annotations: reflector.v1.k8s.emberstack.com/reflection-allowed: "true" - reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea" + reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate" reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true" - reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea" + reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate" privateKey: size: 4096 dnsNames: