gatus (status), ical-proxy, kube-prometheus-stack (alerts/dash/prometheus) have no nginx-only annotations, so the migration is pure ingressClassName: nginx → traefik plus apps/allow-from-ingress now permitting the traefik label as a source. cloudflared retargets status.renner.uno (the only WAN-exposed name in this batch); the rest are LAN-only via external-dns-unifi. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>