unkin-agent
51243d8145
The traefik gateway terminates TLS for ghp.unkin.net and forwards cleartext to the ghp Service port 80 -> container :8080. But :8080 was GHP_SERVER_HTTP_LISTEN, ghp's http->https 308 REDIRECT listener, so ghp bounced every request back to https, which the gateway forwarded to :8080 again: an infinite ghp.unkin.net -> ghp.unkin.net 308 loop. Per ghp source (internal/server/server.go Run/serveTLS/servePlain, redirect.go), the app is served on either GHP_SERVER_LISTEN (plain, full handler incl. mgmt UI + API) OR GHP_SERVER_HTTPS_LISTEN (own TLS) - it is strictly either/or: any non-empty https_listen sets hasTLS and runs serveTLS, in which GHP_SERVER_LISTEN is ignored and http_listen only ever redirects. To serve cleartext on :8080 behind the TLS-terminating gateway, ghp must run in plain mode: - configmap: drop GHP_SERVER_HTTPS_LISTEN + GHP_SERVER_HTTP_LISTEN; set GHP_SERVER_LISTEN ":8080" so :8080 SERVES the app; add GHP_SERVER_TRUST_PROXY_HEADERS so ghp trusts the gateway's X-Forwarded-*/Forwarded for scheme/host. - deployment + vmservicescrape: the metrics server only wraps TLS when hasTLS is true, so in plain mode it is cleartext - switch the /metrics probes and the scrape from HTTPS/https to HTTP/http. Service, HTTPRoute and Gateway are unchanged.
argocd-apps docs
Operational notes for the manifests in this repo.
| Doc | What it covers |
|---|---|
| cnpg-backups.md | How CNPG Postgres backups (WAL archiving + nightly base backups) to Ceph RGW are configured. |
| cnpg-restore.md | Restoring a CNPG cluster: full recovery, point-in-time recovery, cutover, and gotchas. |
| authentik-rancher-sso.md | Manual runtime step to point Rancher's OIDC auth at the canonical identity.unkin.net issuer and trust the internal CA. |
| gitea-migration.md | Staged cutover of the git.unkin.net forge from the Puppet VM to the gitea namespace. |
| ca-rotation.md | Rolling the internal unkin.net PKI CA (vault-ca-cert): what Reloader restarts automatically vs. manual/CNPG restarts. |