From 8020d09d14f06e755b255bc8d27490eb447084b4 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Mon, 5 Oct 2026 01:18:54 +1100 Subject: [PATCH] feat(bind-internal): publish haproxy edge sites from k8s DNS --- .../bind-internal/authoritative/kustomization.yaml | 1 + .../authoritative/main-unkin-net/a/jellyfin.yaml | 14 ++++++++++++++ .../main-unkin-net/a/kustomization.yaml | 12 ++++++++++++ .../authoritative/main-unkin-net/a/lidarr.yaml | 14 ++++++++++++++ .../authoritative/main-unkin-net/a/nzbget.yaml | 14 ++++++++++++++ .../authoritative/main-unkin-net/a/prowlarr.yaml | 14 ++++++++++++++ .../authoritative/main-unkin-net/a/radarr.yaml | 14 ++++++++++++++ .../authoritative/main-unkin-net/a/readarr.yaml | 14 ++++++++++++++ .../authoritative/main-unkin-net/a/sonarr.yaml | 14 ++++++++++++++ .../main-unkin-net/kustomization.yaml | 6 ++++++ .../authoritative/unkin-net/a/auth.yaml | 14 ++++++++++++++ .../authoritative/unkin-net/a/fafflix.yaml | 14 ++++++++++++++ .../authoritative/unkin-net/a/git-edge.yaml | 14 ++++++++++++++ .../authoritative/unkin-net/a/git.yaml | 12 ++++-------- .../authoritative/unkin-net/a/kustomization.yaml | 5 ++++- 15 files changed, 167 insertions(+), 9 deletions(-) create mode 100644 apps/base/bind-internal/authoritative/main-unkin-net/a/jellyfin.yaml create mode 100644 apps/base/bind-internal/authoritative/main-unkin-net/a/kustomization.yaml create mode 100644 apps/base/bind-internal/authoritative/main-unkin-net/a/lidarr.yaml create mode 100644 apps/base/bind-internal/authoritative/main-unkin-net/a/nzbget.yaml create mode 100644 apps/base/bind-internal/authoritative/main-unkin-net/a/prowlarr.yaml create mode 100644 apps/base/bind-internal/authoritative/main-unkin-net/a/radarr.yaml create mode 100644 apps/base/bind-internal/authoritative/main-unkin-net/a/readarr.yaml create mode 100644 apps/base/bind-internal/authoritative/main-unkin-net/a/sonarr.yaml create mode 100644 apps/base/bind-internal/authoritative/main-unkin-net/kustomization.yaml create mode 100644 apps/base/bind-internal/authoritative/unkin-net/a/auth.yaml create mode 100644 apps/base/bind-internal/authoritative/unkin-net/a/fafflix.yaml create mode 100644 apps/base/bind-internal/authoritative/unkin-net/a/git-edge.yaml diff --git a/apps/base/bind-internal/authoritative/kustomization.yaml b/apps/base/bind-internal/authoritative/kustomization.yaml index 98bf4be..606fb07 100644 --- a/apps/base/bind-internal/authoritative/kustomization.yaml +++ b/apps/base/bind-internal/authoritative/kustomization.yaml @@ -11,5 +11,6 @@ resources: - tsigkey.yaml - zones.yaml - unkin-net + - main-unkin-net - ceph-unkin-net - acls.yaml diff --git a/apps/base/bind-internal/authoritative/main-unkin-net/a/jellyfin.yaml b/apps/base/bind-internal/authoritative/main-unkin-net/a/jellyfin.yaml new file mode 100644 index 0000000..91467ac --- /dev/null +++ b/apps/base/bind-internal/authoritative/main-unkin-net/a/jellyfin.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + name: jellyfin-dns-internal + namespace: bind-internal +spec: + zoneRef: main-unkin-net + name: jellyfin + type: A + ttl: 600 + values: + # traefik-external haproxy edge Gateway VIP (TLS passthrough). + - 198.18.199.0 diff --git a/apps/base/bind-internal/authoritative/main-unkin-net/a/kustomization.yaml b/apps/base/bind-internal/authoritative/main-unkin-net/a/kustomization.yaml new file mode 100644 index 0000000..420efcf --- /dev/null +++ b/apps/base/bind-internal/authoritative/main-unkin-net/a/kustomization.yaml @@ -0,0 +1,12 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - jellyfin.yaml + - lidarr.yaml + - nzbget.yaml + - prowlarr.yaml + - radarr.yaml + - readarr.yaml + - sonarr.yaml diff --git a/apps/base/bind-internal/authoritative/main-unkin-net/a/lidarr.yaml b/apps/base/bind-internal/authoritative/main-unkin-net/a/lidarr.yaml new file mode 100644 index 0000000..db22d5b --- /dev/null +++ b/apps/base/bind-internal/authoritative/main-unkin-net/a/lidarr.