atlas-botandClaude Opus 5.5
e579a8f6d3
The three Matrix Ingresses had no dns.renner.uno/public label, so netbird-service-sync never created a NetBird proxy service for them and the public proxy rejects their SNI (tlsv1 alert internal error). Label them like audiobooks/immich and add Gatus checks for the three hosts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
162 lines
4.6 KiB
YAML
162 lines
4.6 KiB
YAML
# Public (REN-663): each Ingress carries dns.renner.uno/public, so
|
|
# netbird-service-sync publishes its host through the NetBird proxy
|
|
# (Cloudflare wildcard -> proxy.renner.uno -> TLS passthrough to Traefik) and
|
|
# external-dns-unifi skips it; LAN clients follow the public answer and the UDM
|
|
# hairpins back in. Same path as audiobooks/immich. Federation stays off.
|
|
#
|
|
# Synapse: only the client-facing paths. /_synapse/admin stays off the
|
|
# Ingress (in-cluster only); /_matrix/federation and /_matrix/key are not
|
|
# served by the listener anyway.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: synapse
|
|
namespace: matrix
|
|
labels:
|
|
# Registered publicly (Cloudflare wildcard -> NetBird proxy); the UDM
|
|
# external-dns instance skips it, LAN reaches it via the hairpin NAT.
|
|
dns.renner.uno/public: "true"
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-cluster
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- matrix.renner.uno
|
|
secretName: matrix-tls
|
|
rules:
|
|
- host: matrix.renner.uno
|
|
http:
|
|
paths:
|
|
# Legacy login/logout/refresh go to MAS (its compat layer). Longer
|
|
# paths win in Traefik, so these override /_matrix/client below.
|
|
- path: /_matrix/client/v3/login
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: mas
|
|
port:
|
|
number: 8080
|
|
- path: /_matrix/client/v3/logout
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: mas
|
|
port:
|
|
number: 8080
|
|
- path: /_matrix/client/v3/refresh
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: mas
|
|
port:
|
|
number: 8080
|
|
- path: /_matrix/client/r0/login
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: mas
|
|
port:
|
|
number: 8080
|
|
- path: /_matrix/client/r0/logout
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: mas
|
|
port:
|
|
number: 8080
|
|
- path: /_matrix/client/r0/refresh
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: mas
|
|
port:
|
|
number: 8080
|
|
- path: /_matrix/client
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: synapse
|
|
port:
|
|
number: 8008
|
|
- path: /_matrix/media
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: synapse
|
|
port:
|
|
number: 8008
|
|
- path: /_synapse/client
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: synapse
|
|
port:
|
|
number: 8008
|
|
- path: /.well-known/matrix/client
|
|
pathType: Exact
|
|
backend:
|
|
service:
|
|
name: synapse
|
|
port:
|
|
number: 8008
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: element-web
|
|
namespace: matrix
|
|
labels:
|
|
# Registered publicly (Cloudflare wildcard -> NetBird proxy); the UDM
|
|
# external-dns instance skips it, LAN reaches it via the hairpin NAT.
|
|
dns.renner.uno/public: "true"
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-cluster
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- element.renner.uno
|
|
secretName: element-tls
|
|
rules:
|
|
- host: element.renner.uno
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: element-web
|
|
port:
|
|
number: 80
|
|
---
|
|
# MAS: login pages, OAuth endpoints and account management.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: mas
|
|
namespace: matrix
|
|
labels:
|
|
# Registered publicly (Cloudflare wildcard -> NetBird proxy); the UDM
|
|
# external-dns instance skips it, LAN reaches it via the hairpin NAT.
|
|
dns.renner.uno/public: "true"
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-cluster
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- account.matrix.renner.uno
|
|
secretName: mas-tls
|
|
rules:
|
|
- host: account.matrix.renner.uno
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: mas
|
|
port:
|
|
number: 8080
|