From 30a241ab3f614981713acd7b76a397abf64b57a9 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Fri, 26 Jun 2026 11:53:10 +0200 Subject: [PATCH] home-assistant: move public edge off Cloudflare tunnel to NetBird proxy Drop the external-dns/cloudflare label from the HA Ingress and remove the home.renner.uno cloudflared route, moving the public edge to the NetBird reverse proxy. HA keeps its own login (no proxy auth added; the prior Authentik forward-auth attempt stays reverted). LAN/mesh -> Traefik via home.k.renner.uno is unaffected. MERGE ONLY AFTER the home proxy service + DNS are live, then roll cloudflared, or home.renner.uno goes dark in the gap. Co-Authored-By: Claude Opus 4.8 (1M context) --- kubernetes/apps/home-assistant/ingress.yaml | 2 -- kubernetes/infrastructure/cloudflared/configmap.yaml | 5 ----- 2 files changed, 7 deletions(-) diff --git a/kubernetes/apps/home-assistant/ingress.yaml b/kubernetes/apps/home-assistant/ingress.yaml index 7dd6f3ce..d56028bf 100644 --- a/kubernetes/apps/home-assistant/ingress.yaml +++ b/kubernetes/apps/home-assistant/ingress.yaml @@ -3,8 +3,6 @@ kind: Ingress metadata: name: home-assistant namespace: home-assistant - labels: - external-dns/cloudflare: "true" annotations: cert-manager.io/cluster-issuer: letsencrypt-cluster spec: diff --git a/kubernetes/infrastructure/cloudflared/configmap.yaml b/kubernetes/infrastructure/cloudflared/configmap.yaml index 9395538c..bb34ba77 100644 --- a/kubernetes/infrastructure/cloudflared/configmap.yaml +++ b/kubernetes/infrastructure/cloudflared/configmap.yaml @@ -21,11 +21,6 @@ data: originRequest: noTLSVerify: true - - hostname: home.renner.uno - service: https://traefik.ingress.svc.cluster.local:443 - originRequest: - noTLSVerify: true - - hostname: music.renner.uno service: https://traefik.ingress.svc.cluster.local:443 originRequest: -- 2.54.0