Revert "Put the artifactapi web UI behind Authentik oauth2-proxy (#456)"

This reverts commit c98d88c197.

The artifactapi web UI has been down since #456 merged: /ui/ and /oauth2/
both return 503 "no available server", Traefik's response for a Service
with no ready endpoints, so the oauth2-proxy pod is not becoming ready.
The machine API surface (/version, /api/v2/health, /v2/,
/.well-known/terraform.json) is unaffected and still returns 200.

Rolling back restores unauthenticated access to the UI at /ui, served
directly by the ui Service exactly as before.

- Point the api-route /ui rule back at the ui Service and drop the
  /oauth2 rule.
- Remove the oauth2-proxy ConfigMap, Deployment, Service and VMPodScrape.
- Remove the oauth-credentials VaultStaticSecret.

The apps/base/artifactapi tree is byte-identical to 520da44, the commit
immediately before #456. Nothing that landed since is touched.

.woodpecker/vector-test.yaml

@@ -0,0 +1,29 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: vector-test
+    image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector:0.57.0-debian
+    commands:
+      # Dummy creds + writable dirs so the full topologies build; the unit tests
+      # only exercise the transforms (sources are not started).
+      - export CLICKHOUSE_USER=ci CLICKHOUSE_PASSWORD=ci
+      - export NATS_PRODUCER_PASSWORD=ci NATS_CONSUMER_PASSWORD=ci
+      - mkdir -p /vector-data-dir /etc/vault-ca
+      - cp /etc/ssl/certs/ca-certificates.crt /etc/vault-ca/ca.crt
+      # Transform tier + VM ingest: unit-tested transforms.
+      - vector test apps/base/logging/vector/aggregator.yaml apps/base/logging/vector/aggregator-tests.yaml
+      - vector test apps/base/logging/vector/vm-ingest.yaml apps/base/logging/vector/vm-ingest-tests.yaml
+      # Agent has no transforms to unit-test; validate it builds. (The archiver
+      # leg is now the logarchiver service, not a Vector pipeline.)
+      - vector validate --no-environment apps/base/logging/vector/agent.yaml
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 256Mi
+            cpu: 250m
+          limits:
+            memory: 1Gi
+            cpu: 1

apps/base/artifactapi/api-deployment.yaml

@@ -36,7 +36,7 @@ spec:
               mountPath: /combined-certs
       containers:
         - name: api
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi:v3.19.0
+          image: git.unkin.net/unkin/artifactapi:v3.11.2
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8000

apps/base/artifactapi/configmap.yaml

@@ -5,8 +5,6 @@ metadata:
   name: api-env
   namespace: artifactapi
 data:
-  ARTIFACTAPI_OIDC_AUDIENCE: artifactapi
-  ARTIFACTAPI_OIDC_ISSUER: https://vault.service.consul:8200/v1/identity/oidc
   DBHOST: postgres-pooler
   DBNAME: artifacts
   DBPORT: "5432"

apps/base/artifactapi/httproute.yaml

@@ -1,21 +1,4 @@
 ---
-# Path split between the authenticated UI and the unauthenticated machine API.
-# Longest matching prefix wins, so the two UI rules take precedence over "/".
-#
-# AUTHENTICATED (oauth2 Service -> oauth2-proxy -> ui Service):
-#   /oauth2   oauth2-proxy sign_in / start / callback / sign_out
-#   /ui       the human-facing SPA
-#
-# NOT AUTHENTICATED (artifactapi Service, unchanged):
-#   /api/v1/{remote,local,virtual}/*   package proxy reads (yum/dnf, pip, ...)
-#   /api/v2/remotes|virtuals|locals/*  management API + the UI's own XHR calls
-#   /api/v2/remotes/{name}/files/*     CI publish uploads (PUT) and downloads
-#   /v2/*                              Docker Registry V2 (containerd, buildah)
-#   /terraform/v1/providers/*          Terraform provider registry
-#   /.well-known/terraform.json        Terraform service discovery
-#   /health, /version, /               probes and the redirect to /ui/
-# Those clients cannot complete a browser OIDC flow, so they must never be
-# routed through oauth2-proxy.
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
@@ -39,17 +22,7 @@ spec:
     - backendRefs:
         - group: ""
           kind: Service
-          name: oauth2
-          port: 80
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /oauth2
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: oauth2
+          name: ui
           port: 80
           weight: 1
       matches:

apps/base/artifactapi/image-keeper.yaml

@@ -1,105 +0,0 @@
----
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: image-keeper
-  namespace: artifactapi
-spec:
-  selector:
-    matchLabels:
-      app: image-keeper
-  updateStrategy:
-    rollingUpdate:
-      maxUnavailable: 25%
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: image-keeper
-    spec:
-      automountServiceAccountToken: false
-      priorityClassName: low
-      tolerations:
-        - operator: Exists
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      initContainers:
-        # artifactapi is distroless with no exit-0 flag, so run a static busybox as `true`
-        - name: copy-true
-          image: busybox:1.37.0-musl
-          imagePullPolicy: IfNotPresent
-          command: ["cp", "/bin/busybox", "/keeper/true"]
-          volumeMounts:
-            - name: keeper
-              mountPath: /keeper
-          resources:
-            limits:
-              cpu: 10m
-              memory: 16Mi
-            requests:
-              cpu: 1m
-              memory: 4Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop: ["ALL"]
-        - name: api
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi:v3.19.0
-          imagePullPolicy: IfNotPresent
-          command: ["/keeper/true"]
-          volumeMounts:
-            - name: keeper
-              mountPath: /keeper
-              readOnly: true
-          resources:
-            limits:
-              cpu: 10m
-              memory: 16Mi
-            requests:
-              cpu: 1m
-              memory: 4Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop: ["ALL"]
-        - name: ui
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi-ui:v3.19.0
-          imagePullPolicy: IfNotPresent
-          command: ["true"]
-          resources:
-            limits:
-              cpu: 10m
-              memory: 16Mi
-            requests:
-              cpu: 1m
-              memory: 4Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop: ["ALL"]
-      containers:
-        - name: pause
-          image: rancher/mirrored-pause:3.6
-          imagePullPolicy: IfNotPresent
-          resources:
-            limits:
-              cpu: 10m
-              memory: 16Mi
-            requests:
-              cpu: 1m
-              memory: 4Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop: ["ALL"]
-      volumes:
-        - name: keeper
-          emptyDir: {}

apps/base/artifactapi/kustomization.yaml

@@ -11,10 +11,7 @@ resources:
   - cnpg_pooler.yaml
   - gateway.yaml
   - httproute.yaml
-  - image-keeper.yaml
   - namespace.yaml
-  - oauth2-proxy-configmap.yaml
-  - oauth2-proxy-deployment.yaml
   - redis-deployment.yaml
   - services.yaml
   - ui-deployment.yaml

