Add a public front door for the WatchState admin UI on watchstate.unkin.net
via the external (DMZ) Traefik, alongside the existing internal
watchstate.k8s.syd1.au.unkin.net gateway. oauth2-proxy fronts both hostnames.
- DNSRecord watchstate-dns-internal (bind-internal/authoritative, unkin.net
zone) -> A 198.18.199.0, the traefik-external VIP (arrstack precedent).
- watchstate-external Gateway (traefik-external) + HTTPRoutes: http->https
redirect and https -> watchstate-oauth2:80. TLS terminated with the
Let's Encrypt *.unkin.net wildcard (wildcard-unkin-net-tls), so no
cert-manager/external-dns annotations.
- oauth2-proxy: relative redirect-url (/oauth2/callback) so reverse-proxy mode
derives scheme+host per request, making the callback work on BOTH hosts;
cookie + whitelist domains cover both hostnames.
- Drop the no-op sync-wave: "0" annotation on the vaultauth default VaultAuth.
Dependencies:
- wildcard-unkin-net-tls reflection into the watchstate namespace (reflector
allow-list, argocd-apps PR #418).
- Both callback URIs registered on the Authentik watchstate provider
(terraform-authentik, separate PR).
unkin-agent