From cbdb4caabea3d6527b803a7c4155edad1053fe10 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sun, 27 Sep 2026 11:24:58 +1000
Subject: [PATCH] Serve vlogs.unkin.net on the external Traefik with the
 wildcard cert

Front the VictoriaLogs UI on the DMZ gateway VIP, terminate TLS with the
reflected Let's Encrypt *.unkin.net wildcard, and publish the apex A record
from the bind-operator unkin.net zone.
---
 .../bind-internal/authoritative/records.yaml  | 15 +++++++++++++
 .../certificate_wildcard-unkin-net.yaml       |  4 ++--
 apps/base/logging/vlogs/gateway.yaml          | 21 ++++++++++---------
 apps/base/logging/vlogs/httproute.yaml        |  4 ++--
 4 files changed, 30 insertions(+), 14 deletions(-)

diff --git a/apps/base/bind-internal/authoritative/records.yaml b/apps/base/bind-internal/authoritative/records.yaml
index e9be28c..ef2b45b 100644
--- a/apps/base/bind-internal/authoritative/records.yaml
+++ b/apps/base/bind-internal/authoritative/records.yaml
@@ -162,3 +162,18 @@ spec:
     # traefik-EXTERNAL (DMZ) gateway VIP; the watchstate-external Gateway serves
     # the watchstate.unkin.net front door (oauth2-proxy) there.
     - 198.18.199.0
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: vlogs-dns-internal
+  namespace: bind-internal
+spec:
+  zoneRef: unkin-net
+  name: vlogs
+  type: A
+  ttl: 600
+  values:
+    # traefik-EXTERNAL (DMZ) gateway VIP; the vlogs-external Gateway serves the
+    # vlogs.unkin.net front door (oauth2-proxy) there.
+    - 198.18.199.0
diff --git a/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml b/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml
index 7873433..92338ce 100644
--- a/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml
+++ b/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml
@@ -14,9 +14,9 @@ spec:
   secretTemplate:
     annotations:
       reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy,logging"
       reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy,logging"
   privateKey:
     size: 4096
   dnsNames:
diff --git a/apps/base/logging/vlogs/gateway.yaml b/apps/base/logging/vlogs/gateway.yaml
index 7d03e29..d1ead27 100644
--- a/apps/base/logging/vlogs/gateway.yaml
+++ b/apps/base/logging/vlogs/gateway.yaml
@@ -1,19 +1,20 @@
 ---
+# External (DMZ) front for the VictoriaLogs UI on vlogs.unkin.net via the
+# external Traefik (LB VIP 198.18.199.0). TLS terminates with the real Let's
+# Encrypt *.unkin.net wildcard (Certificate wildcard-unkin-net in cert-manager,
+# reflected into this namespace as wildcard-unkin-net-tls by the emberstack
+# reflector), so there is no cert-manager annotation here. The apex
+# vlogs.unkin.net A record lives in the bind-operator unkin.net zone, NOT
+# external-dns, so no external-dns annotation either. oauth2-proxy fronts it.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
   labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: vlogs.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: vlogs.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-  name: vlogs
+    traefik.io/instance: external
+  name: vlogs-external
   namespace: logging
 spec:
-  gatewayClassName: traefik-internal
+  gatewayClassName: traefik-external
   listeners:
     - allowedRoutes:
         namespaces:
@@ -33,5 +34,5 @@ spec:
         certificateRefs:
           - group: ""
             kind: Secret
-            name: vlogs-tls
+            name: wildcard-unkin-net-tls
         mode: Terminate
diff --git a/apps/base/logging/vlogs/httproute.yaml b/apps/base/logging/vlogs/httproute.yaml
index 4b20f04..03debad 100644
--- a/apps/base/logging/vlogs/httproute.yaml
+++ b/apps/base/logging/vlogs/httproute.yaml
@@ -10,7 +10,7 @@ spec:
   parentRefs:
     - group: gateway.networking.k8s.io
       kind: Gateway
-      name: vlogs
+      name: vlogs-external
       sectionName: http
   rules:
     - filters:
@@ -34,7 +34,7 @@ spec:
   parentRefs:
     - group: gateway.networking.k8s.io
       kind: Gateway
-      name: vlogs
+      name: vlogs-external
       sectionName: https
   rules:
     - backendRefs: