blumeops/argocd/manifests/tailscale-operator/egress-forge.yaml

# Egress proxy to expose Forgejo (forge) to the cluster
# Forge runs on indri:3001, exposed via Tailscale Serve as forge.tail8d86e.ts.net
# We target indri directly since egress can't reach Tailscale Serve hostnames
#
# See: https://tailscale.com/kb/1438/kubernetes-operator-cluster-egress
---
apiVersion: v1
kind: Service
metadata:
  name: forge
  namespace: tailscale
  annotations:
    tailscale.com/tailnet-fqdn: indri.tail8d86e.ts.net
    tailscale.com/proxy-class: "default"
spec:
  type: ExternalName
  externalName: placeholder
  ports:
    - port: 3001
      targetPort: 3001
K8s Migration Phase 1: Infrastructure Setup (#29) ## Summary - Split k8s migration plan into phases folder for easier navigation - Added `tag:k8s` to Pulumi ACLs for Kubernetes workloads - Phase 1 work in progress ## Phase 1 Goals - Tailscale Kubernetes Operator - CloudNativePG Operator - PostgreSQL cluster for future app migrations ## Deployment and Testing - [ ] Review Phase 1 plan - [ ] `mise run tailnet-preview` to verify ACL changes - [ ] `mise run tailnet-up` to apply ACL changes - [ ] Create Tailscale OAuth client (manual) - [ ] Deploy operators and PostgreSQL cluster 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.tail8d86e.ts.net/eblume/blumeops/pulls/29 2026-01-19 09:49:52 -08:00			`# Egress proxy to expose Forgejo (forge) to the cluster`
			`# Forge runs on indri:3001, exposed via Tailscale Serve as forge.tail8d86e.ts.net`
			`# We target indri directly since egress can't reach Tailscale Serve hostnames`
			`#`
			`# See: https://tailscale.com/kb/1438/kubernetes-operator-cluster-egress`
			`---`
			`apiVersion: v1`
			`kind: Service`
			`metadata:`
			`name: forge`
			`namespace: tailscale`
			`annotations:`
			`tailscale.com/tailnet-fqdn: indri.tail8d86e.ts.net`
P5.1: Migrate minikube from podman to QEMU2 driver (#38) ## Summary - Migrate minikube from podman driver to qemu2 driver for proper NFS/SMB volume mount support - Update ansible minikube role with qemu installation and containerd runtime - Remove podman role dependency from indri.yml - Add synology user creation steps and post-migration zot reconfiguration notes ## Why Phase 6 (Kiwix/Transmission migration) was blocked because the podman driver lacks kernel capabilities for filesystem mounts. QEMU2 creates an actual VM with full mount support. ## Deployment and Testing - [ ] Create k8s-storage user on Synology DSM - [ ] Store credentials in 1Password (synology-k8s-storage) - [ ] Export current k8s state - [ ] Stop and delete podman-based minikube cluster - [ ] Run ansible to create QEMU2 cluster - [ ] Test NFS volume mount with test pod - [ ] Redeploy ArgoCD and all apps - [ ] Verify all services healthy - [ ] Reconfigure zot registry mirrors for containerd (post-migration) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.tail8d86e.ts.net/eblume/blumeops/pulls/38 2026-01-21 16:03:37 -08:00			`tailscale.com/proxy-class: "default"`
K8s Migration Phase 1: Infrastructure Setup (#29) ## Summary - Split k8s migration plan into phases folder for easier navigation - Added `tag:k8s` to Pulumi ACLs for Kubernetes workloads - Phase 1 work in progress ## Phase 1 Goals - Tailscale Kubernetes Operator - CloudNativePG Operator - PostgreSQL cluster for future app migrations ## Deployment and Testing - [ ] Review Phase 1 plan - [ ] `mise run tailnet-preview` to verify ACL changes - [ ] `mise run tailnet-up` to apply ACL changes - [ ] Create Tailscale OAuth client (manual) - [ ] Deploy operators and PostgreSQL cluster 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.tail8d86e.ts.net/eblume/blumeops/pulls/29 2026-01-19 09:49:52 -08:00			`spec:`
			`type: ExternalName`
			`externalName: placeholder`
			`ports:`
			`- port: 3001`
			`targetPort: 3001`