coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prefer temporal.coulomb.social; fix Ingress ACME entrypoints
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Document AAAA parking pitfall for activity.coulomb.social. Use web+websecure
entrypoints and Authelia middleware on SSO Ingress manifests.
This commit is contained in:
tegwick 2026-07-22 01:29:23 +02:00
parent 54431db583
commit 3bd005acc9
3 changed files with 17 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/ops-sso-access.md
View file

@ -62,12 +62,17 @@ Priority for ops mutations (`POST /ops/...`):
Create A records (or CNAME to the forgejo host pattern): Create A records (or CNAME to the forgejo host pattern):
```text ```text
activity.coulomb.social A 92.205.62.239 activity.coulomb.social A 92.205.62.239
temporal.coulomb.social A 92.205.62.239 temporal.coulomb.social A 92.205.62.239
``` ```
Until DNS exists, cert-manager Certificate will stay Pending and HTTPS will not **Important:** do **not** leave a stale **AAAA** (IPv6) record for
serve. Manifests can still be applied. `activity.coulomb.social` pointing at parking (e.g. IONOS
`2001:8d8:100f:f000::200` / `217.160.0.253`). Cluster resolvers prefer AAAA;
cert-manager HTTP-01 self-check then hits the wrong host and returns 204.
Either remove AAAA or set it to the railiance01 public IPv6.
Until DNS is correct, cert-manager Certificate may stay Pending.
## Break-glass ## Break-glass

9
k8s/railiance/31-ingress-ops-sso.yaml
View file

@ -1,5 +1,7 @@
# HTTPS SSO front door for activity-core ops console + API. # HTTPS SSO front door for activity-core ops console + API.
# Requires DNS: activity.coulomb.social A → 92.205.62.239 # Requires DNS:
# activity.coulomb.social A → 92.205.62.239
# (no stale AAAA / parking records — IPv6 must not point at IONOS parking)
# ACTIVITY-WP-0025 # ACTIVITY-WP-0025
apiVersion: networking.k8s.io/v1 apiVersion: networking.k8s.io/v1
kind: Ingress kind: Ingress
@ -12,9 +14,12 @@ metadata:
app.kubernetes.io/component: sso-ingress app.kubernetes.io/component: sso-ingress
annotations: annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod cert-manager.io/cluster-issuer: letsencrypt-prod
traefik.ingress.kubernetes.io/router.entrypoints: websecure # HTTP-01 ACME needs web (80); browsers use websecure (443)
traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
traefik.ingress.kubernetes.io/router.tls: "true" traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/router.middlewares: activity-core-authelia-forwardauth@kubernetescrd traefik.ingress.kubernetes.io/router.middlewares: activity-core-authelia-forwardauth@kubernetescrd
# Prefer ACME solver path over this catch-all when both match
traefik.ingress.kubernetes.io/router.priority: "1"
spec: spec:
ingressClassName: traefik ingressClassName: traefik
tls: tls:

3
k8s/railiance/32-ingress-temporal-sso.yaml
View file

@ -12,9 +12,10 @@ metadata:
app.kubernetes.io/component: sso-ingress app.kubernetes.io/component: sso-ingress
annotations: annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod cert-manager.io/cluster-issuer: letsencrypt-prod
traefik.ingress.kubernetes.io/router.entrypoints: websecure traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
traefik.ingress.kubernetes.io/router.tls: "true" traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/router.middlewares: activity-core-authelia-forwardauth@kubernetescrd traefik.ingress.kubernetes.io/router.middlewares: activity-core-authelia-forwardauth@kubernetescrd
traefik.ingress.kubernetes.io/router.priority: "1"
spec: spec:
ingressClassName: traefik ingressClassName: traefik
tls: tls: