From 1c01b7e6caa24ed81f488858f44295a9f82f805e Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 27 Sep 2026 09:55:58 +1000 Subject: [PATCH] Allow k8s edge health checks on arrstack hosts (#532) The Kubernetes-hosted haproxy edge probes the arr/nzbget backends on `/consul/health`, but its traffic arrives SNATed from the node ranges rather than the DMZ edge, so nginx returns 403 and every backend health-checks down. - Allow `198.18.21.0/24` (2.5gbe physical), `198.18.15.0/24` and `198.18.19.0/24` (node loopbacks) on the `arrstack_web_healthcheck` location. - Keep `198.18.24.0/24` so the existing DMZ edge stays healthy through cutover. --------- Co-authored-by: unkin-agent Reviewed-on: https://git.unkin.net/unkin/puppet-prod/pulls/532 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- hieradata/roles/apps/media.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hieradata/roles/apps/media.yaml b/hieradata/roles/apps/media.yaml index 2780ede..6f2e113 100644 --- a/hieradata/roles/apps/media.yaml +++ b/hieradata/roles/apps/media.yaml @@ -65,6 +65,9 @@ profiles::nginx::simpleproxy::locations: - 127.0.0.1 - "%{facts.networking.ip}" - 198.18.24.0/24 + - 198.18.21.0/24 + - 198.18.15.0/24 + - 198.18.19.0/24 location_deny: - all # authorised access from external