mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-20 23:16:49 +00:00
Scooby HuskyandClaude Sonnet 5
ff638250d6
LAPI treated a failed CAPI/console-enroll attempt as fatal at startup, crashing the whole server (and taking agent + bouncer down with it via their LAPI dependency) on every restart. Root cause investigation tonight found two separate real issues: 1. Home's public IP gets a 403 from AWS WAF in front of api.crowdsec.net on any request, unrelated to credentials - ENROLL_KEY is valid and correctly wired but can't get past this. 2. Attempted routing around it via a VPS-side proxy over Netbird; found no node in the cluster has any route into the Netbird mesh CIDR for pod-originated egress traffic - the per-namespace netbird router pods (gitlab, vault, argocd, etc.) are inbound-only infrastructure. A proper fix needs either a Talos-native static route (fragile against pod IP churn) or a deliberate STIG exception for hostNetwork - out of scope for tonight, tracked separately. DISABLE_ONLINE_API=true lets LAPI start cleanly with local-only detection (agent + bouncer functional again). ENROLL_KEY stays set in Vault/values - flip this back once real egress routing exists. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>