543394a825
- values.yaml: internal ingress only (communicore.local.mk-labs.cloud) CN=communicore.local.mk-labs.cloud, secret=couchdb-tls - ingress-public.yaml: external ingress (communicore.mk-labs.cloud) CN=communicore.mk-labs.cloud, secret=couchdb-tls-public ExternalDNS opt-in annotations for Cloudflare -> ingress.mk-labs.cloud Obsidian Sync connects externally via communicore.mk-labs.cloud; JARVIS traffic stays internal on communicore.local.mk-labs.cloud.
35 lines
1.3 KiB
YAML
35 lines
1.3 KiB
YAML
# ------------------------------------------------------------------------------
|
|
# FILE: cluster/applications/couchdb/ingress-public.yaml
|
|
# DESCRIPTION: External ingress for CouchDB — communicore.mk-labs.cloud only.
|
|
# Separate from the Helm-managed internal ingress so each cert
|
|
# has the correct CN for its hostname. CN validation in Obsidian
|
|
# Sync requires CN=communicore.mk-labs.cloud on the public cert.
|
|
# ------------------------------------------------------------------------------
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: couchdb-public
|
|
namespace: couchdb
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
|
external-dns.alpha.kubernetes.io/hostname: "communicore.mk-labs.cloud"
|
|
external-dns.alpha.kubernetes.io/target: "ingress.mk-labs.cloud"
|
|
external-dns.alpha.kubernetes.io/public: "true"
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: communicore.mk-labs.cloud
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: couchdb-svc-couchdb
|
|
port:
|
|
number: 5984
|
|
tls:
|
|
- secretName: couchdb-tls-public
|
|
hosts:
|
|
- communicore.mk-labs.cloud
|