From da47c35fb22afebf15492b6e682c41f7a923051e Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Fri, 26 Jun 2026 11:58:17 +0200 Subject: [PATCH] music-assistant: move public edge off Cloudflare tunnel to NetBird proxy Drop the external-dns/cloudflare label from the music-assistant Ingress and remove the music.renner.uno cloudflared route, moving the public edge to the NetBird reverse proxy. Music Assistant keeps its HA-delegated login (no proxy auth added). LAN/mesh via music.k.renner.uno -> Traefik is unaffected. MERGE ONLY AFTER the music proxy service + DNS are live, then roll cloudflared, or music.renner.uno goes dark in the gap. Co-Authored-By: Claude Opus 4.8 (1M context) --- kubernetes/apps/music-assistant/ingress.yaml | 7 ------- kubernetes/infrastructure/cloudflared/configmap.yaml | 5 ----- 2 files changed, 12 deletions(-) diff --git a/kubernetes/apps/music-assistant/ingress.yaml b/kubernetes/apps/music-assistant/ingress.yaml index 8d52c64b..0e077c75 100644 --- a/kubernetes/apps/music-assistant/ingress.yaml +++ b/kubernetes/apps/music-assistant/ingress.yaml @@ -3,13 +3,6 @@ kind: Ingress metadata: name: music-assistant namespace: music-assistant - labels: - # Publishes the hostnames into Cloudflare via the cluster's - # cloudflare-scoped external-dns instance (kubernetes/apps/ - # external-dns/helmrelease.yaml selects on this label). external- - # dns creates CNAMEs to the cargo tunnel; cloudflared forwards - # inbound to traefik. - external-dns/cloudflare: "true" annotations: cert-manager.io/cluster-issuer: letsencrypt-cluster spec: diff --git a/kubernetes/infrastructure/cloudflared/configmap.yaml b/kubernetes/infrastructure/cloudflared/configmap.yaml index bb34ba77..d3b24e4e 100644 --- a/kubernetes/infrastructure/cloudflared/configmap.yaml +++ b/kubernetes/infrastructure/cloudflared/configmap.yaml @@ -21,10 +21,5 @@ data: originRequest: noTLSVerify: true - - hostname: music.renner.uno - service: https://traefik.ingress.svc.cluster.local:443 - originRequest: - noTLSVerify: true - # Catch-all - service: http_status:404 -- 2.54.0