homelab

T

k.rennerandClaude Opus 4.7 342a76d93e fix(network-policies): allow any in-cluster source to reach ingress-nginx

The ingress-default-deny CNP enumerated `ingress`, `apps`, `paperless`
as allowed-from namespaces. Any other namespace's pods (e.g.
audiobookshelf) couldn't reach ingress-nginx in-cluster — surfaced
while verifying the k8s_gateway DNS fix: ABS resolved auth.renner.uno
to 10.2.40.80 correctly, but TCP connect timed out because the policy
dropped the packet.

Replace the per-namespace allow list with a `cluster` entity match.
Any pod in the cluster can now reach ingress-nginx; external entry is
still bounded by the existing Cloudflare/MetalLB/host-probe paths.
New app namespaces no longer need a policy edit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-22 16:11:05 +02:00

.vscode

Add Unifi and Cloudflare provider configurations and examples

2026-02-02 21:54:10 +01:00

.woodpecker

feat(caddy): add kasm.renner.uno reverse proxy and deploy-caddy pipeline

2026-04-22 07:59:11 +02:00

ansible

feat(caddy): add kasm.renner.uno reverse proxy and deploy-caddy pipeline

2026-04-22 07:59:11 +02:00

dns-server

chore: Remove local markdown docs; wiki is single source of truth