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + name: lidarr-dns-internal + namespace: bind-internal +spec: + zoneRef: main-unkin-net + name: lidarr + type: A + ttl: 600 + values: + # traefik-external haproxy edge Gateway VIP (TLS passthrough). + - 198.18.199.0 diff --git a/apps/base/bind-internal/authoritative/main-unkin-net/a/nzbget.yaml b/apps/base/bind-internal/authoritative/main-unkin-net/a/nzbget.yaml new file mode 100644 index 0000000..77584d5 --- /dev/null +++ b/apps/base/bind-internal/authoritative/main-unkin-net/a/nzbget.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + name: nzbget-dns-internal + namespace: bind-internal +spec: + zoneRef: main-unkin-net + name: nzbget + type: A + ttl: 600 + values: + # traefik-external haproxy edge Gateway VIP (TLS passthrough). + - 198.18.199.0 diff --git a/apps/base/bind-internal/authoritative/main-unkin-net/a/prowlarr.yaml b/apps/base/bind-internal/authoritative/main-unkin-net/a/prowlarr.yaml new file mode 100644 index 0000000..cce8cba --- /dev/null +++ b/apps/base/bind-internal/authoritative/main-unkin-net/a/prowlarr.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + name: prowlarr-dns-internal + namespace: bind-internal +spec: + zoneRef: main-unkin-net + name: prowlarr + type: A + ttl: 600 + values: + # traefik-external haproxy edge Gateway VIP (TLS passthrough). + - 198.18.199.0 diff --git a/apps/base/bind-internal/authoritative/main-unkin-net/a/radarr.yaml b/apps/base/bind-internal/authoritative/main-unkin-net/a/radarr.yaml new file mode 100644 index 0000000..83fe416 --- /dev/null +++ b/apps/base/bind-internal/authoritative/main-unkin-net/a/radarr.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + name: radarr-dns-internal + namespace: bind-internal +spec: + zoneRef: main-unkin-net + name: radarr + type: A + ttl: 600 + values: + # traefik-external haproxy edge Gateway VIP (TLS passthrough). + - 198.18.199.0 diff --git a/apps/base/bind-internal/authoritative/main-unkin-net/a/readarr.yaml b/apps/base/bind-internal/authoritative/main-unkin-net/a/readarr.yaml new file mode 100644 index 0000000..fa7c454 --- /dev/null +++ b/apps/base/bind-internal/authoritative/main-unkin-net/a/readarr.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + name: readarr-dns-internal + namespace: bind-internal +spec: + zoneRef: main-unkin-net + name: readarr + type: A + ttl: 600 + values: + # traefik-external haproxy edge Gateway VIP (TLS passthrough). + - 198.18.199.0 diff --git a/apps/base/bind-internal/authoritative/main-unkin-net/a/sonarr.yaml b/apps/base/bind-internal/authoritative/main-unkin-net/a/sonarr.yaml new file mode 100644 index 0000000..5e67631 --- /dev/null +++ b/apps/base/bind-internal/authoritative/main-unkin-net/a/sonarr.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + name: sonarr-dns-internal + namespace: bind-internal +spec: + zoneRef: main-unkin-net + name: sonarr + type: A + ttl: 600 + values: + # traefik-external haproxy edge Gateway VIP (TLS passthrough). + - 198.18.199.0 diff --git a/apps/base/bind-internal/authoritative/main-unkin-net/kustomization.yaml b/apps/base/bind-internal/authoritative/main-unkin-net/kustomization.yaml new file mode 100644 index 0000000..294f3aa --- /dev/null +++ b/apps/base/bind-internal/authoritative/main-unkin-net/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - a diff --git a/apps/base/bind-internal/authoritative/unkin-net/a/auth.yaml b/apps/base/bind-internal/authoritative/unkin-net/a/auth.yaml new file mode 100644 index 0000000..8d8435f --- /dev/null +++ b/apps/base/bind-internal/authoritative/unkin-net/a/auth.