unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

watchstate: expose externally at watchstate.unkin.net #420

Merged
benvin merged 1 commits from benvin/watchstate-external into main 2026-08-26 21:47:03 +10:00
Conversation 0 Commits 1 Files Changed 6
+118 -5
unkin-agent commented 2026-08-25 21:47:13 +10:00
Member
Copy Link
Copy Source

Why

WatchState currently only has an internal front door (watchstate.k8s.syd1.au.unkin.net, PR #419, merged). This adds a public front door at watchstate.unkin.net via the external (DMZ) Traefik so the admin UI is reachable off-cluster, still fully gated by oauth2-proxy/Authentik. The internal gateway and routes are untouched; oauth2-proxy now fronts BOTH hostnames.

Stacked base note: the intended base (benvin/watchstate-deploy, PR #419) merged into main before this PR opened, so this targets main.

How

  • DNS: watchstate-dns-internal DNSRecord in apps/base/bind-internal/authoritative/records.yaml (unkin.net zone, bind-internal) -> A 198.18.199.0, the traefik-external VIP. Mirrors the arrstack-dns-internal precedent (external front door via bind, not external-dns). Kept in the central bind-internal location, so no AppProject destination widening is needed.
  • Gateway: new watchstate-external Gateway (gatewayClassName: traefik-external), http + https listeners on hostname watchstate.unkin.net. TLS terminated with the Let's Encrypt *.unkin.net wildcard secret wildcard-unkin-net-tls — so no cert-manager and no external-dns annotations.
  • Routes: watchstate-external-http-redirect (http->https 301) and watchstate-external (https -> watchstate-oauth2:80), mirroring the arrproxy/cheeztv external patterns.
  • oauth2-proxy dual-host: OAUTH2_PROXY_REDIRECT_URL changed from the pinned cluster callback to the relative /oauth2/callback. With OAUTH2_PROXY_REVERSE_PROXY=true (already set), oauth2-proxy derives scheme+host per request from X-Forwarded-Proto/Host (verified in oauth2-proxy v7.15.3 getOAuthRedirectURI: host-less redirectURL falls through to request-derived), so the callback works on both watchstate.unkin.net and watchstate.k8s.syd1.au.unkin.net. COOKIE_DOMAINS and WHITELIST_DOMAINS now list both hosts (one cookie per host; a single parent-domain cookie can't cleanly span unkin.net vs k8s.syd1.au.unkin.net).
  • Dropped the no-op argocd.argoproj.io/sync-wave: "0" annotation on the default VaultAuth. New resources intentionally carry no sync-wave annotations.

Validation

  • kustomize build --enable-helm on apps/overlays/au-syd1/watchstate and .../bind-internal: OK.
  • kubeconform (repo CI config, k8s 1.33.7): watchstate overlay 15/15 valid (2 Gateways, 4 HTTPRoutes); bind-internal overlay 67/67 valid (incl. watchstate-dns-internal).