apps/base/artifactapi/oauth2-proxy-configmap.yaml

@@ -1,46 +0,0 @@
----
-# Non-secret oauth2-proxy configuration (client_id/secret/cookie_secret come
-# from the oauth-credentials Secret).
-#
-# SCOPE: this proxy fronts the artifactapi web UI ONLY. The HTTPRoute sends just
-# /ui and /oauth2 here; every machine surface (/api/v1, /api/v2, /v2 docker
-# registry, /terraform, /.well-known/terraform.json, /health, /version, /) goes
-# straight to the api Service and is NOT authenticated. yum/dnf, containerd
-# registry mirrors, docker/buildah, terraform init and Woodpecker publish steps
-# cannot complete a browser OIDC flow, so they must never reach this container.
-# Its only upstream is the ui Service -- there is deliberately no api upstream.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: artifactapi-oauth2-env
-  namespace: artifactapi
-data:
-  OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:4180"
-  OAUTH2_PROXY_METRICS_ADDRESS: "0.0.0.0:44180"
-  OAUTH2_PROXY_PROVIDER: "oidc"
-  # Publicly-trusted Authentik host: the authorize step is a browser redirect,
-  # so the issuer must present a cert every user's browser already trusts (the
-  # k8s host serves an internal-CA cert). Slug from terraform-authentik.
-  OAUTH2_PROXY_OIDC_ISSUER_URL: "https://identity.unkin.net/application/o/artifactapi/"
-  OAUTH2_PROXY_REDIRECT_URL: "https://artifactapi.k8s.syd1.au.unkin.net/oauth2/callback"
-  OAUTH2_PROXY_UPSTREAMS: "http://ui.artifactapi.svc.cluster.local:80/"
-  OAUTH2_PROXY_SCOPE: "openid email profile ak_groups"
-  # Populate session.Groups from the Authentik hierarchical ak_groups claim.
-  OAUTH2_PROXY_OIDC_GROUPS_CLAIM: "ak_groups"
-  OAUTH2_PROXY_ALLOWED_GROUPS: "akP-artifactapi-admin"
-  OAUTH2_PROXY_PASS_USER_HEADERS: "true"
-  OAUTH2_PROXY_EMAIL_DOMAINS: "*"
-  # Authentik hardcodes email_verified=false in the id_token; authorization is
-  # enforced via ak_groups, so accepting the unverified email is safe.
-  OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true"
-  OAUTH2_PROXY_COOKIE_SECURE: "true"
-  OAUTH2_PROXY_COOKIE_DOMAINS: "artifactapi.k8s.syd1.au.unkin.net"
-  OAUTH2_PROXY_WHITELIST_DOMAINS: "artifactapi.k8s.syd1.au.unkin.net"
-  OAUTH2_PROXY_REVERSE_PROXY: "true"
-  OAUTH2_PROXY_CODE_CHALLENGE_METHOD: "S256"
-  OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
-  # Back-channel discovery/token calls resolve the issuer inside the cluster,
-  # where it is served under the internal unkin.net CA rather than the publicly
-  # trusted cert the browser sees. Trust the bundle the combine-certs init
-  # container assembles, as every other oauth2-proxy in the estate does.
-  OAUTH2_PROXY_PROVIDER_CA_FILES: "/etc/ssl/combined/ca-certificates.crt"

apps/base/artifactapi/oauth2-proxy-deployment.yaml

@@ -1,136 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: oauth2
-  namespace: artifactapi
-  annotations:
-    configmap.reloader.stakater.com/auto: "true"
-    secret.reloader.stakater.com/reload: "oauth-credentials,vault-ca-cert"
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: oauth2
-  strategy:
-    rollingUpdate:
-      maxUnavailable: 1
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: oauth2
-    spec:
-      serviceAccountName: default
-      automountServiceAccountToken: false
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        fsGroup: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      initContainers:
-        # The Authentik issuer is served behind the internal unkin.net CA;
-        # combine the system roots with it so oauth2-proxy's OIDC HTTP client
-        # trusts the discovery endpoint.
-        - name: combine-certs
-          image: docker.io/library/alpine:3
-          imagePullPolicy: IfNotPresent
-          command:
-            - sh
-            - -c
-            - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
-          volumeMounts:
-            - name: vault-ca-cert
-              mountPath: /custom-ca
-              readOnly: true
-            - name: combined-certs
-              mountPath: /combined-certs
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          resources:
-            requests:
-              cpu: 50m
-              memory: 32Mi
-            limits:
-              cpu: 200m
-              memory: 64Mi
-      containers:
-        - name: oauth2-proxy
-          image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 4180
-              name: http
-              protocol: TCP
-            - containerPort: 44180
-              name: metrics
-              protocol: TCP
-          envFrom:
-            - configMapRef:
-                name: artifactapi-oauth2-env
-                optional: false
-          env:
-            - name: OAUTH2_PROXY_CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: oauth-credentials
-                  key: client_id
-            - name: OAUTH2_PROXY_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: oauth-credentials
-                  key: client_secret
-            - name: OAUTH2_PROXY_COOKIE_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: oauth-credentials
-                  key: cookie_secret
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - ALL
-          volumeMounts:
-            - name: combined-certs
-              mountPath: /etc/ssl/combined
-              readOnly: true
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 500m
-              memory: 256Mi
-      volumes:
-        - name: vault-ca-cert
-          secret:
-            secretName: vault-ca-cert
-            items:
-              - key: ca.crt
-                path: ca.crt
-        - name: combined-certs
-          emptyDir: {}
-      restartPolicy: Always

apps/base/artifactapi/services.yaml

@@ -16,26 +16,6 @@ spec:
   sessionAffinity: None
   type: ClusterIP
 ---
-# Authenticated front door for the web UI only: api-route sends /ui and /oauth2
-# here, oauth2-proxy authenticates and forwards to the ui Service. Every other
-# path reaches the api Service above directly and stays unauthenticated.
-apiVersion: v1
-kind: Service
-metadata:
-  name: oauth2
-  namespace: artifactapi
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: http
-      port: 80
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: oauth2
-  sessionAffinity: None
-  type: ClusterIP
----
 apiVersion: v1
 kind: Service
 metadata:

apps/base/artifactapi/ui-deployment.yaml

@@ -22,7 +22,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: ui
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi-ui:v3.19.0
+          image: git.unkin.net/unkin/artifactapi-ui:v3.11.2
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 80

apps/base/artifactapi/vaultstaticsecret.yaml

@@ -32,26 +32,3 @@ spec:
   refreshAfter: 5m
   type: kv-v2
   vaultAuthRef: default
----
-# Authentik OIDC client for the artifactapi UI front door (client_id,
-# client_secret, cookie_secret). Seeded out of band at
-# kv/kubernetes/namespace/artifactapi/default/oauth-credentials; the default
-# k8s auth role already grants the artifactapi/default ServiceAccount read on
-# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*, so no
-# terraform-vault change is needed. Consumed by the oauth2 Deployment.
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: oauth-credentials
-  namespace: artifactapi
-spec:
-  destination:
-    create: true
-    name: oauth-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/artifactapi/default/oauth-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/artifactapi/vmpodscrape.yaml