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + name: auth-dns-internal + namespace: bind-internal +spec: + zoneRef: unkin-net + name: auth + type: A + ttl: 600 + values: + # traefik-internal gateway VIP; the kanidm Gateway serves auth.unkin.net there. + - 198.18.200.4 diff --git a/apps/base/bind-internal/authoritative/unkin-net/a/fafflix.yaml b/apps/base/bind-internal/authoritative/unkin-net/a/fafflix.yaml new file mode 100644 index 0000000..41daea2 --- /dev/null +++ b/apps/base/bind-internal/authoritative/unkin-net/a/fafflix.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + name: fafflix-dns-internal + namespace: bind-internal +spec: + zoneRef: unkin-net + name: fafflix + type: A + ttl: 600 + values: + # traefik-external haproxy edge Gateway VIP (TLS passthrough). + - 198.18.199.0 diff --git a/apps/base/bind-internal/authoritative/unkin-net/a/git-edge.yaml b/apps/base/bind-internal/authoritative/unkin-net/a/git-edge.yaml new file mode 100644 index 0000000..3bd8214 --- /dev/null +++ b/apps/base/bind-internal/authoritative/unkin-net/a/git-edge.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + name: git-edge-dns-internal + namespace: bind-internal +spec: + zoneRef: unkin-net + name: git + type: A + ttl: 600 + values: + # traefik-external haproxy edge Gateway VIP (TLS passthrough). + - 198.18.199.0 diff --git a/apps/base/bind-internal/authoritative/unkin-net/a/git.yaml b/apps/base/bind-internal/authoritative/unkin-net/a/git.yaml index eaa1f41..5546dcd 100644 --- a/apps/base/bind-internal/authoritative/unkin-net/a/git.yaml +++ b/apps/base/bind-internal/authoritative/unkin-net/a/git.yaml @@ -1,16 +1,12 @@ --- # PRODUCTION CUTOVER RECORD — intentionally commented out. -# git.unkin.net currently resolves to the LIVE VM forge (HAProxy VRRP VIP -# 198.18.19.17), which holds every repo the estate depends on. Uncommenting this +# git.unkin.net currently resolves to the haproxy edge (git-edge.yaml), which +# forwards to the LIVE VM forge holding every repo. Uncommenting this # repoints the whole org's git.unkin.net at the new k8s Gitea gateway VIP, so it # is the FINAL step of the forge migration — gated on the data migration (gitea # dump/restore + SECRET_KEY copy) in argocd-apps docs/gitea-migration.md. -# NOTE: the live git.unkin.net answer is served by the puppet DNS master today -# (profiles::dns::master, records from PuppetDB); this k8s apex zone holds only -# SOA+NS + a few DNSRecords so far. Confirm the k8s bind cluster is the live -# authority for unkin.net (or update the puppet record instead) before relying -# on this CR at cutover. -# Uncomment this record AND its entry in kustomization.yaml to activate it. +# Uncomment this record AND its entry in kustomization.yaml (removing +# git-edge.yaml there) to activate it. # --- # apiVersion: bind.unkin.net/v1alpha1 # kind: DNSRecord diff --git a/apps/base/bind-internal/authoritative/unkin-net/a/kustomization.yaml b/apps/base/bind-internal/authoritative/unkin-net/a/kustomization.yaml index c10613a..5f7821d 100644 --- a/apps/base/bind-internal/authoritative/unkin-net/a/kustomization.yaml +++ b/apps/base/bind-internal/authoritative/unkin-net/a/kustomization.yaml @@ -4,11 +4,14 @@ kind: Kustomization resources: - arrstack.yaml + - auth.yaml - cheeztv.yaml + - fafflix.yaml # PRODUCTION CUTOVER RECORD — see git.yaml. Uncomment together with the - # record itself. + # record itself, and remove git-edge.yaml. # - git.yaml - ghp.yaml + - git-edge.yaml - grafana.yaml - identity.yaml - lb1.yaml