k.rennerandClaude Opus 4.7
f4b232ac07
vscode.home.renner.uno (LAN-only) edits HA's /config in a browser. Sidecar in the HA pod rather than a separate Deployment because the config PVC is RWO ceph-block; the alternative was migrating to RWX ceph-filesystem, which would touch HA's running state for no other benefit. Auth is --auth=none — trust-the-network on the LAN. The Ingress omits the cloudflare-proxied annotation, so external-dns-unifi publishes a UniFi DNS A record for vscode.home.renner.uno -> the ingress-nginx LB and external-dns-cloudflare leaves it alone. DNS-01 via Cloudflare gets the cert without WAN reachability. Pod restart caveat: rolling the home-assistant Deployment now restarts HA + config-reconciler + code-server together, which is fine on a Recreate strategy. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>