2 commits

Author	SHA1	Message	Date
Brandon Schneider	69b984c410	fix(infra): resolve k3s services startup issues and update ingress configuration ... - Revert builder image in embedded_surface Dockerfile to rust:bookworm for glibc compatibility with bookworm-slim runner. - Replace racknerd-surface.json Git LFS pointer with the actual retrieved JSON config to resolve parse errors. - Separated and imported regenerated docker images for stubs and credential-server on all cluster nodes. - Fixed Ingress resources and middleware to target the correct authentik-server service name. - Rewrote verification script checks to handle iptables-based ports and relative redirects robustly. - Updated nixos-laptop IP in node topology documentation. Build: 0 jobs, 0 errors	2026-05-27 17:39:00 -05:00
Brandon Schneider	aae680ad3c	chore(infra): add internal routing smoke-test script ... scripts/verify-internal.sh runs the exact verification sequence before the edge is touched. Checks (in order): 0. Port listeners — host Caddy owns :80, Traefik NodePort on :30080 1. GET / — 200 Homer or 302 → auth.researchstack.info (not internal IP) 2. /api/* bypass — none of /api/*/health may 302 to Authentik 3. auth.researchstack.info — 200/302 from Authentik, no internal-IP loop 4. Host header passthrough — Traefik :30080 /ping reachable; /api/jobs/health routes end-to-end through host Caddy → Traefik → Ingress 5. X-Forwarded-Proto — https header survives the server-Caddy hop Usage: # on nixos-laptop directly: bash 4-Infrastructure/k3s-flake/scripts/verify-internal.sh # from any tailnet node: bash 4-Infrastructure/k3s-flake/scripts/verify-internal.sh --remote Exit 0 = safe to deploy edge. Exit 1 = fix red checks first. Generated with Devin (https://cli.devin.ai/docs) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2026-05-26 21:08:58 -05:00