[reverse-proxy] Fix gw.viktorbarzin.me — point at 192.168.1.1 via EndpointSlice

The TP-Link gateway was wired via ExternalName `gw.viktorbarzin.lan`, but
Technitium has no record for that name (the router isn't a DHCP client and
Kea DDNS never registers it), so the ingress backend returned NXDOMAIN and
the `[External] gw` Uptime Kuma monitor was permanently failing.

Factory now accepts `backend_ip` as an alternative to `external_name`: it
creates a selector-less ClusterIP Service + manual EndpointSlice pointing
at the given IP, bypassing cluster DNS entirely. Used for gw (192.168.1.1);
the old ExternalName path is retained for every other service.

Also add a direct `port` monitor for the router in uptime-kuma's
internal_monitors list so we can tell a Cloudflare/tunnel outage apart
from the router itself being down. Extended the internal-monitor-sync
script to handle non-DB monitor types (hostname + port fields).

stacks/reverse-proxy/modules/reverse_proxy/factory/main.tf

@@ -14,7 +14,16 @@ variable "name" {}
 variable "namespace" {
   default = "reverse-proxy"
 }
-variable "external_name" {}
+variable "external_name" {
+  type        = string
+  default     = null
+  description = "DNS name for ExternalName Service. Mutually exclusive with backend_ip."
+}
+variable "backend_ip" {
+  type        = string
+  default     = null
+  description = "IP address backend. When set, creates a selector-less Service + EndpointSlice pointing at this IP. Mutually exclusive with external_name — use for hosts that aren't in Technitium (e.g. upstream gateways)."
+}
 variable "port" {
   default = "80"
 }
@@ -95,7 +104,14 @@ variable "public_ipv6" {
 }
 
 
+locals {
+  use_backend_ip = var.backend_ip != null
+  port_name      = var.backend_protocol == "HTTPS" ? "https-${var.name}" : "${var.name}-web"
+}
+
+# ExternalName flavor — used when the backend is addressable by DNS.
 resource "kubernetes_service" "proxied-service" {
+  count = local.use_backend_ip ? 0 : 1
   metadata {
     name      = var.name
     namespace = var.namespace
@@ -109,7 +125,7 @@ resource "kubernetes_service" "proxied-service" {
     external_name = var.external_name
 
     port {
-      name        = var.backend_protocol == "HTTPS" ? "https-${var.name}" : "${var.name}-web"
+      name        = local.port_name
       port        = var.port
       protocol    = "TCP"
       target_port = var.port
@@ -117,6 +133,58 @@ resource "kubernetes_service" "proxied-service" {
   }
 }
 
+# IP-backend flavor — selector-less Service + manually-managed EndpointSlice.
+# Used for upstreams that have no DNS entry in Technitium (e.g. 192.168.1.1).
+resource "kubernetes_service" "ip-backend-service" {
+  count = local.use_backend_ip ? 1 : 0
+  metadata {
+    name      = var.name
+    namespace = var.namespace
+    labels = {
+      "app" = var.name
+    }
+  }
+
+  spec {
+    type = "ClusterIP"
+    port {
+      name        = local.port_name
+      port        = var.port
+      protocol    = "TCP"
+      target_port = var.port
+    }
+  }
+}
+
+resource "kubernetes_manifest" "ip_backend_endpointslice" {
+  count = local.use_backend_ip ? 1 : 0
+  manifest = {
+    apiVersion = "discovery.k8s.io/v1"
+    kind       = "EndpointSlice"
+    metadata = {
+      name      = var.name
+      namespace = var.namespace
+      labels = {
+        "kubernetes.io/service-name" = var.name
+        "app"                        = var.name
+      }
+    }
+    addressType = "IPv4"
+    ports = [{
+      name     = local.port_name
+      port     = tonumber(var.port)
+      protocol = "TCP"
+    }]
+    endpoints = [{
+      addresses = [var.backend_ip]
+      conditions = {
+        ready = true
+      }
+    }]
+  }
+  depends_on = [kubernetes_service.ip-backend-service]
+}
+
 locals {
   # External monitor defaults: on when proxied, off otherwise. Explicit bool overrides.
   effective_external_monitor = var.external_monitor != null ? var.external_monitor : (var.dns_type == "proxied")

stacks/reverse-proxy/modules/reverse_proxy/main.tf

@@ -112,13 +112,11 @@ module "idrac" {
   depends_on = [kubernetes_namespace.reverse-proxy]
 }
 
-# Can either listen on https or http; can't do both :/
-# TODO: Not working yet
 module "tp-link-gateway" {
   source             = "./factory"
   dns_type           = "proxied"
   name               = "gw"
-  external_name      = "gw.viktorbarzin.lan"
+  backend_ip         = "192.168.1.1"
   port               = 443
   tls_secret_name    = var.tls_secret_name
   backend_protocol   = "HTTPS"