coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prefer temporal.coulomb.social; fix Ingress ACME entrypoints
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Document AAAA parking pitfall for activity.coulomb.social. Use web+websecure
entrypoints and Authelia middleware on SSO Ingress manifests.
This commit is contained in:
tegwick 2026-07-22 01:29:23 +02:00
parent 54431db583
commit 3bd005acc9
3 changed files with 17 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

9
k8s/railiance/31-ingress-ops-sso.yaml
View file

@ -1,5 +1,7 @@
# HTTPS SSO front door for activity-core ops console + API.
# Requires DNS: activity.coulomb.social A → 92.205.62.239
# Requires DNS:
# activity.coulomb.social A → 92.205.62.239
# (no stale AAAA / parking records — IPv6 must not point at IONOS parking)
# ACTIVITY-WP-0025
apiVersion: networking.k8s.io/v1
kind: Ingress
@ -12,9 +14,12 @@ metadata:
app.kubernetes.io/component: sso-ingress
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
traefik.ingress.kubernetes.io/router.entrypoints: websecure
# HTTP-01 ACME needs web (80); browsers use websecure (443)
traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/router.middlewares: activity-core-authelia-forwardauth@kubernetescrd
# Prefer ACME solver path over this catch-all when both match
traefik.ingress.kubernetes.io/router.priority: "1"
spec:
ingressClassName: traefik
tls:

3
k8s/railiance/32-ingress-temporal-sso.yaml
View file

@ -12,9 +12,10 @@ metadata:
app.kubernetes.io/component: sso-ingress
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/router.middlewares: activity-core-authelia-forwardauth@kubernetescrd
traefik.ingress.kubernetes.io/router.priority: "1"
spec:
ingressClassName: traefik
tls: