panxiao81
88a02ababa
Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
55 lines
2.5 KiB
YAML
55 lines
2.5 KiB
YAML
# Cert for the PUBLIC Authelia hostname, so it can also be served on the LAN.
|
|
#
|
|
# WHY this exists at all, when ../envoy-gateway/gateway.yaml says adding a service
|
|
# needs no cert work: that promise holds only for `*.ad.ddupan.top`. Authelia is
|
|
# reached at `auth.ddupan.top` — a different zone (Cloudflare is authoritative for
|
|
# ddupan.top; the DC is authoritative only for ad.ddupan.top) and one label
|
|
# shallower, so the wildcard cannot cover it.
|
|
#
|
|
# WHY serve a public name internally (split-horizon) rather than introduce an
|
|
# internal alias: the OIDC issuer, every registered redirect_uri, and the session
|
|
# cookie domain are all `auth.ddupan.top`. Changing the name Gitea talks to would
|
|
# mean re-registering every client. Resolving the SAME name to the LAN changes
|
|
# nothing Authelia knows about itself.
|
|
#
|
|
# WHAT BROKE WITHOUT IT (2026-07-28): auth.ddupan.top resolves to Cloudflare proxy
|
|
# IPs (104.21.6.55 / 172.67.154.245). TCP/443 to both fails from this network,
|
|
# persistently, while other Cloudflare IPs (104.16.132.229) connect fine. Gitea's
|
|
# chart runs `gitea admin auth update-oauth` in an INIT container, which fetches
|
|
# the discovery URL on every pod start — so Gitea CrashLoopBackOff'd on any
|
|
# restart, and server-side token exchange timed out. Routing the name to the LAN
|
|
# removes the public internet from an entirely in-cluster conversation. See
|
|
# CLAUDE.md: "Internal name resolution must never depend on the WAN."
|
|
#
|
|
# CT-log note: ../cert-manager/certificate-wildcard-ad.yaml deliberately uses a
|
|
# wildcard to keep internal hostnames out of Certificate Transparency logs. That
|
|
# reasoning does not apply here — auth.ddupan.top is already public in CT via the
|
|
# Cloudflare-facing cert, so naming it costs nothing.
|
|
#
|
|
# Lives in envoy-gateway-system because a Gateway listener may only reference a
|
|
# Secret in the Gateway's own namespace.
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: auth-ddupan-top
|
|
namespace: envoy-gateway-system
|
|
spec:
|
|
secretName: auth-ddupan-top-tls
|
|
issuerRef:
|
|
name: letsencrypt
|
|
kind: ClusterIssuer
|
|
group: cert-manager.io
|
|
commonName: "auth.ddupan.top"
|
|
dnsNames:
|
|
- "auth.ddupan.top"
|
|
# DNS-01 via Cloudflare (the letsencrypt ClusterIssuer's solver). Cloudflare stays
|
|
# authoritative for ddupan.top, so the challenge resolves publicly even though the
|
|
# A record we serve internally points at the LAN.
|
|
duration: 2160h # 90d — Let's Encrypt maximum
|
|
renewBefore: 720h # 30d
|
|
privateKey:
|
|
algorithm: ECDSA
|
|
size: 256
|
|
rotationPolicy: Always
|