chore(dns): drop the stale UDM records pointing at the retired Hetzner VM

renner.uno and www.renner.uno were pinned to 159.69.42.237, the VM that hosted WordPress before it moved into the cluster. Neither record is live on the UDM any more (verified: a LAN query for www.renner.uno returns the public answer, proxy.renner.uno), so the file was drift waiting to be re-applied — a tofu apply would have pointed the house at a host that is being decommissioned, while the rest of the world already reaches the cluster. Their absence is the correct end state, not an omission: www.renner.uno carries dns.renner.uno/public, so external-dns-unifi writes no UDM record by design and LAN clients take the public path and hairpin back in. The apex stays with Cloudflare, which now redirects renner.uno/* to www. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014giKN9N6e5J2DF8QZmVh98
Merge pull request 'chore(ci): bump all ci-k8s pipeline pins to 2026-08-10' (#496 ) from bump-ci-k8s-pins into master
2026-08-16 22:43:42 +02:00 · 2026-08-16 20:34:16 +00:00 · 2026-08-16 20:24:09 +00:00 · 2026-08-16 22:21:57 +02:00
6 changed files with 21 additions and 9 deletions
@@ -42,7 +42,7 @@ when:

 steps:
  - name: fetch-alerts
-    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-05-01
+    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-08-10
    environment:
      SOPS_AGE_KEY:
        from_secret: sops_age_key
@@ -60,7 +60,7 @@ steps:
  # run that never touched them. Tracked in #461.
  - name: kustomize-build
    depends_on: [] # see note above `steps:`
-    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-07-30
+    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-08-10
    commands:
      - |
        set -eu
@@ -240,7 +240,7 @@ steps:
  # this step fails permanently on its own documentation.
  - name: no-digest-pins
    depends_on: [] # see note above `steps:`
-    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-07-30
+    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-08-10
    commands:
      - |
        set -eu
@@ -4,7 +4,7 @@ when:

 steps:
  - name: e2e
-    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-05-01
+    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-08-10
    environment:
      SOPS_AGE_KEY:
        from_secret: sops_age_key
@@ -30,7 +30,7 @@ steps:
      - sh scripts/ci/test-model-selection.sh

  - name: e2e-test
-    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-05-01
+    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-08-10
    environment:
      SOPS_AGE_KEY:
        from_secret: sops_age_key
@@ -49,7 +49,7 @@ steps:
    # (the issue-pick logic needs jq, which only the ci-claude image has);
    # minting a 1h read-only token per run is cheap. Degrades to
    # snapshot-only if the ci-diagnostics ServiceAccount isn't reconciled.
-    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-05-01
+    image: gitea.renner.uno/gitea_admin/ci-k8s:2026-08-10
    environment:
      SOPS_AGE_KEY:
        from_secret: sops_age_key
@@ -1,8 +1,20 @@
 locals {
  renner_uno_records = {
-    # A Records
-    "@"   = { type = "A", value = "159.69.42.237" }
-    "www" = { type = "A", value = "159.69.42.237" }
+    # No "@" / "www" entries. Both used to pin renner.uno and www.renner.uno
+    # to 159.69.42.237, the Hetzner VM that hosted the WordPress site until it
+    # moved into the cluster (kubernetes/apps/wordpress). Neither record is
+    # actually live on the UDM any more — verified 2026-08-16: a LAN query for
+    # www.renner.uno returns the public answer (proxy.renner.uno) — so this
+    # block was drift waiting to be re-applied.
+    #
+    # The correct end state is exactly this absence: www.renner.uno is labelled
+    # dns.renner.uno/public, so external-dns-unifi deliberately writes no UDM
+    # record and LAN clients follow the public path (wildcard -> proxy) and
+    # hairpin back in. Re-adding an A record here would point the house at a
+    # server that is being decommissioned.
+    #
+    # The apex stays with Cloudflare, where a redirect rule sends
+    # renner.uno/* to https://www.renner.uno/*.

    # CNAME Records (External Targets)
    "nut" = { type = "CNAME", value = "nut.srv.renner.uno" }
Author	SHA1	Message	Date
claude-botandClaude Opus 5	0211269b91	chore(dns): drop the stale UDM records pointing at the retired Hetzner VM ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details renner.uno and www.renner.uno were pinned to 159.69.42.237, the VM that hosted WordPress before it moved into the cluster. Neither record is live on the UDM any more (verified: a LAN query for www.renner.uno returns the public answer, proxy.renner.uno), so the file was drift waiting to be re-applied — a tofu apply would have pointed the house at a host that is being decommissioned, while the rest of the world already reaches the cluster. Their absence is the correct end state, not an omission: www.renner.uno carries dns.renner.uno/public, so external-dns-unifi writes no UDM record by design and LAN clients take the public path and hairpin back in. The apex stays with Cloudflare, which now redirects renner.uno/* to www. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014giKN9N6e5J2DF8QZmVh98	2026-08-16 22:43:42 +02:00
k.renner	fe75b912f5	Merge pull request 'chore(ci): bump all ci-k8s pipeline pins to 2026-08-10' (#496 ) from bump-ci-k8s-pins into master ci/woodpecker/cron/issue-fix Pipeline was successful Details ci/woodpecker/cron/alert-monitor Pipeline was successful Details Reviewed-on: k.renner/homelab#496	2026-08-16 20:34:16 +00:00
k.renner	d9b4c47cf2	Merge pull request 'fix(wordpress): route the outpost OAuth path so the gate is a gate, not a dead end' (#494 ) from fix-outpost-callback-path into master ci/woodpecker/cron/alert-monitor Pipeline was successful Details Reviewed-on: k.renner/homelab#494	2026-08-16 20:24:09 +00:00
claude-bot	632e092363	chore(ci): bump all ci-k8s pipeline pins to 2026-08-10 ci/woodpecker/manual/e2e-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details Closes #461. Five pipeline steps pinned ci-k8s at two stale tags: e2e-test.yml, e2e.yml, alert-monitor.yml and issue-fix.yml at 2026-05-01, and ci-manifests-test.yml at 2026-07-30. 2026-08-10 is the newest dated tag in gitea_admin/ci-k8s and shares a digest with :latest (sha256:0019f264...), so all five now run the same image the build pipeline last produced. A stale pin eventually points at a garbage-collected tag, and the split had no deliberate reason behind it. Co-Authored-By: Claude Bot <claude-bot@renner.uno>	2026-08-16 22:21:57 +02:00