gitea_admin/Homelabv4
1
0
Fork 0
mirror of https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git synced 2026-08-21 05:26:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Repoint CoreDNS rewrite at ha-authentik-postgres (has port 61432)

Browse Source 
Follow-up to 8b8549e - pg-authentik-rw only listens on 5432, the app
tier needs 61432. See that commit for the full explanation.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Scooby Husky
2026-08-20 18:34:17 -05:00
co-authored by Claude Sonnet 5
parent 8b8549e432
commit cfbe844ecd
1 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infrastructure/coredns/manifests/coredns-configmap.yaml
+13 -6
View File
@@ -44,12 +44,19 @@ data:
# Multi-site active failover pilot (see # Multi-site active failover pilot (see
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md): home's # /home/scooby/.claude/plans/jiggly-snacking-iverson.md): home's
# own pods resolving the floating pg-authentik.ha.huskypup.net # own pods resolving the floating pg-authentik.ha.huskypup.net
# record always go straight to the local CNPG -rw service instead # record always go straight to a local service instead of
# of round-tripping out through the UniFi WAN port-forward and # round-tripping out through the UniFi WAN port-forward and back
# back in - this UniFi doesn't support NAT hairpin/loopback for # in - this UniFi doesn't support NAT hairpin/loopback for its
# its own forwarded ports (confirmed live 2026-08-20: DNS # own forwarded ports (confirmed live 2026-08-20: DNS resolved
# resolved fine, TCP connect failed). # fine, TCP connect failed). Points at ha-authentik-postgres, NOT
rewrite name pg-authentik.ha.huskypup.net pg-authentik-rw.authentik.svc.cluster.local # CNPG's own pg-authentik-rw directly - rewrite only changes the
# resolved name, not the port a client then connects to, and the
# app tier is configured for port 61432 (matching the external
# floating hostname) - pg-authentik-rw only listens on 5432,
# ha-authentik-postgres additionally listens on 61432 (see
# infrastructure/authentik/manifests/ha-postgres-nodeport.yaml)
# specifically so this rewrite target actually has that port.
rewrite name pg-authentik.ha.huskypup.net ha-authentik-postgres.authentik.svc.cluster.local
kubernetes cluster.local in-addr.arpa ip6.arpa { kubernetes cluster.local in-addr.arpa ip6.arpa {
pods insecure pods insecure