@@ -14,17 +14,3 @@ spec:
   podMetricsEndpoints:
     - port: metrics
       path: /metrics
----
-# Scrape the UI oauth2-proxy (:44180), which exposes sign-in/authz counters.
-apiVersion: operator.victoriametrics.com/v1beta1
-kind: VMPodScrape
-metadata:
-  name: oauth2
-  namespace: artifactapi
-spec:
-  selector:
-    matchLabels:
-      app: oauth2
-  podMetricsEndpoints:
-    - port: metrics
-      path: /metrics

apps/base/authentik/cnpg_cluster.yaml

@@ -64,12 +64,8 @@ spec:
       archive_mode: "on"
       archive_timeout: 5min
       dynamic_shared_memory_type: posix
-      effective_cache_size: 1536MB
+      effective_cache_size: 256MB
       full_page_writes: "on"
-      # Replicas report their oldest xmin to the primary, so multi-second reads on
-      # a hot standby stop exhausting max_standby_streaming_delay and being
-      # cancelled. Retained-dead-tuple cost is negligible on a ~155MB database.
-      hot_standby_feedback: "on"
       log_destination: csvlog
       log_directory: /controller/log
       log_filename: postgres
@@ -81,12 +77,7 @@ spec:
       max_parallel_workers: "16"
       max_replication_slots: "16"
       max_worker_processes: "16"
-      # A pg_stat_statements.* parameter is what makes CNPG treat the extension as
-      # managed and run CREATE EXTENSION in every database; preloading alone does
-      # not create it.
-      pg_stat_statements.max: "10000"
-      pg_stat_statements.track: top
-      shared_buffers: 512MB
+      shared_buffers: 128MB
       shared_memory_type: mmap
       ssl_max_protocol_version: TLSv1.3
       ssl_min_protocol_version: TLSv1.3
@@ -95,9 +86,6 @@ spec:
       wal_log_hints: "on"
       wal_receiver_timeout: 5s
       wal_sender_timeout: 5s
-    # CNPG merges this with the libraries it manages itself.
-    shared_preload_libraries:
-      - pg_stat_statements
     syncReplicaElectionConstraint:
       enabled: false
   primaryUpdateMethod: restart
@@ -117,16 +105,13 @@ spec:
     updateInterval: 30
   resources:
     limits:
-      # 500m is a 50ms CFS quota per 100ms period, exhausted by bursts even at
-      # ~0.01 cores average, so every query pays throttle latency.
-      cpu: "2"
+      cpu: 500m
       # 512Mi OOMKilled replicas under load (shared_buffers 128MB +
       # max_connections 200 leave no headroom) — see incident 2026-07-28.
-      # shared_buffers 512MB needs the same headroom multiple, hence 2Gi.
-      memory: 2Gi
-    requests:
-      cpu: 500m
       memory: 1Gi
+    requests:
+      cpu: 50m
+      memory: 512Mi
   smartShutdownTimeout: 180
   startDelay: 3600
   stopDelay: 1800

apps/base/authentik/httproute.yaml

@@ -37,22 +37,6 @@ spec:
       name: authentik
       sectionName: https
   rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: authentik-server
-          port: 80
-          weight: 1
-      filters:
-        - type: URLRewrite
-          urlRewrite:
-            path:
-              type: ReplaceFullPath
-              replaceFullPath: /application/o/token/
-      matches:
-        - path:
-            type: Exact
-            value: /application/o/token
     - backendRefs:
         - group: ""
           kind: Service
@@ -102,22 +86,6 @@ spec:
       name: authentik-internal
       sectionName: https
   rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: authentik-server
-          port: 80
-          weight: 1
-      filters:
-        - type: URLRewrite
-          urlRewrite:
-            path:
-              type: ReplaceFullPath
-              replaceFullPath: /application/o/token/
-      matches:
-        - path:
-            type: Exact
-            value: /application/o/token
     - backendRefs:
         - group: ""
           kind: Service

apps/base/authentik/kustomization.yaml

@@ -19,7 +19,6 @@ resources:
   - redis-deployment.yaml
   - redis-pvc.yaml
   - redis-service.yaml
-  - server-vmpodscrape.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
   - vmpodscrape.yaml

apps/base/authentik/server-vmpodscrape.yaml

@@ -1,16 +0,0 @@
----
-# Scrape the authentik server's django_prometheus endpoint (:9300). Picked up
-# by the observability VMAgent (selectAllByDefault).
-apiVersion: operator.victoriametrics.com/v1beta1
-kind: VMPodScrape
-metadata:
-  name: authentik-server
-  namespace: authentik
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: authentik
-      app.kubernetes.io/component: server
-  podMetricsEndpoints:
-    - port: metrics
-      path: /metrics

apps/base/bind-external/acme-unkin-net/a/ns1.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: acme-ns1-a
-  namespace: bind-external
-spec:
-  zoneRef: acme-unkin-net
-  name: ns1
-  type: A
-  ttl: 3600
-  values:
-    # Public address of this cluster's external BIND, same target as
-    # acme-ns1.unkin.net. Resolvers that cached the seeded ns1.acme.unkin.net
-    # NS name must still reach the zone.
-    - 103.216.191.185

apps/base/bind-external/acme-unkin-net/kustomization.yaml

@@ -1,11 +0,0 @@
----
-# Authoritative delegation records for acme.unkin.net. Without these the zone
-# only holds the operator's seed apex (NS ns1.acme.unkin.net glued to the
-# primary pod IP), which is unroutable off-cluster and goes stale on
-# reschedule. DNSRecords must live in the same namespace as their BindZone.
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ns
-  - a

apps/base/bind-external/acme-unkin-net/ns/apex.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: acme-apex-ns
-  namespace: bind-external
-spec:
-  zoneRef: acme-unkin-net
-  # "@" is the zone apex.
-  name: "@"
-  type: NS
-  ttl: 3600
-  values:
-    # Matches the parent delegation in Google Cloud DNS. Out of zone, so the
-    # child needs no glue of its own.
-    - acme-ns1.unkin.net.

