unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

ghp: serve at ghp.unkin.net (gateway + cert + httproute + DNS) #360

Merged
benvin merged 1 commits from benvin/ghp-unkin-net into main 2026-08-13 22:48:24 +10:00
Conversation 0 Commits 1 Files Changed 4
+70 -17
unkin-agent commented 2026-08-13 22:30:58 +10:00
Member
Copy Link
Copy Source

Why

Make ghp.unkin.net the primary URL that the ghp app responds to. Until now ghp has only been reachable at the internal admin name ghp.k8s.syd1.au.unkin.net; this promotes the apex unkin.net name to canonical (mirroring the gitea apex pattern) while keeping the k8s name as the admin/internal route.

How

  • apps/base/ghp/gateway.yaml — add ghp.unkin.net as the PRIMARY http/https listeners (http-primary/https-primary) and keep ghp.k8s.syd1.au.unkin.net as the admin route (http-admin/https-admin), mirroring gitea. Add the cert-manager gateway annotations (cluster-issuer: vault-issuer, common-name: ghp.unkin.net, private-key-size: "4096") so cert-manager mints a NEW ghp-gateway-tls Secret with CN ghp.unkin.net + a SAN per TLS listener hostname (so it also covers the k8s host). Both https listeners' certificateRefs point at ghp-gateway-tls. This is a separate Secret from ghp-tls (ghp's own GitHub-impersonation cert), so cert-manager never fights over it. external-dns annotation stays scoped to the k8s host only — the apex is not published by external-dns.
  • apps/base/ghp/httproute.yaml — add ghp.unkin.net to hostnames; update parentRefs to attach to the renamed http-primary/http-admin/https-primary/https-admin sections.
  • apps/base/ghp/configmap.yaml — set GHP_SERVER_MANAGEMENT_HOST: ghp.unkin.net and GHP_SERVER_BASE_URL: https://ghp.unkin.net, so ghp serves its mgmt UI on that Host and OAuth callbacks use the new base.
  • apps/base/bind-internal/authoritative/records.yaml — add a bind-operator DNSRecord ghp-dns-internal for ghp.unkin.net -> A 198.18.200.4 (traefik-internal gateway VIP), mirroring the active identity-dns-internal record in the same file.

⚠️ NOTE — GitHub App OAuth callback must be updated on github.com

The GitHub App's OAuth callback URL must be changed on github.com to https://ghp.unkin.net/auth/github/callback. It was set to the k8s host in the runbook; OAuth login will break until this is updated.

Note on DNS authority

The bind-operator apex unkin.net zone comments warn that some apex names may still be served by the puppet DNS master (records from PuppetDB), with the k8s bind cluster not yet confirmed as the live authority for unkin.net. This DNSRecord mirrors the already-active identity/lb1 apex records in the same file, so it is consistent with them — but if the k8s bind cluster is not the live authority for unkin.net, ghp.unkin.net will not resolve from this Record alone and the puppet master record must be added instead.

Validation

kustomize build of the ghp and bind-internal overlays render clean; kubeconform (strict) valid; yamllint + pre-commit clean. Not applied.

## Why Make `ghp.unkin.net` the primary URL that the ghp app responds to. Until now ghp has only been reachable at the internal admin name `ghp.k8s.syd1.au.unkin.net`; this promotes the apex `unkin.net` name to canonical (mirroring the gitea apex pattern) while keeping the k8s name as the admin/internal route. ## How - **`apps/base/ghp/gateway.yaml`** — add `ghp.unkin.net` as the PRIMARY http/https listeners (`http-primary`/`https-primary`) and keep `ghp.k8s.syd1.au.unkin.net` as the admin route (`http-admin`/`https-admin`), mirroring gitea. Add the cert-manager gateway annotations (`cluster-issuer: vault-issuer`, `common-name: ghp.unkin.net`, `private-key-size: "4096"`) so cert-manager mints a NEW `ghp-gateway-tls` Secret with CN `ghp.unkin.net` + a SAN per TLS listener hostname (so it also covers the k8s host). Both https listeners' `certificateRefs` point at `ghp-gateway-tls`. This is a separate Secret from `ghp-tls` (ghp's own GitHub-impersonation cert), so cert-manager never fights over it. external-dns annotation stays scoped to the k8s host only — the apex is not published by external-dns. - **`apps/base/ghp/httproute.yaml`** — add `ghp.unkin.net` to `hostnames`; update `parentRefs` to attach to the renamed `http-primary`/`http-admin`/`https-primary`/`https-admin` sections. - **`apps/base/ghp/configmap.yaml`** — set `GHP_SERVER_MANAGEMENT_HOST: ghp.unkin.net` and `GHP_SERVER_BASE_URL: https://ghp.unkin.net`, so ghp serves its mgmt UI on that Host and OAuth callbacks use the new base. - **`apps/base/bind-internal/authoritative/records.yaml`** — add a bind-operator `DNSRecord` `ghp-dns-internal` for `ghp.unkin.net` -> **A 198.18.200.4** (traefik-internal gateway VIP), mirroring the active `identity-dns-internal` record in the same file. ## ⚠️ NOTE — GitHub App OAuth callback must be updated on github.com The GitHub App's OAuth callback URL must be changed on github.com to **`https://ghp.unkin.net/auth/github/callback`**. It was set to the k8s host in the runbook; OAuth login will break until this is updated. ## Note on DNS authority The bind-operator apex `unkin.net` zone comments warn that some apex names may still be served by the puppet DNS master (records from PuppetDB), with the k8s bind cluster not yet confirmed as the live authority for `unkin.net`. This DNSRecord mirrors the already-active `identity`/`lb1` apex records in the same file, so it is consistent with them — but if the k8s bind cluster is not the live authority for `unkin.net`, `ghp.unkin.net` will not resolve from this Record alone and the puppet master record must be added instead. ## Validation `kustomize build` of the ghp and bind-internal overlays render clean; kubeconform (strict) valid; yamllint + pre-commit clean. Not applied.
unkin-agent added 1 commit 2026-08-13 22:30:58 +10:00
ghp: serve at ghp.unkin.net (gateway + cert + httproute + DNS)
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
916b0c5e70
benvin merged commit 5e2eecda6b into main 2026-08-13 22:48:24 +10:00
benvin deleted branch benvin/ghp-unkin-net 2026-08-13 22:48:24 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#360
Delete Branch "benvin/ghp-unkin-net"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?