Nik Afiq
6277c7fa33
Some checks failed
validate / lint (push) Failing after 1s
Callers on the LAN (e.g. nik-gpu) don't trust this cluster's internal CA, and installing it everywhere was judged not worth it for a LAN-only, bearer-token-authenticated endpoint. Drops the internal-CA Certificate and switches the IngressRoute from websecure to the web entrypoint.
29 lines
1.2 KiB
YAML
29 lines
1.2 KiB
YAML
# Apply: kubectl apply -f manifests/home-services/alert-bridge-ingress.yaml
|
|
# Delete: kubectl delete -f manifests/home-services/alert-bridge-ingress.yaml
|
|
# Description: Plain-HTTP Traefik IngressRoute for alert-bridge at
|
|
# alert-bridge.home.arpa, so a caller elsewhere on the home network (not
|
|
# inside the k8s cluster, e.g. a cronjob on another LAN host) can reach
|
|
# POST /alerts. Deliberately plain HTTP, not internal-CA TLS like
|
|
# authentik-ingress.yaml/ha.home.arpa - callers (e.g. nik-gpu) don't have this
|
|
# cluster's internal CA trusted, and the alternative (installing it via
|
|
# ca.home.arpa on every caller) was judged not worth it for a LAN-only,
|
|
# already-bearer-token-authenticated endpoint. The `/alerts` bearer token
|
|
# therefore travels in cleartext on the LAN - accepted tradeoff, not an
|
|
# oversight. Revisit (switch back to websecure + internal-ca-issuer, see git
|
|
# history for the prior version) if this ever needs to be reachable from
|
|
# somewhere less trusted than the home LAN.
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: alert-bridge
|
|
namespace: home-services
|
|
spec:
|
|
entryPoints:
|
|
- web
|
|
routes:
|
|
- match: Host(`alert-bridge.home.arpa`)
|
|
kind: Rule
|
|
services:
|
|
- name: alert-bridge
|
|
port: 8080
|