apps/base/bind-external/acme-unkin-net/ns/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - apex.yaml

apps/base/bind-external/edge-unkin-net/a/kustomization.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - mta1.yaml
-  - mta2.yaml

apps/base/bind-external/edge-unkin-net/a/mta1.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: edge-mta1-a
-  namespace: bind-external
-spec:
-  zoneRef: edge-unkin-net
-  name: "mta1"
-  type: A
-  ttl: 3600
-  values:
-    - 66.226.148.207

apps/base/bind-external/edge-unkin-net/a/mta2.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: edge-mta2-a
-  namespace: bind-external
-spec:
-  zoneRef: edge-unkin-net
-  name: "mta2"
-  type: A
-  ttl: 3600
-  values:
-    - 66.226.149.50

apps/base/bind-external/edge-unkin-net/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - a

apps/base/bind-external/kustomization.yaml

@@ -7,7 +7,4 @@ resources:
   - cluster.yaml
   - tsigkey.yaml
   - zones.yaml
-  - acme-unkin-net
-  - main-unkin-net
-  - edge-unkin-net
   - agent-dns-rolebinding.yaml

apps/base/bind-external/main-unkin-net/a/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - mail-in.yaml

apps/base/bind-external/main-unkin-net/a/mail-in.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-mail-in-a
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "mail-in"
-  type: A
-  ttl: 3600
-  values:
-    - 103.216.191.185

apps/base/bind-external/main-unkin-net/cname/acme-challenge.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-acme-challenge-cname
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "_acme-challenge"
-  type: CNAME
-  ttl: 3600
-  values:
-    - _acme-challenge.main.acme.unkin.net.

apps/base/bind-external/main-unkin-net/cname/au-syd1-pve-api.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-au-syd1-pve-api-cname
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "au-syd1-pve-api"
-  type: CNAME
-  ttl: 3600
-  values:
-    - lb1.unkin.net.

apps/base/bind-external/main-unkin-net/cname/au-syd1-pve.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-au-syd1-pve-cname
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "au-syd1-pve"
-  type: CNAME
-  ttl: 3600
-  values:
-    - lb1.unkin.net.

apps/base/bind-external/main-unkin-net/cname/grafana.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-grafana-cname
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "grafana"
-  type: CNAME
-  ttl: 3600
-  values:
-    - lb1.unkin.net.

apps/base/bind-external/main-unkin-net/cname/kustomization.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - acme-challenge.yaml
-  - au-syd1-pve.yaml
-  - au-syd1-pve-api.yaml
-  - grafana.yaml
-  - lidarr.yaml
-  - nzbget.yaml
-  - prowlarr.yaml
-  - radarr.yaml
-  - readarr.yaml
-  - sonarr.yaml

apps/base/bind-external/main-unkin-net/cname/lidarr.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-lidarr-cname
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "lidarr"
-  type: CNAME
-  ttl: 3600
-  values:
-    - lb1.unkin.net.

apps/base/bind-external/main-unkin-net/cname/nzbget.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-nzbget-cname
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "nzbget"
-  type: CNAME
-  ttl: 3600
-  values:
-    - lb1.unkin.net.

apps/base/bind-external/main-unkin-net/cname/prowlarr.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-prowlarr-cname
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "prowlarr"
-  type: CNAME
-  ttl: 3600
-  values:
-    - lb1.unkin.net.

apps/base/bind-external/main-unkin-net/cname/radarr.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-radarr-cname
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "radarr"
-  type: CNAME
-  ttl: 3600
-  values:
-    - lb1.unkin.net.

apps/base/bind-external/main-unkin-net/cname/readarr.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-readarr-cname
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "readarr"
-  type: CNAME
-  ttl: 3600
-  values:
-    - lb1.unkin.net.

apps/base/bind-external/main-unkin-net/cname/sonarr.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-sonarr-cname
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "sonarr"
-  type: CNAME
-  ttl: 3600
-  values:
-    - lb1.unkin.net.

apps/base/bind-external/main-unkin-net/kustomization.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - a
-  - mx
-  - txt
-  - cname

apps/base/bind-external/main-unkin-net/mx/apex.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-apex-mx
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "@"
-  type: MX
-  ttl: 3600
-  values:
-    - "10 mta1.edge.unkin.net."
-    - "20 mta2.edge.unkin.net."

apps/base/bind-external/main-unkin-net/mx/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - apex.yaml

apps/base/bind-external/main-unkin-net/txt/apex.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-apex-txt
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "@"
-  type: TXT
-  ttl: 3600
-  values:
-    - '"v=spf1 ip4:66.226.148.207 ip4:66.226.149.50 -all"'

apps/base/bind-external/main-unkin-net/txt/dmarc.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-dmarc-txt
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "_dmarc"
-  type: TXT
-  ttl: 3600
-  values:
-    - '"v=DMARC1; p=none; rua=mailto:dmarc@unkin.net; adkim=r; aspf=r"'

apps/base/bind-external/main-unkin-net/txt/kustomization.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - apex.yaml
-  - dmarc.yaml

apps/base/bind-external/zones.yaml

@@ -17,50 +17,3 @@ spec:
   updateKeyRef: certmanager
   allowTransfer:
     - key certmanager
-  # Published apex NS. acme-ns1 is what the parent delegates to and glues; ns1 is
-  # in-zone, so its address is declared below or a reseed would glue it to the
-  # primary pod IP.
-  nameservers:
-    - acme-ns1.unkin.net.
-    - ns1.acme.unkin.net.
-  records:
-    - name: ns1
-      type: A
-      ttl: 3600
-      values: ["103.216.191.185"]
----
-# Public mail zones, delegated from Google Cloud DNS to acme-ns1.unkin.net like
-# acme.unkin.net. DNSRecords are applied with the zone's update key.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: main-unkin-net
-  namespace: bind-external
-spec:
-  clusterRef: bind-external
-  zoneName: main.unkin.net
-  type: primary
-  defaultTTL: 3600
-  dynamicUpdate: true
-  updateKeyRef: certmanager
-  allowTransfer:
-    - key certmanager
-  nameservers:
-    - acme-ns1.unkin.net.
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: edge-unkin-net
-  namespace: bind-external
-spec:
-  clusterRef: bind-external
-  zoneName: edge.unkin.net
-  type: primary
-  defaultTTL: 3600
-  dynamicUpdate: true
-  updateKeyRef: certmanager
-  allowTransfer:
-    - key certmanager
-  nameservers:
-    - acme-ns1.unkin.net.

apps/base/bind-internal/authoritative/ceph-unkin-net/cname/dashboard.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: dashboard-ceph-cname
-  namespace: bind-internal
-spec:
-  zoneRef: ceph-unkin-net
-  name: dashboard
-  type: CNAME
-  ttl: 600
-  values:
-    # Ceph mgr dashboard, reached via lb1. Lets in-cluster clients (the
-    # cephrgw-operator) resolve dashboard.ceph.unkin.net.
-    - lb1.unkin.net.

