unkin-agent
d42d013541
why: cheeztv.unkin.net needs a publicly-trusted cert; DNS-01 via the delegated acme.unkin.net zone is now working (staging wildcard verified end-to-end in ~70s). A single centrally-managed wildcard avoids per-host CNAMEs and LE duplicate-order rate limits. - add Certificate wildcard-unkin-net (cert-manager ns, ClusterIssuer letsencrypt prod, secret wildcard-unkin-net-tls) with emberstack reflector secretTemplate annotations - reflect the secret into the cheeztv namespace (append future consumers to the two reflector namespace lists) - point the public cheeztv gateway listener at wildcard-unkin-net-tls and drop its vault-issuer annotations (cheeztv-internal stays on vault-issuer) Reviewed-on: #417 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
82 lines
2.4 KiB
YAML
82 lines
2.4 KiB
YAML
---
|
|
# Friendly public hostname for the kids instance, cheeztv.unkin.net. Same
|
|
# internal-Traefik + external-dns pattern as logviewer.unkin.net: external-dns
|
|
# publishes the A record at the internal LB VIP (198.18.200.4). Public TLS is
|
|
# terminated with the real Let's Encrypt *.unkin.net wildcard, centrally minted
|
|
# once in the cert-manager namespace (Certificate wildcard-unkin-net) and
|
|
# reflected into this namespace by the emberstack reflector as the secret
|
|
# wildcard-unkin-net-tls, not the Vault PKI issuer.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
labels:
|
|
traefik.io/instance: internal
|
|
annotations:
|
|
external-dns.alpha.kubernetes.io/hostname: cheeztv.unkin.net
|
|
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
|
name: cheeztv
|
|
namespace: cheeztv
|
|
spec:
|
|
gatewayClassName: traefik-internal
|
|
listeners:
|
|
- allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
hostname: cheeztv.unkin.net
|
|
name: http
|
|
port: 80
|
|
protocol: HTTP
|
|
- allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
hostname: cheeztv.unkin.net
|
|
name: https
|
|
port: 443
|
|
protocol: HTTPS
|
|
tls:
|
|
certificateRefs:
|
|
- group: ""
|
|
kind: Secret
|
|
name: wildcard-unkin-net-tls
|
|
mode: Terminate
|
|
---
|
|
# Cluster hostname variant, mirroring fafflix's jellyfin.k8s.syd1.au.unkin.net
|
|
# gateway 1:1 (internal Traefik, external-dns at 198.18.200.4). Own cert secret
|
|
# so each hostname gets its own leaf.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
labels:
|
|
traefik.io/instance: internal
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: vault-issuer
|
|
cert-manager.io/common-name: cheeztv.k8s.syd1.au.unkin.net
|
|
cert-manager.io/private-key-size: "4096"
|
|
external-dns.alpha.kubernetes.io/hostname: cheeztv.k8s.syd1.au.unkin.net
|
|
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
|
name: cheeztv-internal
|
|
namespace: cheeztv
|
|
spec:
|
|
gatewayClassName: traefik-internal
|
|
listeners:
|
|
- allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
hostname: cheeztv.k8s.syd1.au.unkin.net
|
|
name: http
|
|
port: 80
|
|
protocol: HTTP
|
|
- allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
hostname: cheeztv.k8s.syd1.au.unkin.net
|
|
name: https
|
|
port: 443
|
|
protocol: HTTPS
|
|
tls:
|
|
certificateRefs:
|
|
- group: ""
|
|
kind: Secret
|
|
name: cheeztv-internal-tls
|
|
mode: Terminate
|