Dependencies

  • Reflector allow-list (argocd-apps PR #418): reflects wildcard-unkin-net-tls into the watchstate namespace. This PR references that secret as if present.
  • Authentik (terraform-authentik, separate PR): register both https://watchstate.unkin.net/oauth2/callback and https://watchstate.k8s.syd1.au.unkin.net/oauth2/callback as redirect URIs on the watchstate provider.
## Why WatchState currently only has an internal front door (watchstate.k8s.syd1.au.unkin.net, PR #419, merged). This adds a public front door at **watchstate.unkin.net** via the external (DMZ) Traefik so the admin UI is reachable off-cluster, still fully gated by oauth2-proxy/Authentik. The internal gateway and routes are untouched; oauth2-proxy now fronts BOTH hostnames. Stacked base note: the intended base (benvin/watchstate-deploy, PR #419) merged into main before this PR opened, so this targets `main`. ## How - **DNS**: `watchstate-dns-internal` DNSRecord in `apps/base/bind-internal/authoritative/records.yaml` (unkin.net zone, bind-internal) -> `A 198.18.199.0`, the traefik-external VIP. Mirrors the `arrstack-dns-internal` precedent (external front door via bind, not external-dns). Kept in the central bind-internal location, so no AppProject destination widening is needed. - **Gateway**: new `watchstate-external` Gateway (`gatewayClassName: traefik-external`), http + https listeners on hostname `watchstate.unkin.net`. TLS terminated with the Let's Encrypt `*.unkin.net` wildcard secret `wildcard-unkin-net-tls` — so **no cert-manager and no external-dns annotations**. - **Routes**: `watchstate-external-http-redirect` (http->https 301) and `watchstate-external` (https -> `watchstate-oauth2:80`), mirroring the arrproxy/cheeztv external patterns. - **oauth2-proxy dual-host**: `OAUTH2_PROXY_REDIRECT_URL` changed from the pinned cluster callback to the **relative** `/oauth2/callback`. With `OAUTH2_PROXY_REVERSE_PROXY=true` (already set), oauth2-proxy derives scheme+host per request from `X-Forwarded-Proto/Host` (verified in oauth2-proxy v7.15.3 `getOAuthRedirectURI`: host-less redirectURL falls through to request-derived), so the callback works on both `watchstate.unkin.net` and `watchstate.k8s.syd1.au.unkin.net`. `COOKIE_DOMAINS` and `WHITELIST_DOMAINS` now list both hosts (one cookie per host; a single parent-domain cookie can't cleanly span unkin.net vs k8s.syd1.au.unkin.net). - Dropped the no-op `argocd.argoproj.io/sync-wave: "0"` annotation on the `default` VaultAuth. New resources intentionally carry no sync-wave annotations. ## Validation - `kustomize build --enable-helm` on `apps/overlays/au-syd1/watchstate` and `.../bind-internal`: OK. - kubeconform (repo CI config, k8s 1.33.7): watchstate overlay 15/15 valid (2 Gateways, 4 HTTPRoutes); bind-internal overlay 67/67 valid (incl. `watchstate-dns-internal`). ## Dependencies - **Reflector allow-list (argocd-apps PR #418)**: reflects `wildcard-unkin-net-tls` into the `watchstate` namespace. This PR references that secret as if present. - **Authentik (terraform-authentik, separate PR)**: register both `https://watchstate.unkin.net/oauth2/callback` and `https://watchstate.k8s.syd1.au.unkin.net/oauth2/callback` as redirect URIs on the watchstate provider.
unkin-agent added 1 commit 2026-08-26 21:45:16 +10:00
watchstate: expose externally at watchstate.unkin.net
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
47f7cd9c51 
Add a public front door for the WatchState admin UI on watchstate.unkin.net
via the external (DMZ) Traefik, alongside the existing internal
watchstate.k8s.syd1.au.unkin.net gateway. oauth2-proxy fronts both hostnames.

- DNSRecord watchstate-dns-internal (bind-internal/authoritative, unkin.net
  zone) -> A 198.18.199.0, the traefik-external VIP (arrstack precedent).
- watchstate-external Gateway (traefik-external) + HTTPRoutes: http->https
  redirect and https -> watchstate-oauth2:80. TLS terminated with the
  Let's Encrypt *.unkin.net wildcard (wildcard-unkin-net-tls), so no
  cert-manager/external-dns annotations.
- oauth2-proxy: relative redirect-url (/oauth2/callback) so reverse-proxy mode
  derives scheme+host per request, making the callback work on BOTH hosts;
  cookie + whitelist domains cover both hostnames.
- Drop the no-op sync-wave: "0" annotation on the vaultauth default VaultAuth.

Dependencies:
- wildcard-unkin-net-tls reflection into the watchstate namespace (reflector
  allow-list, argocd-apps PR #418).
- Both callback URIs registered on the Authentik watchstate provider
  (terraform-authentik, separate PR).
unkin-agent force-pushed benvin/watchstate-external from 931bfcf923 to 47f7cd9c51 2026-08-26 21:45:16 +10:00 Compare
benvin merged commit b9f727bc97 into main 2026-08-26 21:47:03 +10:00
benvin deleted branch benvin/watchstate-external 2026-08-26 21:47:03 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#420
Delete Branch "benvin/watchstate-external"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?