From 0413d84134baeadef7986d43547f62f563fbc6a5 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Fri, 26 Jun 2026 10:17:36 +0200 Subject: [PATCH] audiobookshelf: drop external-dns/cloudflare label Stop publishing audiobooks.renner.uno through the Cloudflare tunnel so the public name can be repointed at the NetBird reverse proxy (which is exposing it with Authentik SSO at the edge). LAN/mesh resolution (UniFi / routing peer -> Traefik) is unaffected. Co-Authored-By: Claude Opus 4.8 (1M context) --- kubernetes/apps/audiobookshelf/ingress.yaml | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/kubernetes/apps/audiobookshelf/ingress.yaml b/kubernetes/apps/audiobookshelf/ingress.yaml index 25b5c589..d87d0458 100644 --- a/kubernetes/apps/audiobookshelf/ingress.yaml +++ b/kubernetes/apps/audiobookshelf/ingress.yaml @@ -3,20 +3,6 @@ kind: Ingress metadata: name: audiobookshelf namespace: audiobookshelf - labels: - # Publish through Cloudflare via the cluster's cargo tunnel. The - # cloudflare-scoped external-dns instance filters on this label - # and creates CNAMEs to the tunnel; cloudflared then needs a matching - # host entry in its configmap (see kubernetes/infrastructure/ - # cloudflared/configmap.yaml). Both hostnames share the label, - # but only audiobooks.renner.uno is mapped in cloudflared — the - # .k.renner.uno LAN alias stays tunnel-404 (mirrors the immich / - # paperless approach). - # NOTE: Cloudflare's default body cap on free/pro plans is 100 MiB, - # so external uploads of single audio files above that size will - # fail at the edge even though ingress-nginx allows up to 500m. - # LAN clients bypass this entirely via audiobooks.k.renner.uno. - external-dns/cloudflare: "true" annotations: cert-manager.io/cluster-issuer: letsencrypt-cluster spec: -- 2.54.0