[BryanLawless]

Summary

Dynamic DNS

• favonia/cloudflare-ddns 1.18.0 (pinned by digest) keeps PUBLIC_DOMAIN (proxied), REGISTRY_DOMAIN and STORAGE_DOMAIN (DNS only, because of Cloudflare's 100 MB proxy body limit) on the connection's current public IPv4 address, checking on start and every five minutes. IPv6 is off.
• Runs in the infrastructure-configs stage, so the records are right before the platform and apps deploy. That stage now takes cluster-settings through postBuild.substituteFrom (nothing in it used $ before), and validate.sh checks it with substitution.
• Reuses the snapflow/cloudflare-dns Zone:DNS:Edit token cert-manager uses, and sends failed updates to the Flux alerts Discord channel; the ExternalSecret template turns the webhook URL into Shoutrrr's discord://<token>@<id> without any $, so Flux substitution cannot touch it.
• Hardened like the chart's workloads: non-root, read-only root filesystem, all capabilities dropped, no service account token, secrets mounted as files, Reloader on secret changes.

Host firewall

• deploy/bootstrap/host-firewall.sh is the server's whole UFW configuration, applied declaratively (reset, then the rules), so reruns are no-ops and hand-added rules are removed. --dry-run prints the rules.
• Public: TCP 80, 443, 8443, 9443 and UDP 8443. Administrative network only (default: the default route's network; ADMIN_CIDR overrides; Tailscale when present): SSH, rate limited, and the k3s API. The k3s pod and service CIDRs are allowed for input and forwarding, per the k3s requirements for UFW.
• Ends by listing every Docker-published port and Kubernetes NodePort, LoadBalancer, host-network and host-port workload, since those bypass UFW.

Read-only database access

• CloudNativePG managed.roles declares snapflow_readonly (login, pg_read_all_data, connection limit 5) with its password from a kubernetes.io/basic-auth secret labelled cnpg.io/reload.
• The OpenBao configure job generates the password at snapflow/platform/postgres-readonly; the operator policy may read that one path (and list snapflow/platform/) and nothing else there.

Testing

• validate.sh passes for every stage, including infrastructure-configs with cluster settings; shellcheck is clean.
• The notification template, rendered with Go text/template and sprig as External Secrets does, turns https://discord.com/api/webhooks/<id>/<token> into discord://<token>@<id>.
• The pinned cloudflare-ddns image, run as 1000:1000 read-only with all capabilities dropped and these exact settings, parsed every setting (three IPv4 domains, @every 5m, notifications) and proceeded to call Cloudflare.
• The firewall script in a privileged Ubuntu container: the dry run prints the rules; a real run produces exactly them; a second run is identical; a hand-added rule is removed; a bad argument is rejected.
• Against OpenBao 2.7.1, the operator token reads snapflow/platform/postgres-readonly and lists snapflow/platform/, but cannot write it or read snapflow/platform/redis.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 029d9ccd-42da-4d26-b3f2-15b8a4eb3335

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn