Erich Blume
e6cf7e47e0
All checks were successful
Deploy Fly.io Proxy / deploy (push) Successful in 1m8s
## Summary - Introduce `tag:flyio-target` so services must explicitly opt in to be reachable by the fly.io proxy - Replace broad `tag:k8s` and `tag:homelab` grants with the new tag in the ACL rule and test - Add `tailscale.com/tags: "tag:k8s,tag:flyio-target"` annotation to docs, loki, and prometheus Ingresses - Switch Alloy push endpoints from `*.ops.eblu.me` (Caddy) to `*.tail8d86e.ts.net` (Tailscale Ingress) - Update docs: flyio-proxy, caddy, tailscale, forgejo (future public access + security checklist), expose-service-publicly ## Manual step (not in PR) Update the k8s operator OAuth client in the Tailscale admin console to include `tag:flyio-target` in its scope. Without this, the operator cannot assign the new tag to Ingress proxy nodes. ## Deployment order 1. **Pulumi ACLs** — `mise run tailnet-preview && mise run tailnet-up` 2. **OAuth client** — Manual update in Tailscale admin console 3. **K8s Ingresses** — `argocd app sync apps && argocd app sync docs loki prometheus` 4. **Fly.io proxy** — `mise run fly-deploy` 5. **Verify** — `mise run services-check`, check Grafana dashboards ## Test plan - [ ] `mise run tailnet-preview` shows clean diff - [ ] `argocd app diff docs`, `argocd app diff loki`, `argocd app diff prometheus` show only annotation additions - [ ] After deploy: Grafana dashboards show continued log/metric flow - [ ] `curl -sf https://docs.eblu.me` returns 200 - [ ] `mise run services-check` passes 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/126
33 lines
1.1 KiB
YAML
33 lines
1.1 KiB
YAML
# Tailscale Ingress for Grafana
|
|
# Exposes Grafana at https://grafana.tail8d86e.ts.net with Let's Encrypt TLS
|
|
#
|
|
# The hostname "grafana" becomes grafana.tail8d86e.ts.net via Tailscale MagicDNS
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: grafana-tailscale
|
|
namespace: monitoring
|
|
annotations:
|
|
tailscale.com/proxy-class: "default"
|
|
tailscale.com/proxy-group: "ingress"
|
|
gethomepage.dev/enabled: "true"
|
|
gethomepage.dev/name: "Grafana"
|
|
gethomepage.dev/group: "Observability"
|
|
gethomepage.dev/icon: "grafana.png"
|
|
gethomepage.dev/description: "Metrics dashboards"
|
|
gethomepage.dev/href: "https://grafana.ops.eblu.me"
|
|
gethomepage.dev/pod-selector: "app.kubernetes.io/name=grafana"
|
|
gethomepage.dev/widget.type: "grafana"
|
|
gethomepage.dev/widget.url: "https://grafana.ops.eblu.me"
|
|
gethomepage.dev/widget.username: "{{HOMEPAGE_VAR_GRAFANA_USERNAME}}"
|
|
gethomepage.dev/widget.password: "{{HOMEPAGE_VAR_GRAFANA_PASSWORD}}"
|
|
spec:
|
|
ingressClassName: tailscale
|
|
defaultBackend:
|
|
service:
|
|
name: grafana
|
|
port:
|
|
number: 80
|
|
tls:
|
|
- hosts:
|
|
- grafana
|