apps/base/ghp/configmap.yaml

@@ -6,9 +6,21 @@ metadata:
   namespace: ghp
 data:
   GHP_DATABASE_DRIVER: postgres
+  # ghp runs in plain-HTTP reverse-proxy mode: the traefik gateway terminates TLS
+  # for ghp.unkin.net and forwards cleartext to container :8080, where ghp SERVES
+  # the full app (mgmt UI + API) via GHP_SERVER_LISTEN.
+  #
+  # Do NOT set GHP_SERVER_HTTPS_LISTEN here. Any non-empty https_listen flips ghp
+  # into TLS-only mode (server.go Run(): hasTLS -> serveTLS): the app is served on
+  # :8443 and http_listen becomes a 308 http->https REDIRECT listener, while
+  # GHP_SERVER_LISTEN is ignored entirely. The gateway forwarding cleartext into
+  # that redirect listener on :8080 was the ghp.unkin.net -> ghp.unkin.net 308 loop.
+  #
   # nonroot cannot bind <1024; listen high and remap in the Service.
-  GHP_SERVER_HTTPS_LISTEN: ":8443"
-  GHP_SERVER_HTTP_LISTEN: ":8080"
+  GHP_SERVER_LISTEN: ":8080"
+  # Behind the TLS-terminating gateway: trust its X-Forwarded-* / Forwarded headers
+  # for scheme/host when generating absolute URLs (GHP_SERVER_BASE_URL is also set).
+  GHP_SERVER_TRUST_PROXY_HEADERS: "true"
   GHP_METRICS_LISTEN: ":9136"
   GHP_METRICS_ENABLED: "true"
   GHP_SERVER_BASE_URL: https://ghp.unkin.net

apps/base/ghp/deployment.yaml

@@ -102,7 +102,10 @@ spec:
             httpGet:
               path: /metrics
               port: metrics
-              scheme: HTTPS
+              # Plain HTTP: ghp only serves metrics over TLS in TLS mode
+              # (hasTLS). In reverse-proxy/plain mode the metrics server is
+              # cleartext, so probe with HTTP.
+              scheme: HTTP
             initialDelaySeconds: 30
             periodSeconds: 30
             successThreshold: 1
@@ -112,7 +115,10 @@ spec:
             httpGet:
               path: /metrics
               port: metrics
-              scheme: HTTPS
+              # Plain HTTP: ghp only serves metrics over TLS in TLS mode
+              # (hasTLS). In reverse-proxy/plain mode the metrics server is
+              # cleartext, so probe with HTTP.
+              scheme: HTTP
             initialDelaySeconds: 10
             periodSeconds: 5
             successThreshold: 1

apps/base/ghp/vmservicescrape.yaml

@@ -16,8 +16,6 @@ spec:
   endpoints:
     - port: metrics
       path: /metrics
-      scheme: https
-      # ghp serves metrics over TLS with an internal-CA cert; skip verification
-      # since the scrape targets a pod IP the cert SANs do not cover.
-      tlsConfig:
-        insecureSkipVerify: true
+      # ghp runs in plain reverse-proxy mode (no GHP_SERVER_HTTPS_LISTEN), so the
+      # metrics server is cleartext HTTP rather than TLS. Scrape over http.
+      scheme: http