# Brings kube-system/coredns's Corefile under GitOps management. It was
# previously only ever edited live via kubectl (3 existing rewrite rules
# for auth/rancher/netbird.kube.huskypup.net, none of them git-tracked
# anywhere in this repo) - every future change meant a manual,
# classifier-gated live edit to a cluster-wide DNS config instead of a
# normal git commit ArgoCD applies on its own. No Talos/kubeadm
# ownerReferences on this ConfigMap or the coredns Deployment (confirmed
# live 2026-08-20), so it's safe to take over here.
#
# No pod restart needed after a sync - the Corefile's own `reload` plugin
# (already present below) watches the mounted file and hot-reloads within
# ~30-60s of the ConfigMap volume actually updating on disk (kubelet
# propagates ConfigMap changes to mounted volumes automatically, typically
# within ~60-90s).
apiVersion: v1
kind: ConfigMap
metadata:
  name: coredns
  namespace: kube-system
data:
  Corefile: |
    .:53 {
        errors
        health {
            lameduck 5s
        }
        ready
        log . {
            class error
        }
        prometheus :9153

        # Rewrite auth.kube.huskypup.net to ingress gateway (NOT authentik-server directly)
        # This ensures HTTPS works because the ingress gateway has the wildcard TLS cert.
        # The old rewrite to authentik-server caused TLS failures for OIDC token exchange.
        rewrite name auth.kube.huskypup.net istio-ingressgateway.istio-system.svc.cluster.local

        # Rewrite rancher.kube.huskypup.net to internal Istio ingress gateway
        rewrite name rancher.kube.huskypup.net istio-ingressgateway.istio-system.svc.cluster.local

        # Rewrite netbird.kube.huskypup.net to internal Istio ingress gateway
        rewrite name netbird.kube.huskypup.net istio-ingressgateway.istio-system.svc.cluster.local

        # Multi-site active failover pilot (see
        # /home/scooby/.claude/plans/jiggly-snacking-iverson.md): home's
        # own pods resolving the floating pg-authentik.ha.huskypup.net
        # record always go straight to a local service instead of
        # round-tripping out through the UniFi WAN port-forward and back
        # in - this UniFi doesn't support NAT hairpin/loopback for its
        # own forwarded ports (confirmed live 2026-08-20: DNS resolved
        # fine, TCP connect failed). Points at ha-authentik-postgres, NOT
        # CNPG's own pg-authentik-rw directly - rewrite only changes the
        # resolved name, not the port a client then connects to, and the
        # app tier is configured for port 61432 (matching the external
        # floating hostname) - pg-authentik-rw only listens on 5432,
        # ha-authentik-postgres additionally listens on 61432 (see
        # infrastructure/authentik/manifests/ha-postgres-nodeport.yaml)
        # specifically so this rewrite target actually has that port.
        rewrite name pg-authentik.ha.huskypup.net ha-authentik-postgres.authentik.svc.cluster.local

        kubernetes cluster.local in-addr.arpa ip6.arpa {
            pods insecure
            fallthrough in-addr.arpa ip6.arpa
            ttl 30
        }
        forward . 1.1.1.1 8.8.8.8 {
           max_concurrent 1000
        }
        cache 30 {
           disable success cluster.local
           disable denial cluster.local
        }
        loop
        reload
        loadbalance
    }