- security-model: Replace "no public access" with Fly.io proxy description
- routing: Add *.eblu.me as third DNS domain for public services
- architecture: Add Fly.io to network layer and service routing table
- CLAUDE.md: Add public routing domain to routing table
- gandi: Add public CNAME records section
- tailscale-operator: Document ProxyGroup, VIP routing, per-Ingress tags
- flyio-proxy: Clarify why Alloy uses direct Tailscale endpoints (ACL)
- Remove hardcoded Tailscale IP (100.98.163.89) from docs, use DNS names
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Revert the Caddy endpoint change — flyio-proxy ACLs only allow
tag:flyio-target, so Alloy can't reach Caddy on indri (tag:homelab).
The direct Tailscale Ingress endpoints (loki/prometheus.tail8d86e.ts.net)
are tagged tag:flyio-target specifically for this purpose.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add autoApprovers so ProxyGroup pods (tag:k8s) can auto-approve VIP
service routes, as required by Tailscale multi-cluster Ingress docs
- Revert Alloy endpoints from direct Tailscale Ingress back to Caddy
(*.ops.eblu.me) to decouple observability from VIP routing
- Update changelog to reflect final state
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove explicit `host:` field from Ingress rules. With ProxyGroup-based
Tailscale Ingresses, the Host header contains the FQDN (e.g.,
prometheus.tail8d86e.ts.net) which doesn't match the short name
(prometheus), causing 404s.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The legacy per-Ingress StatefulSet proxy model silently ignores the
tailscale.com/tags annotation, so tag:flyio-target was never applied
to docs/loki/prometheus — breaking the restricted ACL. This adds a
ProxyGroup (type: Ingress, 2 replicas) and annotates all 12 Ingresses
with tailscale.com/proxy-group: "ingress" to enable per-Ingress tag
overrides and restore connectivity.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace broad tag:k8s and tag:homelab grants with a new tag:flyio-target
tag that services must explicitly opt into. Alloy now pushes logs/metrics
directly to Loki and Prometheus via Tailscale Ingress, bypassing Caddy.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
