mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 11:36:50 +00:00
Scooby Husky
5bc1be2f00
The DNS-flip watcher (scripts/vps-dns-failover/) was designed but never actually installed on the VPS despite being tracked as done - real gap, found when asked whether the standby services are actually reachable. New design: instead of dynamically flipping *.kube.huskypup.net between home and VPS IPs, give the VPS site its own permanent, always-resolving subdomain - vault/gitea/auth/n8n/nextcloud.vps.huskypup.net, each with real Ingress+TLS on the VPS's own Traefik+cert-manager (both already installed by Phase 0 bootstrap, just never wired up). No token-scoping decision needed since there's no dynamic flipping - reuses the same cert-manager token pattern as home. Also scales Authentik/n8n/Nextcloud from 0 to 1 replica on the VPS so the replicated data is actually browsable at all times, not just present-but-unreachable. Their CNPG clusters are still read-only replicas (spec.replica.enabled: true) - writes will error until a deliberate manual promotion, but reads/browsing work now. Vault and Gitea were already running continuously.
35 lines
1.1 KiB
YAML
35 lines
1.1 KiB
YAML
---
|
|
# See infrastructure/vps-standby/vault/manifests/ingress.yaml for the
|
|
# vps.huskypup.net subdomain design rationale.
|
|
#
|
|
# CAVEAT: Authentik's provider/application configs (redirect_uris, etc.)
|
|
# are replicated byte-for-byte from home and point at *.kube.huskypup.net
|
|
# - SSO logins between VPS-hosted apps and this VPS Authentik instance
|
|
# won't complete correctly (redirect mismatch) until that's addressed
|
|
# separately. Direct/local Authentik admin login still works fine for
|
|
# browsing and verifying replicated data.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: vps-authentik
|
|
namespace: authentik
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-production
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- auth.vps.huskypup.net
|
|
secretName: vps-authentik-tls
|
|
rules:
|
|
- host: auth.vps.huskypup.net
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: vps-authentik-server
|
|
port:
|
|
number: 80
|