cleanup(ingress): drop legacy Caddy/cloudflared/netbird-gateway tiers #70

2026-06-27T09:22:42Z

k.renner commented

2026-06-27 09:22:42 +00:00

Simplify ingress: remove superseded legacy tiers

Now that the netbird-ingress DaemonSet, the netbird reverse-proxy, and Traefik carry all ingress, the old tiers they replaced — stopped (not deleted) since the 2026-05-09 PVE cutover — are dead code. This removes them.

Supersession map

New (live)	Removed (was stopped)
`netbird-ingress` DaemonSet	`netbird-gateway` LXC 260 + role + play
netbird reverse-proxy (VPS)	`cloudflared` LXC 117 + role + play + disabled cloudflare tofu stubs
Traefik	Caddy HA LXCs 232/233/234 + `caddy-ha` role + crowdsec-caddy play + build/deploy-caddy CI + ci-caddy-builder image

Also cleaned

opentofu/backup_jobs.tf: dropped VMIDs 117/232/233/234/260 from the nightly vzdump include list (those LXCs are being destroyed).
netbird-server role: setup-key hint now points at netbird-ingress / netbird-proxy instead of the removed netbird-gateway role.

Kept deliberately

crowdsec role — generic and reusable; it's the basis for the still-open Traefik CrowdSec-bouncer work, so it is not dead code.
netbird-client role + play — the live loki (226) and prometheus (227) LXCs are tagged netbird_client, so this remains part of the active mesh architecture.

⚠️ Reviewer note — this plans a DESTROY

Applying the OpenTofu change will schedule a destroy of the stopped LXCs 117, 232, 233, 234, 260. They're powered off but still exist on disk in PVE, so this is irreversible. Review the tofu plan and confirm those are the only destroys before apply.

Out of scope

The CrowdSec LAPI currently enforces nothing (Traefik bouncer plugin never installed). That's a gap to close, not dead code to delete — left for a separate change.

🤖 Generated with Claude Code

## Simplify ingress: remove superseded legacy tiers Now that the **netbird-ingress DaemonSet**, the **netbird reverse-proxy**, and **Traefik** carry all ingress, the old tiers they replaced — stopped (not deleted) since the 2026-05-09 PVE cutover — are dead code. This removes them. ### Supersession map | New (live) | Removed (was stopped) | |---|---| | `netbird-ingress` DaemonSet | `netbird-gateway` LXC 260 + role + play | | netbird reverse-proxy (VPS) | `cloudflared` LXC 117 + role + play + disabled cloudflare tofu stubs | | Traefik | Caddy HA LXCs 232/233/234 + `caddy-ha` role + crowdsec-caddy play + build/deploy-caddy CI + ci-caddy-builder image | ### Also cleaned - `opentofu/backup_jobs.tf`: dropped VMIDs **117/232/233/234/260** from the nightly vzdump include list (those LXCs are being destroyed). - `netbird-server` role: setup-key hint now points at `netbird-ingress` / `netbird-proxy` instead of the removed `netbird-gateway` role. ### Kept deliberately - **`crowdsec` role** — generic and reusable; it's the basis for the still-open Traefik CrowdSec-bouncer work, so it is *not* dead code. - **`netbird-client` role + play** — the live `loki` (226) and `prometheus` (227) LXCs are tagged `netbird_client`, so this remains part of the active mesh architecture. ### ⚠️ Reviewer note — this plans a DESTROY Applying the OpenTofu change will schedule a **destroy** of the stopped LXCs **117, 232, 233, 234, 260**. They're powered off but still exist on disk in PVE, so this is irreversible. **Review the `tofu plan` and confirm those are the only destroys before apply.** ### Out of scope The CrowdSec LAPI currently enforces nothing (Traefik bouncer plugin never installed). That's a gap to close, not dead code to delete — left for a separate change. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

k.renner force-pushed simplify-ingress-drop-legacy from 34d824aca4 to 1fb7bfacc6

2026-06-27 09:42:33 +00:00

Compare

k.renner merged commit 874ee1f41a into master

2026-06-27 09:44:22 +00:00

k.renner referenced this issue from a commit

2026-06-27 09:44:24 +00:00

Merge pull request 'cleanup(ingress): drop legacy Caddy/cloudflared/netbird-gateway tiers' (#70) from simplify-ingress-drop-legacy into master

k.renner referenced this issue from a commit

2026-06-27 09:59:52 +00:00

cleanup(ansible): remove dead Caddy plays + Grafana dashboard

k.renner referenced this pull request