unkin-agent
47f7cd9c51
Add a public front door for the WatchState admin UI on watchstate.unkin.net via the external (DMZ) Traefik, alongside the existing internal watchstate.k8s.syd1.au.unkin.net gateway. oauth2-proxy fronts both hostnames. - DNSRecord watchstate-dns-internal (bind-internal/authoritative, unkin.net zone) -> A 198.18.199.0, the traefik-external VIP (arrstack precedent). - watchstate-external Gateway (traefik-external) + HTTPRoutes: http->https redirect and https -> watchstate-oauth2:80. TLS terminated with the Let's Encrypt *.unkin.net wildcard (wildcard-unkin-net-tls), so no cert-manager/external-dns annotations. - oauth2-proxy: relative redirect-url (/oauth2/callback) so reverse-proxy mode derives scheme+host per request, making the callback work on BOTH hosts; cookie + whitelist domains cover both hostnames. - Drop the no-op sync-wave: "0" annotation on the vaultauth default VaultAuth. Dependencies: - wildcard-unkin-net-tls reflection into the watchstate namespace (reflector allow-list, argocd-apps PR #418). - Both callback URIs registered on the Authentik watchstate provider (terraform-authentik, separate PR).
argocd-apps docs
Operational notes for the manifests in this repo.
| Doc | What it covers |
|---|---|
| cnpg-backups.md | How CNPG Postgres backups (WAL archiving + nightly base backups) to Ceph RGW are configured. |
| cnpg-restore.md | Restoring a CNPG cluster: full recovery, point-in-time recovery, cutover, and gotchas. |
| authentik-rancher-sso.md | Manual runtime step to point Rancher's OIDC auth at the canonical identity.unkin.net issuer and trust the internal CA. |
| gitea-migration.md | Staged cutover of the git.unkin.net forge from the Puppet VM to the gitea namespace. |
| ca-rotation.md | Rolling the internal unkin.net PKI CA (vault-ca-cert): what Reloader restarts automatically vs. manual/CNPG restarts. |