viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

forgejo pulls: route *.viktorbarzin.me to Technitium, drop /etc/hosts pins [ci skip]

Browse source 
Supersedes this morning's per-node /etc/hosts pin (no hardcoded service
IPs on nodes, per Viktor). Technitium's split-horizon zone already
resolves forgejo.viktorbarzin.me -> CNAME apex -> live Traefik LB IP
(ingress-dns-sync auto-CNAMEs every ingress host; apex drift probe
alerts) -- the nodes just never queried it. Rolled the devvm's
systemd-resolved routing-domain pattern (~viktorbarzin.me ->
10.0.20.201) to all 7 nodes, removed the pins, verified getent +
crictl pull via pure DNS.

Also demoted node5/6's cloud-init global-dns.conf (DNS=8.8.8.8 1.1.1.1)
to FallbackDNS-only: public servers in the global set race the routing
domain. Its justification ("Technitium NXDOMAINs forgejo") was obsolete
-- exactly the stale comment that pointed new nodes at the hairpin.

hosts.toml mirror kept but documented as vestigial (Traefik 404s
bare-IP requests; registry auth realm is an absolute URL).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Viktor Barzin 2026-06-10 07:56:31 +00:00
parent b6976ce014
commit 1ee1bf0817
7 changed files with 135 additions and 66 deletions
Download patch file Download diff file Expand all files Collapse all files

28
modules/create-template-vm/k8s-node-containerd-setup.sh
View file

@ -49,10 +49,16 @@ server = "https://ghcr.io"
capabilities = ["pull", "resolve"]
GHCR
# Forgejo OCI registry: prefer in-cluster Traefik LB (10.0.20.203) to
# avoid hairpin NAT. Traefik serves the *.viktorbarzin.me wildcard so
# SNI verification succeeds. If the mirror is unreachable, fall back to
# public DNS resolution (needs the global DNS fallback set up below).
# Forgejo OCI registry. NOTE: this hosts.toml mirror is VESTIGIAL — it
# cannot keep pulls off the public hairpin on its own (Traefik routes by
# Host/SNI and 404s the mirror's bare-IP requests, and the registry's
# Bearer auth realm is the absolute https://forgejo.viktorbarzin.me/v2/token
# URL fetched outside the mirror). What actually keeps forgejo pulls
# internal is the systemd-resolved routing domain ~viktorbarzin.me ->
# Technitium (viktorbarzin.conf, written by cloud_init.yaml), which
# resolves forgejo to the live Traefik LB via the split-horizon zone.
# Kept for config uniformity; harmless. See
# docs/post-mortems/2026-06-10-tuya-bridge-forgejo-pull-hairpin.md.
mkdir -p /etc/containerd/certs.d/forgejo.viktorbarzin.me
cat > /etc/containerd/certs.d/forgejo.viktorbarzin.me/hosts.toml <<'FORGEJO'
server = "https://forgejo.viktorbarzin.me"
@ -62,20 +68,6 @@ server = "https://forgejo.viktorbarzin.me"
skip_verify = true
FORGEJO
# /etc/hosts pin — REQUIRED in addition to the hosts.toml mirror. The
# mirror alone cannot make forgejo pulls hairpin-proof for two reasons
# (2026-06-10 tuya-bridge outage, third incident of this class):
# a) Traefik routes by Host/SNI and 404s the mirror's bare-IP requests,
# so containerd always falls back to `server` (public DNS → hairpin).
# b) The registry's Bearer auth realm is the absolute URL
# https://forgejo.viktorbarzin.me/v2/token, which containerd fetches
# verbatim — that leg never goes through the mirror at all.
# Pinning the name to Traefik's LB fixes resolve + token + blob legs with
# correct SNI and a valid cert. If Traefik's LB IP ever changes, update
# this pin together with the hosts.toml IP above.
grep -q forgejo-internal-pin /etc/hosts || \
echo '10.0.20.203 forgejo.viktorbarzin.me # forgejo-internal-pin (managed: setup-forgejo-containerd-mirror.sh)' >> /etc/hosts
# quay.io + registry.k8s.io: include mirror configs that match node4's
# layout (no real pull-through cache today, server line is the direct
# upstream). Keeping these present makes the per-node config uniform and