apps/base/bind-internal/authoritative/ceph-unkin-net/cname/kustomization.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - dashboard.yaml
-  - s3.yaml

apps/base/bind-internal/authoritative/ceph-unkin-net/cname/s3.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: s3-ceph-cname
-  namespace: bind-internal
-spec:
-  zoneRef: ceph-unkin-net
-  name: s3
-  type: CNAME
-  ttl: 600
-  values:
-    # radosgw S3 endpoint. Points at the Consul service for now; the real
-    # target will be changed later.
-    - radosgw.service.consul.

apps/base/bind-internal/authoritative/ceph-unkin-net/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - cname

apps/base/bind-internal/authoritative/kustomization.yaml

@@ -2,15 +2,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
-# Individually-managed authoritative records live under <zone>/<type>/<record>.yaml.
-# DNSRecords must live in the same namespace as their BindZone (the operator
-# resolves zoneRef/clusterRef/updateKeyRef within the record's namespace), so
-# these sit alongside the zone in bind-internal, not in the app namespace.
 resources:
   - cluster.yaml
   - tsigkey.yaml
   - zones.yaml
-  - unkin-net
-  - main-unkin-net
-  - ceph-unkin-net
+  - records.yaml
   - acls.yaml

apps/base/bind-internal/authoritative/main-unkin-net/a/jellyfin.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: jellyfin-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: main-unkin-net
-  name: jellyfin
-  type: A
-  ttl: 600
-  values:
-    # traefik-external haproxy edge Gateway VIP (TLS passthrough).
-    - 198.18.199.0

apps/base/bind-internal/authoritative/main-unkin-net/a/kustomization.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - jellyfin.yaml
-  - mail-in.yaml
-  - lidarr.yaml
-  - nzbget.yaml
-  - prowlarr.yaml
-  - radarr.yaml
-  - readarr.yaml
-  - sonarr.yaml

apps/base/bind-internal/authoritative/main-unkin-net/a/lidarr.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: lidarr-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: main-unkin-net
-  name: lidarr
-  type: A
-  ttl: 600
-  values:
-    # traefik-external haproxy edge Gateway VIP (TLS passthrough).
-    - 198.18.199.0

apps/base/bind-internal/authoritative/main-unkin-net/a/mail-in.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: mail-in-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: main-unkin-net
-  name: mail-in
-  type: A
-  ttl: 600
-  values:
-    # home WAN (public path for edge to smarthost relay), mirrors public DNS.
-    - 103.216.191.185

apps/base/bind-internal/authoritative/main-unkin-net/a/nzbget.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: nzbget-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: main-unkin-net
-  name: nzbget
-  type: A
-  ttl: 600
-  values:
-    # traefik-external haproxy edge Gateway VIP (TLS passthrough).
-    - 198.18.199.0

apps/base/bind-internal/authoritative/main-unkin-net/a/prowlarr.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: prowlarr-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: main-unkin-net
-  name: prowlarr
-  type: A
-  ttl: 600
-  values:
-    # traefik-external haproxy edge Gateway VIP (TLS passthrough).
-    - 198.18.199.0

apps/base/bind-internal/authoritative/main-unkin-net/a/radarr.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: radarr-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: main-unkin-net
-  name: radarr
-  type: A
-  ttl: 600
-  values:
-    # traefik-external haproxy edge Gateway VIP (TLS passthrough).
-    - 198.18.199.0

apps/base/bind-internal/authoritative/main-unkin-net/a/readarr.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: readarr-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: main-unkin-net
-  name: readarr
-  type: A
-  ttl: 600
-  values:
-    # traefik-external haproxy edge Gateway VIP (TLS passthrough).
-    - 198.18.199.0

apps/base/bind-internal/authoritative/main-unkin-net/a/sonarr.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: sonarr-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: main-unkin-net
-  name: sonarr
-  type: A
-  ttl: 600
-  values:
-    # traefik-external haproxy edge Gateway VIP (TLS passthrough).
-    - 198.18.199.0

apps/base/bind-internal/authoritative/main-unkin-net/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - a

apps/base/bind-internal/authoritative/records.yaml

@@ -0,0 +1,164 @@
+# Individually-managed authoritative records for the unkin.net zone.
+# DNSRecords must live in the same namespace as their BindZone (the operator
+# resolves zoneRef/clusterRef/updateKeyRef within the record's namespace), so
+# these sit alongside the zone in bind-internal, not in the app namespace.
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  # "internal" in the name distinguishes this from the external DNS that
+  # Authentik will manage its own records from later.
+  name: identity-dns-internal
+  namespace: bind-internal
+spec:
+  zoneRef: unkin-net
+  name: identity
+  type: A
+  ttl: 600
+  values:
+    # traefik-EXTERNAL (DMZ) gateway VIP; the authentik Gateway serves the
+    # identity.unkin.net hostname there.
+    - 198.18.199.0
+---
+# PRODUCTION CUTOVER RECORD — intentionally commented out.
+# git.unkin.net currently resolves to the LIVE VM forge (HAProxy VRRP VIP
+# 198.18.19.17), which holds every repo the estate depends on. Uncommenting this
+# repoints the whole org's git.unkin.net at the new k8s Gitea gateway VIP, so it
+# is the FINAL step of the forge migration — gated on the data migration (gitea
+# dump/restore + SECRET_KEY copy) in argocd-apps docs/gitea-migration.md.
+# NOTE: the live git.unkin.net answer is served by the puppet DNS master today
+# (profiles::dns::master, records from PuppetDB); this k8s apex zone holds only
+# SOA+NS + a few DNSRecords so far. Confirm the k8s bind cluster is the live
+# authority for unkin.net (or update the puppet record instead) before relying
+# on this CR at cutover.
+# ---
+# apiVersion: bind.unkin.net/v1alpha1
+# kind: DNSRecord
+# metadata:
+#   name: git-dns-internal
+#   namespace: bind-internal
+# spec:
+#   zoneRef: unkin-net
+#   name: git
+#   type: A
+#   ttl: 600
+#   values:
+#     # traefik-internal gateway VIP; the gitea Gateway serves git.unkin.net there.
+#     - 198.18.200.4
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: s3-ceph-cname
+  namespace: bind-internal
+spec:
+  zoneRef: ceph-unkin-net
+  name: s3
+  type: CNAME
+  ttl: 600
+  values:
+    # radosgw S3 endpoint. Points at the Consul service for now; the real
+    # target will be changed later.
+    - radosgw.service.consul.
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: dashboard-ceph-cname
+  namespace: bind-internal
+spec:
+  zoneRef: ceph-unkin-net
+  name: dashboard
+  type: CNAME
+  ttl: 600
+  values:
+    # Ceph mgr dashboard, reached via lb1. Lets in-cluster clients (the
+    # cephrgw-operator) resolve dashboard.ceph.unkin.net.
+    - lb1.unkin.net.
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: lb1-unkin-net
+  namespace: bind-internal
+spec:
+  zoneRef: unkin-net
+  name: lb1
+  type: A
+  ttl: 600
+  values:
+    - 103.216.191.185
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: ghp-dns-internal
+  namespace: bind-internal
+spec:
+  zoneRef: unkin-net
+  name: ghp
+  type: A
+  ttl: 600
+  values:
+    # traefik-internal gateway VIP; the ghp Gateway serves ghp.unkin.net there.
+    - 198.18.200.4
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: arrstack-dns-internal
+  namespace: bind-internal
+spec:
+  zoneRef: unkin-net
+  name: arrstack
+  type: A
+  ttl: 600
+  values:
+    # traefik-EXTERNAL (DMZ) gateway VIP; the arrproxy Gateway serves the
+    # arrstack.unkin.net front door (oauth2-proxy) there.
+    - 198.18.199.0
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: logviewer-dns-internal
+  namespace: bind-internal
+spec:
+  zoneRef: unkin-net
+  name: logviewer
+  type: A
+  ttl: 600
+  values:
+    # traefik-internal gateway VIP; the logviewer Gateway serves
+    # logviewer.unkin.net there.
+    - 198.18.200.4
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: cheeztv-dns-internal
+  namespace: bind-internal
+spec:
+  zoneRef: unkin-net
+  name: cheeztv
+  type: A
+  ttl: 600
+  values:
+    # traefik-internal gateway VIP; the cheeztv Gateway serves cheeztv.unkin.net
+    # there.
+    - 198.18.200.4
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: watchstate-dns-internal
+  namespace: bind-internal
+spec:
+  zoneRef: unkin-net
+  name: watchstate
+  type: A
+  ttl: 600
+  values:
+    # traefik-EXTERNAL (DMZ) gateway VIP; the watchstate-external Gateway serves
+    # the watchstate.unkin.net front door (oauth2-proxy) there.
+    - 198.18.199.0

