Claude
1261e238aa
- Pinned to 1.37.0 so the migration is not also an upgrade - ADMIN_TOKEN rotated to an Argon2id PHC string, stored as a SealedSecret. The old token was plaintext AND set in config.json, which overrides env -- both that key and signups_allowed were removed during migration so the Deployment is the source of truth. signups had been silently enabled. - /admin keeps Authentik forward-auth at priority 1000 (Traefik's default priority is rule length; the old docker router used 10 vs an implicit 24 and was therefore bypassed). - vault.aleshym.co stays private: absent from the k3s public catchall and from the Docker Traefik wan entrypoint. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
30 lines
855 B
YAML
30 lines
855 B
YAML
# vault.aleshym.co is PRIVATE. It is deliberately absent from the k3s
|
|
# `catchall-to-docker-apps` public host list and from the Docker Traefik `wan`
|
|
# entrypoint, so the internet has no route to it. Pi-hole resolves the name to
|
|
# 10.10.0.100 for LAN/VPN clients.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: vaultwarden
|
|
namespace: vaultwarden
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
spec:
|
|
ingressClassName: traefik
|
|
rules:
|
|
- host: vault.aleshym.co
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: vaultwarden
|
|
port:
|
|
name: http
|
|
tls:
|
|
- hosts:
|
|
- vault.aleshym.co
|
|
secretName: vaultwarden-tls
|