From 60b6b4d4712ba65f2806c8484ddb7c1c6325ff9c Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Fri, 26 Jun 2026 11:49:24 +0200 Subject: [PATCH] immich: move public edge off Cloudflare tunnel to the NetBird proxy Drop the external-dns/cloudflare label from the immich Ingress and remove the immich.renner.uno cloudflared tunnel route, moving the public edge to the NetBird reverse proxy. immich keeps its own login (no proxy auth added). The .k.renner.uno LAN alias and legacy photos.renner.uno were already tunnel-404 via the shared label; LAN/mesh -> Traefik is unaffected. MERGE ONLY AFTER the immich proxy service + DNS are live, then roll cloudflared, or immich.renner.uno goes dark in the gap. Co-Authored-By: Claude Opus 4.8 (1M context) --- kubernetes/apps/immich/ingress.yaml | 14 -------------- .../infrastructure/cloudflared/configmap.yaml | 5 ----- 2 files changed, 19 deletions(-) diff --git a/kubernetes/apps/immich/ingress.yaml b/kubernetes/apps/immich/ingress.yaml index 6208ac21..b9ba90e9 100644 --- a/kubernetes/apps/immich/ingress.yaml +++ b/kubernetes/apps/immich/ingress.yaml @@ -3,20 +3,6 @@ kind: Ingress metadata: name: immich namespace: immich - labels: - # Publish through Cloudflare via the cluster's cargo tunnel. The - # cloudflare-scoped external-dns instance filters on this label - # and creates CNAMEs to the tunnel; cloudflared then needs a matching - # host entry in its configmap (see kubernetes/infrastructure/ - # cloudflared/configmap.yaml). All three hostnames share the label, - # but only immich.renner.uno is mapped in cloudflared — - # the .k.renner.uno LAN alias and the legacy photos.renner.uno stay - # tunnel-404 (mirrors the paperless approach for the .k aliases). - # NOTE: Cloudflare's default body cap on free/pro plans is 100 MiB, - # so external photo/video sync above that size will fail at the edge - # even though Traefik streams without a body cap. LAN clients - # bypass this entirely via immich.k.renner.uno. - external-dns/cloudflare: "true" annotations: cert-manager.io/cluster-issuer: letsencrypt-cluster spec: diff --git a/kubernetes/infrastructure/cloudflared/configmap.yaml b/kubernetes/infrastructure/cloudflared/configmap.yaml index e615f736..9395538c 100644 --- a/kubernetes/infrastructure/cloudflared/configmap.yaml +++ b/kubernetes/infrastructure/cloudflared/configmap.yaml @@ -26,11 +26,6 @@ data: originRequest: noTLSVerify: true - - hostname: immich.renner.uno - service: https://traefik.ingress.svc.cluster.local:443 - originRequest: - noTLSVerify: true - - hostname: music.renner.uno service: https://traefik.ingress.svc.cluster.local:443 originRequest: