From 6277c7fa3357c9a65a4b26df3317d8ab7a08e98d Mon Sep 17 00:00:00 2001 From: Nik Afiq Date: Sat, 1 Aug 2026 23:00:06 +0900 Subject: [PATCH] alert-bridge: switch ingress from HTTPS to plain HTTP Callers on the LAN (e.g. nik-gpu) don't trust this cluster's internal CA, and installing it everywhere was judged not worth it for a LAN-only, bearer-token-authenticated endpoint. Drops the internal-CA Certificate and switches the IngressRoute from websecure to the web entrypoint. --- README.md | 2 +- .../home-services/alert-bridge-ingress.yaml | 37 +++++++------------ 2 files changed, 14 insertions(+), 25 deletions(-) diff --git a/README.md b/README.md index 7f912da..a0dd076 100644 --- a/README.md +++ b/README.md @@ -61,7 +61,7 @@ Public services under `nik4nao.com` use Let's Encrypt. | `https://ha.home.arpa` | Home Assistant | Internal CA | | `https://glances.home.arpa` | Glances on K3s | Internal CA | | `https://glances-debian.home.arpa` | Glances on Debian | Internal CA | -| `https://alert-bridge.home.arpa` | Alert bridge (Discord webhook relay) | Internal CA | +| `http://alert-bridge.home.arpa` | Alert bridge (Discord webhook relay) | Plain HTTP | | `https://watch-party.nik4nao.com` | Watch Party on Mac Mini | Let's Encrypt | | `https://nik4nao.com` | Portfolio | Let's Encrypt | | `http://ca.home.arpa` | Internal CA installer | Plain HTTP | diff --git a/manifests/home-services/alert-bridge-ingress.yaml b/manifests/home-services/alert-bridge-ingress.yaml index 6fb5a4c..23b70ae 100644 --- a/manifests/home-services/alert-bridge-ingress.yaml +++ b/manifests/home-services/alert-bridge-ingress.yaml @@ -1,26 +1,17 @@ # Apply: kubectl apply -f manifests/home-services/alert-bridge-ingress.yaml # Delete: kubectl delete -f manifests/home-services/alert-bridge-ingress.yaml -# Description: Internal-CA TLS certificate and Traefik IngressRoute for -# alert-bridge at alert-bridge.home.arpa, so a caller elsewhere on the home -# network (not inside the k8s cluster, e.g. a cronjob on another LAN host) can -# reach POST /alerts. Modeled on manifests/authentik/authentik-ingress.yaml's -# shape (internal-ca-issuer + websecure entrypoint) rather than -# alexa-bridge-public-ingress.yaml's letsencrypt-prod pattern, since this is -# not exposed to the public internet - LAN-only, same trust tier as Argo CD, -# Traefik's own dashboard, etc. -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: alert-bridge-tls - namespace: home-services -spec: - secretName: alert-bridge-tls - issuerRef: - name: internal-ca-issuer - kind: ClusterIssuer - dnsNames: - - alert-bridge.home.arpa ---- +# Description: Plain-HTTP Traefik IngressRoute for alert-bridge at +# alert-bridge.home.arpa, so a caller elsewhere on the home network (not +# inside the k8s cluster, e.g. a cronjob on another LAN host) can reach +# POST /alerts. Deliberately plain HTTP, not internal-CA TLS like +# authentik-ingress.yaml/ha.home.arpa - callers (e.g. nik-gpu) don't have this +# cluster's internal CA trusted, and the alternative (installing it via +# ca.home.arpa on every caller) was judged not worth it for a LAN-only, +# already-bearer-token-authenticated endpoint. The `/alerts` bearer token +# therefore travels in cleartext on the LAN - accepted tradeoff, not an +# oversight. Revisit (switch back to websecure + internal-ca-issuer, see git +# history for the prior version) if this ever needs to be reachable from +# somewhere less trusted than the home LAN. apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -28,12 +19,10 @@ metadata: namespace: home-services spec: entryPoints: - - websecure + - web routes: - match: Host(`alert-bridge.home.arpa`) kind: Rule services: - name: alert-bridge port: 8080 - tls: - secretName: alert-bridge-tls