panxiao81
88a02ababa
Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
24 lines
925 B
YAML
24 lines
925 B
YAML
# Template. Copy to secret.yaml, fill in the real token, and apply.
|
|
# secret.yaml is gitignored — same convention as ../../platform/cert-manager, ../../apps/netbox
|
|
# and ../../apps/smtp-relay.
|
|
#
|
|
# The token IS the tunnel credential: it embeds the account tag, tunnel ID and
|
|
# tunnel secret, so anything holding it can serve traffic for the tunnel. It is
|
|
# also all cloudflared needs — the ingress rules come from the Cloudflare API,
|
|
# managed by ./terraform.
|
|
#
|
|
# Where to get it:
|
|
# Cloudflare dashboard -> Zero Trust -> Networks -> Tunnels -> <tunnel> ->
|
|
# Configure -> the `cloudflared service install <TOKEN>` command contains it.
|
|
# Rotating it there requires re-applying this Secret and restarting the
|
|
# Deployment; the tunnel UUID does not change.
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: cloudflared-tunnel
|
|
namespace: cloudflared
|
|
type: Opaque
|
|
stringData:
|
|
token: REPLACE_WITH_CLOUDFLARE_TUNNEL_TOKEN
|