Scott KarpandClaude Fable 5.1
e17436c4ca
Three NLBs became one (185.19.28.170, ingress-nginx). Shorashim: `shorashim-external` (NLB 185.19.29.180, NodePort 30923) is replaced by an Ingress — a host-less catch-all (works by IP, no DNS) plus a `shorashim.ch` rule ready for the A record; TLS deliberately not requested until the name resolves. Sanhedrin-length proxy timeouts. The watch behind the ingress (completes tablet 46): the TCP peer is now the ingress controller, so Mishmar.peer/1 takes the caller from X-Real-IP — only when the peer is inside TRUSTED_PROXIES (the pod network, configmap); from anyone else the header is the caller's own claim and is ignored. The ingress Service was already externalTrafficPolicy: Local with its health-check port open, so the caller's address arrives without the security-group change the direct route needed. Verified live: the 11th knock is 429, a forged X-Real-IP is still 429, and in the same minute the old route (pod sees the node) was a different subject. Gitea: no name of its resolves, so it rides the controller's TCP passthrough on the same NLB — :3000 → gitea:80, :22 → gitea:22 (ingress-tcp-services.yaml), on the two NodePorts the security group already allowed. gitea-mcp now reaches Gitea over the cluster network instead of out through an NLB and back. Tamid §1.1 note, KOHEN.md, AGENTS.md. Doorpost e4e3d56d… → a2ec3842…. Elixir 539/0 (L3 on and off). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
39 lines
1.9 KiB
YAML
39 lines
1.9 KiB
YAML
# Gitea behind the shared ingress — TCP passthrough
|
|
#
|
|
# One NLB for the cluster (185.19.28.170, the ingress-nginx Service)
|
|
# instead of one per Service. Shorashim is an HTTP Ingress
|
|
# (service.yaml). Gitea has no hostname that resolves
|
|
# (gitea.temple-council.ch is configured in Gitea and exists nowhere),
|
|
# and host-based routing needs a name — so Gitea rides the ingress
|
|
# controller's TCP passthrough on two ports of the same NLB:
|
|
#
|
|
# 185.19.28.170:3000 → temple-council/gitea:80 (HTTP — git, web UI)
|
|
# 185.19.28.170:22 → temple-council/gitea:22 (SSH)
|
|
#
|
|
# Three live objects carry this; only the first is a whole manifest:
|
|
#
|
|
# 1. This ConfigMap.
|
|
# 2. The controller reads it — one argument on the Deployment:
|
|
# kubectl -n ingress-nginx patch deploy ingress-nginx-controller --type=json -p \
|
|
# '[{"op":"add","path":"/spec/template/spec/containers/0/args/-",
|
|
# "value":"--tcp-services-configmap=$(POD_NAMESPACE)/tcp-services"}]'
|
|
# 3. The controller's Service exposes the two ports ON THE NODEPORTS THE
|
|
# SECURITY GROUP ALREADY ALLOWS (they were Gitea's own; the CCM never
|
|
# opens a NodePort — tablets 29, 46):
|
|
# kubectl -n ingress-nginx patch svc ingress-nginx-controller --type=json -p \
|
|
# '[{"op":"add","path":"/spec/ports/-","value":{"name":"gitea-http","port":3000,"targetPort":3000,"protocol":"TCP","nodePort":30575}},
|
|
# {"op":"add","path":"/spec/ports/-","value":{"name":"gitea-ssh","port":22,"targetPort":22,"protocol":"TCP","nodePort":31345}}]'
|
|
# and temple-council/gitea is type ClusterIP (it held 30575/31345 as a
|
|
# LoadBalancer until 2026-10-06).
|
|
#
|
|
# When Gitea has a real name: add an HTTP Ingress for it (TLS via
|
|
# cert-manager) and drop the 3000 line here; SSH stays.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: tcp-services
|
|
namespace: ingress-nginx
|
|
data:
|
|
"3000": "temple-council/gitea:80"
|
|
"22": "temple-council/gitea:22"
|