apps/base/bind-internal/authoritative/unkin-net/a/arrstack.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: arrstack-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: arrstack
-  type: A
-  ttl: 600
-  values:
-    # traefik-EXTERNAL (DMZ) gateway VIP; the arrproxy Gateway serves the
-    # arrstack.unkin.net front door (oauth2-proxy) there.
-    - 198.18.199.0

apps/base/bind-internal/authoritative/unkin-net/a/auth.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: auth-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: auth
-  type: A
-  ttl: 600
-  values:
-    # traefik-internal gateway VIP; the kanidm Gateway serves auth.unkin.net there.
-    - 198.18.200.4

apps/base/bind-internal/authoritative/unkin-net/a/cheeztv.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: cheeztv-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: cheeztv
-  type: A
-  ttl: 600
-  values:
-    # traefik-internal gateway VIP; the cheeztv Gateway serves cheeztv.unkin.net
-    # there.
-    - 198.18.200.4

apps/base/bind-internal/authoritative/unkin-net/a/fafflix.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: fafflix-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: fafflix
-  type: A
-  ttl: 600
-  values:
-    # traefik-external haproxy edge Gateway VIP (TLS passthrough).
-    - 198.18.199.0

apps/base/bind-internal/authoritative/unkin-net/a/ghp.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: ghp-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: ghp
-  type: A
-  ttl: 600
-  values:
-    # traefik-internal gateway VIP; the ghp Gateway serves ghp.unkin.net there.
-    - 198.18.200.4

apps/base/bind-internal/authoritative/unkin-net/a/git-edge.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: git-edge-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: git
-  type: A
-  ttl: 600
-  values:
-    # traefik-external haproxy edge Gateway VIP (TLS passthrough).
-    - 198.18.199.0

apps/base/bind-internal/authoritative/unkin-net/a/git.yaml

@@ -1,23 +0,0 @@
----
-# PRODUCTION CUTOVER RECORD — intentionally commented out.
-# git.unkin.net currently resolves to the haproxy edge (git-edge.yaml), which
-# forwards to the LIVE VM forge holding every repo. Uncommenting this
-# repoints the whole org's git.unkin.net at the new k8s Gitea gateway VIP, so it
-# is the FINAL step of the forge migration — gated on the data migration (gitea
-# dump/restore + SECRET_KEY copy) in argocd-apps docs/gitea-migration.md.
-# Uncomment this record AND its entry in kustomization.yaml (removing
-# git-edge.yaml there) to activate it.
-# ---
-# apiVersion: bind.unkin.net/v1alpha1
-# kind: DNSRecord
-# metadata:
-#   name: git-dns-internal
-#   namespace: bind-internal
-# spec:
-#   zoneRef: unkin-net
-#   name: git
-#   type: A
-#   ttl: 600
-#   values:
-#     # traefik-internal gateway VIP; the gitea Gateway serves git.unkin.net there.
-#     - 198.18.200.4

apps/base/bind-internal/authoritative/unkin-net/a/grafana.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: grafana-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: grafana
-  type: A
-  ttl: 600
-  values:
-    # traefik-EXTERNAL (DMZ) gateway VIP; the grafana-external Gateway serves
-    # grafana.unkin.net there.
-    - 198.18.199.0

apps/base/bind-internal/authoritative/unkin-net/a/identity.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  # "internal" in the name distinguishes this from the external DNS that
-  # Authentik will manage its own records from later.
-  name: identity-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: identity
-  type: A
-  ttl: 600
-  values:
-    # traefik-EXTERNAL (DMZ) gateway VIP; the authentik Gateway serves the
-    # identity.unkin.net hostname there.
-    - 198.18.199.0

apps/base/bind-internal/authoritative/unkin-net/a/kustomization.yaml

@@ -1,23 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - arrstack.yaml
-  - auth.yaml
-  - cheeztv.yaml
-  - fafflix.yaml
-  # PRODUCTION CUTOVER RECORD — see git.yaml. Uncomment together with the
-  # record itself, and remove git-edge.yaml.
-  # - git.yaml
-  - ghp.yaml
-  - git-edge.yaml
-  - grafana.yaml
-  - identity.yaml
-  - lb1.yaml
-  - logviewer.yaml
-  - mail.yaml
-  - mta1-edge.yaml
-  - mta2-edge.yaml
-  - vlogs.yaml
-  - watchstate.yaml

apps/base/bind-internal/authoritative/unkin-net/a/lb1.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: lb1-unkin-net
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: lb1
-  type: A
-  ttl: 600
-  values:
-    - 103.216.191.185

apps/base/bind-internal/authoritative/unkin-net/a/logviewer.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: logviewer-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: logviewer
-  type: A
-  ttl: 600
-  values:
-    # traefik-internal gateway VIP; the logviewer Gateway serves
-    # logviewer.unkin.net there.
-    - 198.18.200.4

apps/base/bind-internal/authoritative/unkin-net/a/mail.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: mail-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: mail
-  type: A
-  ttl: 600
-  values:
-    # stalwart-lb PureLB VIP (IMAPS, submission, HTTPS).
-    - 198.18.200.18

apps/base/bind-internal/authoritative/unkin-net/a/mta1-edge.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: mta1-edge-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: mta1.edge
-  type: A
-  ttl: 600
-  values:
-    # edge MTA 1 public IP, mirrors public DNS.
-    - 66.226.148.207

apps/base/bind-internal/authoritative/unkin-net/a/mta2-edge.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: mta2-edge-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: mta2.edge
-  type: A
-  ttl: 600
-  values:
-    # edge MTA 2 public IP, mirrors public DNS.
-    - 66.226.149.50

apps/base/bind-internal/authoritative/unkin-net/a/vlogs.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: vlogs-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: vlogs
-  type: A
-  ttl: 600
-  values:
-    # traefik-EXTERNAL (DMZ) gateway VIP; the vlogs-external Gateway serves the
-    # vlogs.unkin.net front door (oauth2-proxy) there.
-    - 198.18.199.0

apps/base/bind-internal/authoritative/unkin-net/a/watchstate.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: watchstate-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: watchstate
-  type: A
-  ttl: 600
-  values:
-    # traefik-EXTERNAL (DMZ) gateway VIP; the watchstate-external Gateway serves
-    # the watchstate.unkin.net front door (oauth2-proxy) there.
-    - 198.18.199.0

apps/base/bind-internal/authoritative/unkin-net/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - a

apps/base/bind-internal/resolvers/acls.yaml

@@ -38,9 +38,6 @@ spec:
   clusterRef: bind-resolvers
   entries:
     - 198.18.24.0/24
-    - 172.18.30.0/24  # BinaryLane DMZ VPC syd (mail edge, via VPN)
-    - 172.18.31.0/24  # BinaryLane DMZ VPC mel (mail edge, via VPN)
-    - 172.18.32.0/24  # BinaryLane DMZ VPC bne (mail edge, via VPN)
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindACL

apps/base/bind-internal/resolvers/cluster.yaml

@@ -18,10 +18,9 @@ spec:
       purelb.io/service-group: common
       purelb.io/addresses: 198.18.200.7
       external-dns.alpha.kubernetes.io/hostname: bind-resolvers.k8s.syd1.au.unkin.net
-  # Public names go via global forwarders; RBL zones bypass them (view.yaml).
   forwarders:
-    - 1.1.1.1
     - 8.8.8.8
+    - 1.1.1.1
   # The internal split-horizon zones are served UNSIGNED by the in-cluster
   # authoritative, but their public parents publish DS records (e.g. unkin.net
   # is DNSSEC-signed on the Internet). With dnssec-validation on, the validator

apps/base/bind-internal/resolvers/view.yaml

@@ -21,16 +21,3 @@ spec:
   extraOptions:
     - "allow-recursion { any; }"
     - "allow-query-cache { any; }"
-    # pods have no IPv6 route; v6 NS attempts burn the recursion-query budget
-    - "server ::/0 { bogus yes; }"
-    # RBL zones resolve directly: DNSBLs refuse queries relayed via public resolvers.
-    - 'zone "spamhaus.org" { type forward; forwarders { }; }'
-    - 'zone "mailspike.net" { type forward; forwarders { }; }'
-    - 'zone "spameatingmonkey.net" { type forward; forwarders { }; }'
-    - 'zone "dnswl.org" { type forward; forwarders { }; }'
-    - 'zone "virusfree.cz" { type forward; forwarders { }; }'
-    - 'zone "blocklist.de" { type forward; forwarders { }; }'
-    - 'zone "msbl.org" { type forward; forwarders { }; }'
-    - 'zone "surbl.org" { type forward; forwarders { }; }'
-    - 'zone "uribl.com" { type forward; forwarders { }; }'
-    - 'zone "rspamd.com" { type forward; forwarders { }; }'

apps/base/bind-system/deployment.yaml

@@ -21,7 +21,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: operator
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-operator:v0.4.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-operator:v0.2.6
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081

apps/base/bind-system/kustomization.yaml

@@ -6,7 +6,7 @@ resources:
   - namespace.yaml
   # CRDs are pulled from the bind-operator repo at the matching tag rather than
   # vendored here, so they never drift from the operator.
-  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.4.0/config/crd/install.yaml
+  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.2.6/config/crd/install.yaml
   - rbac.yaml
   - agent-dns-rbac.yaml
   - deployment.yaml

apps/base/cert-manager/certificate_wildcard-ceph-unkin-net.yaml

@@ -1,26 +0,0 @@
----
-# Let's Encrypt *.ceph.unkin.net wildcard for the haproxy edge (ceph dashboard).
-# DNS-01 needs the delegated _acme-challenge.ceph.unkin.net CNAME in the public
-# unkin.net zone.
-# _acme-challenge.ceph.unkin.net. CNAME _acme-challenge.ceph.acme.unkin.net.
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: wildcard-ceph-unkin-net
-  namespace: cert-manager
-spec:
-  secretName: wildcard-ceph-unkin-net-tls
-  secretTemplate:
-    annotations:
-      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "haproxy"
-      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "haproxy"
-  privateKey:
-    size: 4096
-  dnsNames:
-    - "*.ceph.unkin.net"
-  issuerRef:
-    name: letsencrypt
-    kind: ClusterIssuer
-    group: cert-manager.io

apps/base/cert-manager/certificate_wildcard-main-unkin-net.yaml

@@ -1,26 +0,0 @@
----
-# Let's Encrypt *.main.unkin.net wildcard for the haproxy edge (pve, arr stack,
-# jellyfin, stalwart webadmin/autoconfig) and the mail smarthost. DNS-01 needs the delegated
-# _acme-challenge.main.unkin.net CNAME in the public unkin.net zone.
-# _acme-challenge.main.unkin.net. CNAME _acme-challenge.main.acme.unkin.net.
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: wildcard-main-unkin-net
-  namespace: cert-manager
-spec:
-  secretName: wildcard-main-unkin-net-tls
-  secretTemplate:
-    annotations:
-      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "haproxy,mail"
-      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "haproxy,mail"
-  privateKey:
-    size: 4096
-  dnsNames:
-    - "*.main.unkin.net"
-  issuerRef:
-    name: letsencrypt
-    kind: ClusterIssuer
-    group: cert-manager.io

apps/base/cert-manager/certificate_wildcard-unkin-net.yaml

@@ -14,9 +14,9 @@ spec:
   secretTemplate:
     annotations:
       reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy,vlogs,grafana,mail"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner"
       reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy,vlogs,grafana,mail"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner"
   privateKey:
     size: 4096
   dnsNames:

apps/base/cert-manager/kustomization.yaml

@@ -12,5 +12,3 @@ resources:
   - clusterissuer_letsencrypt.yaml
   - clusterissuer_letsencrypt-staging.yaml
   - certificate_wildcard-unkin-net.yaml
-  - certificate_wildcard-main-unkin-net.yaml
-  - certificate_wildcard-ceph-unkin-net.yaml

apps/base/cheeztv/plugin-configmap.yaml

@@ -26,7 +26,7 @@ data:
           </key>
           <value>
             <PluginConfiguration>
-              <OidEndpoint>https://identity.unkin.net/application/o/jellyfin/</OidEndpoint>
+              <OidEndpoint>https://identity.k8s.syd1.au.unkin.net/application/o/jellyfin/</OidEndpoint>
               <OidClientId>jellyfin</OidClientId>
               <OidSecret>@@CLIENT_SECRET@@</OidSecret>
               <Enabled>true</Enabled>

apps/base/cheeztv/service.yaml

@@ -13,4 +13,6 @@ spec:
       targetPort: http
   selector:
     app: cheeztv
+  # Pin each client to one replica to reduce transcode-session churn/takeover.
+  sessionAffinity: ClientIP
   type: ClusterIP

apps/base/cheeztv/statefulset.yaml

@@ -4,8 +4,6 @@ kind: StatefulSet
 metadata:
   name: cheeztv
   namespace: cheeztv
-  annotations:
-    configmap.reloader.stakater.com/auto: "true"
 spec:
   # HA: two replicas coordinate transcode session ownership through Valkey and
   # resume each other's HLS segments off the shared RWX transcode PVC. Stable
@@ -164,7 +162,7 @@ spec:
               readOnly: true
       containers:
         - name: cheeztv
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.4.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.2.0
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

apps/base/clickhouse-system/kustomization.yaml

@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ns1.yaml
+  - namespace.yaml

apps/base/clickhouse-system/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: clickhouse-system
+  name: clickhouse-system

apps/base/dhcp-system/cr/keaapi.yaml

@@ -11,7 +11,7 @@ metadata:
     argocd.argoproj.io/sync-wave: "1"
 spec:
   replicas: 1
-  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/kea-api:v0.1.7
+  image: git.unkin.net/unkin/kea-api:v0.1.3
   tokenSecretName: kea-api-token
   service:
     type: ClusterIP

apps/base/dhcp-system/cr/keacluster.yaml

@@ -11,7 +11,7 @@ metadata:
     argocd.argoproj.io/sync-wave: "1"
 spec:
   replicas: 2
-  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/kea:v0.1.7
+  image: git.unkin.net/unkin/kea:v0.1.3
   domainName: main.unkin.net
   defaultLeaseTime: 1200
   maxLeaseTime: 86400

apps/base/dhcp-system/deployment.yaml

@@ -21,7 +21,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: operator
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/kea-operator:v0.1.7
+          image: git.unkin.net/unkin/kea-operator:v0.1.5
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081

apps/base/fafflix/plugin-configmap.yaml

@@ -26,7 +26,7 @@ data:
           </key>
           <value>
             <PluginConfiguration>
-              <OidEndpoint>https://identity.unkin.net/application/o/jellyfin/</OidEndpoint>
+              <OidEndpoint>https://identity.k8s.syd1.au.unkin.net/application/o/jellyfin/</OidEndpoint>
               <OidClientId>jellyfin</OidClientId>
               <OidSecret>@@CLIENT_SECRET@@</OidSecret>
               <Enabled>true</Enabled>

apps/base/fafflix/service.yaml

@@ -13,4 +13,6 @@ spec:
       targetPort: http
   selector:
     app: fafflix
+  # Pin each client to one replica to reduce transcode-session churn/takeover.
+  sessionAffinity: ClientIP
   type: ClusterIP

apps/base/fafflix/statefulset.yaml

@@ -4,8 +4,6 @@ kind: StatefulSet
 metadata:
   name: fafflix
   namespace: fafflix
-  annotations:
-    configmap.reloader.stakater.com/auto: "true"
 spec:
   # HA: two replicas coordinate transcode session ownership through Valkey and
   # resume each other's HLS segments off the shared RWX transcode PVC. Stable
@@ -164,7 +162,7 @@ spec:
               readOnly: true
       containers:
         - name: fafflix
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.4.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/jellyfin-ha:v0.2.0
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

apps/base/gitea/gateway.yaml

@@ -1,6 +1,11 @@
 ---
-# HTTPS front for the k8s Gitea on git.k8s.syd1.au.unkin.net (external-dns
-# k8s.syd1 zone). git.unkin.net stays on the VM haproxy until cutover.
+# HTTPS front for the k8s Gitea, served on two names:
+#   git.unkin.net              — canonical/production (apex, bind-operator zone;
+#                                DNS flip is the gated cutover step, see the doc)
+#   git.k8s.syd1.au.unkin.net  — admin/backup route (external-dns k8s.syd1 zone),
+#                                same dual-name pattern as identity.unkin.net.
+# The cert-manager Certificate (vault-issuer) takes CN git.unkin.net and gets a
+# DNS SAN for each TLS listener hostname automatically.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -12,13 +17,36 @@ metadata:
     traefik.io/instance: internal
   annotations:
     cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: git.k8s.syd1.au.unkin.net
+    cert-manager.io/common-name: git.unkin.net
     cert-manager.io/private-key-size: "4096"
+    # Only the k8s admin route is published by external-dns (it owns just the
+    # k8s.syd1.au.unkin.net zone). git.unkin.net lives in the apex zone and is
+    # flipped at cutover — NOT managed here.
     external-dns.alpha.kubernetes.io/hostname: git.k8s.syd1.au.unkin.net
     external-dns.alpha.kubernetes.io/target: 198.18.200.4
 spec:
   gatewayClassName: traefik-internal
   listeners:
+    - name: http-primary
+      port: 80
+      protocol: HTTP
+      hostname: git.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https-primary
+      port: 443
+      protocol: HTTPS
+      hostname: git.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: gitea-tls
     - name: http-admin
       port: 80
       protocol: HTTP