consolidate MetalLB IPs: 5 → 1 (10.0.20.200)

Migrate all 11 LoadBalancer services to share 10.0.20.200:
- Update annotations: metallb.universe.tf → metallb.io
- Pin all services to 10.0.20.200 with allow-shared-ip: shared
- Standardize externalTrafficPolicy to Cluster (required for IP sharing)
- Remove redundant port 80 (roundcube) from mailserver LB
- Update CoreDNS forward: 10.0.20.204 → 10.0.20.200
- Update cloudflared tunnel target: 10.0.20.202 → 10.0.20.200

Services consolidated: coturn, headscale, kms, qbittorrent, shadowsocks,
torrserver, wireguard, mailserver, traefik, xray, technitium

stacks/platform/modules/cloudflared/cloudflare.tf

@@ -63,7 +63,7 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "sof" {
       content {
         hostname = ingress_rule.value == "viktorbarzin.me" ? ingress_rule.value : "${ingress_rule.value}.viktorbarzin.me"
         path     = "/"
-        service  = "https://10.0.20.202:443"
+        service  = "https://10.0.20.200:443"
         origin_request {
           no_tls_verify = true
         }

stacks/platform/modules/headscale/main.tf

@@ -283,7 +283,8 @@ resource "kubernetes_service" "headscale-server" {
       "app" = "headscale"
     }
     annotations = {
-      "metallb.universe.tf/allow-shared-ip" : "shared"
+      "metallb.io/loadBalancerIPs" = "10.0.20.200"
+      "metallb.io/allow-shared-ip" = "shared"
     }
   }
 

stacks/platform/modules/mailserver/main.tf

@@ -460,14 +460,14 @@ resource "kubernetes_service" "mailserver" {
     }
 
     annotations = {
-      "metallb.universe.tf/allow-shared-ip" = "shared"
+      "metallb.io/loadBalancerIPs" = "10.0.20.200"
+      "metallb.io/allow-shared-ip" = "shared"
     }
   }
 
   spec {
     type = "LoadBalancer"
-    # external_traffic_policy = "Cluster"
-    external_traffic_policy = "Local"
+    external_traffic_policy = "Cluster"
     selector = {
       app = "mailserver"
     }
@@ -499,12 +499,6 @@ resource "kubernetes_service" "mailserver" {
       port        = 993
       target_port = "imap-secure"
     }
-
-    port {
-      name     = "roundcube"
-      protocol = "TCP"
-      port     = 80
-    }
   }
 }
 

stacks/platform/modules/technitium/main.tf

@@ -74,7 +74,7 @@ resource "kubernetes_config_map" "coredns" {
           rcode NXDOMAIN
           fallthrough
         }
-        forward . 10.0.20.204 # Technitium LoadBalancer
+        forward . 10.0.20.200 # Technitium LoadBalancer
         cache {
           success 10000 300 6
           denial 10000 300 60
@@ -265,6 +265,10 @@ resource "kubernetes_service" "technitium-dns" {
     labels = {
       "app" = "technitium"
     }
+    annotations = {
+      "metallb.io/loadBalancerIPs" = "10.0.20.200"
+      "metallb.io/allow-shared-ip" = "shared"
+    }
   }
 
   spec {
@@ -274,7 +278,7 @@ resource "kubernetes_service" "technitium-dns" {
       port     = 53
       protocol = "UDP"
     }
-    external_traffic_policy = "Local"
+    external_traffic_policy = "Cluster"
     selector = {
       "dns-server" = "true"
     }

stacks/platform/modules/traefik/main.tf

@@ -144,10 +144,11 @@ resource "helm_release" "traefik" {
     service = {
       type = "LoadBalancer"
       annotations = {
-        "metallb.io/loadBalancerIPs" = "10.0.20.202"
+        "metallb.io/loadBalancerIPs" = "10.0.20.200"
+        "metallb.io/allow-shared-ip" = "shared"
       }
       spec = {
-        externalTrafficPolicy = "Local"
+        externalTrafficPolicy = "Cluster"
       }
     }
 

stacks/platform/modules/wireguard/main.tf

@@ -209,7 +209,8 @@ resource "kubernetes_service" "wireguard" {
     name      = "wireguard"
     namespace = kubernetes_namespace.wireguard.metadata[0].name
     annotations = {
-      "metallb.universe.tf/allow-shared-ip" = "shared"
+      "metallb.io/loadBalancerIPs" = "10.0.20.200"
+      "metallb.io/allow-shared-ip" = "shared"
     }
     labels = {
       "app" = "wireguard"