mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby Husky
5bc1be2f00
The DNS-flip watcher (scripts/vps-dns-failover/) was designed but never actually installed on the VPS despite being tracked as done - real gap, found when asked whether the standby services are actually reachable. New design: instead of dynamically flipping *.kube.huskypup.net between home and VPS IPs, give the VPS site its own permanent, always-resolving subdomain - vault/gitea/auth/n8n/nextcloud.vps.huskypup.net, each with real Ingress+TLS on the VPS's own Traefik+cert-manager (both already installed by Phase 0 bootstrap, just never wired up). No token-scoping decision needed since there's no dynamic flipping - reuses the same cert-manager token pattern as home. Also scales Authentik/n8n/Nextcloud from 0 to 1 replica on the VPS so the replicated data is actually browsable at all times, not just present-but-unreachable. Their CNPG clusters are still read-only replicas (spec.replica.enabled: true) - writes will error until a deliberate manual promotion, but reads/browsing work now. Vault and Gitea were already running continuously.
29 lines
1.1 KiB
YAML
29 lines
1.1 KiB
YAML
---
|
|
# cert-manager itself is installed directly by scripts/vps-bootstrap.sh
|
|
# (Phase 0, out-of-band like k3s/Netbird) - not GitOps-managed here. This
|
|
# ClusterIssuer just rides the same GitOps pipeline as everything else in
|
|
# vps-standby, DNS-01 via Cloudflare (same pattern as home's
|
|
# infrastructure/cert-manager/manifests/letsencrypt-issuer.yaml).
|
|
#
|
|
# cloudflare-token-secret is a plain Secret copied here manually
|
|
# (kubectl, not git - same reasoning as every other VPS secret):
|
|
# kubectl -n cert-manager create secret generic cloudflare-token-secret \
|
|
# --from-literal=cloudflare-token=<same token as home's cert-manager>
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: letsencrypt-production
|
|
spec:
|
|
acme:
|
|
server: https://acme-v02.api.letsencrypt.org/directory
|
|
email: garrettstone499@gmail.com
|
|
privateKeySecretRef:
|
|
name: letsencrypt-production
|
|
solvers:
|
|
- dns01:
|
|
cloudflare:
|
|
email: garrettstone499@gmail.com
|
|
apiTokenSecretRef:
|
|
name: cloudflare-token-secret
|
|
key: cloudflare-token
|