alert-bridge: switch ingress from HTTPS to plain HTTP

Callers on the LAN (e.g. nik-gpu) don't trust this cluster's internal CA,
and installing it everywhere was judged not worth it for a LAN-only,
bearer-token-authenticated endpoint. Drops the internal-CA Certificate and
switches the IngressRoute from websecure to the web entrypoint.

README.md

@@ -61,7 +61,7 @@ Public services under `nik4nao.com` use Let's Encrypt.
 | `https://ha.home.arpa` | Home Assistant | Internal CA |
 | `https://glances.home.arpa` | Glances on K3s | Internal CA |
 | `https://glances-debian.home.arpa` | Glances on Debian | Internal CA |
-| `https://alert-bridge.home.arpa` | Alert bridge (Discord webhook relay) | Internal CA |
+| `http://alert-bridge.home.arpa` | Alert bridge (Discord webhook relay) | Plain HTTP |
 | `https://watch-party.nik4nao.com` | Watch Party on Mac Mini | Let's Encrypt |
 | `https://nik4nao.com` | Portfolio | Let's Encrypt |
 | `http://ca.home.arpa` | Internal CA installer | Plain HTTP |

manifests/home-services/alert-bridge-ingress.yaml

@@ -1,26 +1,17 @@
 # Apply: kubectl apply -f manifests/home-services/alert-bridge-ingress.yaml
 # Delete: kubectl delete -f manifests/home-services/alert-bridge-ingress.yaml
-# Description: Internal-CA TLS certificate and Traefik IngressRoute for
-# alert-bridge at alert-bridge.home.arpa, so a caller elsewhere on the home
-# network (not inside the k8s cluster, e.g. a cronjob on another LAN host) can
-# reach POST /alerts. Modeled on manifests/authentik/authentik-ingress.yaml's
-# shape (internal-ca-issuer + websecure entrypoint) rather than
-# alexa-bridge-public-ingress.yaml's letsencrypt-prod pattern, since this is
-# not exposed to the public internet - LAN-only, same trust tier as Argo CD,
-# Traefik's own dashboard, etc.
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: alert-bridge-tls
-  namespace: home-services
-spec:
-  secretName: alert-bridge-tls
-  issuerRef:
-    name: internal-ca-issuer
-    kind: ClusterIssuer
-  dnsNames:
-    - alert-bridge.home.arpa
----
+# Description: Plain-HTTP Traefik IngressRoute for alert-bridge at
+# alert-bridge.home.arpa, so a caller elsewhere on the home network (not
+# inside the k8s cluster, e.g. a cronjob on another LAN host) can reach
+# POST /alerts. Deliberately plain HTTP, not internal-CA TLS like
+# authentik-ingress.yaml/ha.home.arpa - callers (e.g. nik-gpu) don't have this
+# cluster's internal CA trusted, and the alternative (installing it via
+# ca.home.arpa on every caller) was judged not worth it for a LAN-only,
+# already-bearer-token-authenticated endpoint. The `/alerts` bearer token
+# therefore travels in cleartext on the LAN - accepted tradeoff, not an
+# oversight. Revisit (switch back to websecure + internal-ca-issuer, see git
+# history for the prior version) if this ever needs to be reachable from
+# somewhere less trusted than the home LAN.
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -28,12 +19,10 @@ metadata:
   namespace: home-services
 spec:
   entryPoints:
-    - websecure
+    - web
   routes:
     - match: Host(`alert-bridge.home.arpa`)
       kind: Rule
       services:
         - name: alert-bridge
           port: 8080
-  tls:
-    secretName: alert-bridge-tls