Automate add-service-to-domain (DDNS secret + caddy route) #42

New issue

Closed

opened 2026-08-01 20:43:00 +00:00 by lab · 0 comments

lab commented

2026-08-01 20:43:00 +00:00

Owner

Problem

Exposing a new service publicly currently requires manual steps that are error-prone and undocumented in automation:

Add a Caddy route to k3s-ha-cluster/caddy/configmap.yaml (deployed by the caddy-upgrade workflow)
Add the subdomain to temp/config.json (gitignored, real Cloudflare API token)
Regenerate + apply the config-cloudflare-ddns secret by hand
kubectl rollout restart ddns + caddy

Details

The Caddy route is now fully automated via .forgejo/workflows/caddy-upgrade.yml (triggered on configmap.yaml changes, with workflow_dispatch support).
The DDNS record bootstrap is NOT automated: temp/config.json holds the real Cloudflare token and is gitignored, so the committed k3s-ha-cluster/ddns/config-cloudflare-ddns-Secret.yaml is only a placeholder (<my-base64-encoded-config>).
Note: temp/config.json also stores the Cloudflare API token in plaintext locally; ideally it moves into a Forgejo secret (e.g. CLOUDFLARE_DDNS_CONFIG) so a workflow can render the Secret.

Success criteria

A workflow (e.g. deploy-ddns.yml) that renders the real config-cloudflare-ddns Secret from a Forgejo-stored secret and applies it, triggered on changes to a versioned config or via workflow_dispatch.
temp/config.json either becomes a template with the token sourced from a secret, or moves behind a small script.
Update .kiro/skills/homelab-k3s/references/add-service-to-caddy.md to the automated flow.

Refs #39

### Problem Exposing a new service publicly currently requires manual steps that are error-prone and undocumented in automation: 1. Add a Caddy route to `k3s-ha-cluster/caddy/configmap.yaml` (deployed by the caddy-upgrade workflow) 2. Add the subdomain to `temp/config.json` (gitignored, real Cloudflare API token) 3. Regenerate + apply the `config-cloudflare-ddns` secret by hand 4. `kubectl rollout restart` ddns + caddy ### Details - The Caddy route is now fully automated via `.forgejo/workflows/caddy-upgrade.yml` (triggered on `configmap.yaml` changes, with `workflow_dispatch` support). - The DDNS record bootstrap is NOT automated: `temp/config.json` holds the real Cloudflare token and is gitignored, so the committed `k3s-ha-cluster/ddns/config-cloudflare-ddns-Secret.yaml` is only a placeholder (`<my-base64-encoded-config>`). - Note: `temp/config.json` also stores the Cloudflare API token in plaintext locally; ideally it moves into a Forgejo secret (e.g. `CLOUDFLARE_DDNS_CONFIG`) so a workflow can render the Secret. ### Success criteria - A workflow (e.g. `deploy-ddns.yml`) that renders the real `config-cloudflare-ddns` Secret from a Forgejo-stored secret and applies it, triggered on changes to a versioned config or via `workflow_dispatch`. - `temp/config.json` either becomes a template with the token sourced from a secret, or moves behind a small script. - Update `.kiro/skills/homelab-k3s/references/add-service-to-caddy.md` to the automated flow. Refs #39