From 765962c936c9799d6c25578738649009416ec30f Mon Sep 17 00:00:00 2001 From: CTO Date: Sat, 12 Sep 2026 18:15:51 +0000 Subject: [PATCH] fix(velero-drill): hostAliases to reach paperclip.home webhook from cluster (DEV-579) Public DNS for paperclip.home.imicros.de returns the LAN IP 10.0.0.2, so the drill's webhook POST was landing with HTTP 000 from Hetzner. The home reverse proxy at 46.225.155.185 already serves that vhost publicly, so pinning the hostname to the home public IP in the CronJob's hostAliases lets the webhook fire the Paperclip routine without any home-network or SealedSecret changes. Verified end-to-end: bearer POST via --resolve returns HTTP 202 with status=issue_created (run issue b07fc035 created under DEV-578). Co-Authored-By: Paperclip --- velero/restore-drill/20-restore-drill-cronjob.yaml | 11 +++++++++++ velero/restore-drill/README.md | 5 +++-- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/velero/restore-drill/20-restore-drill-cronjob.yaml b/velero/restore-drill/20-restore-drill-cronjob.yaml index e7a91e3..70f9cce 100644 --- a/velero/restore-drill/20-restore-drill-cronjob.yaml +++ b/velero/restore-drill/20-restore-drill-cronjob.yaml @@ -28,6 +28,17 @@ spec: spec: restartPolicy: Never serviceAccountName: restore-drill + # DEV-579: public DNS for paperclip.home.imicros.de returns the LAN IP + # 10.0.0.2 (split-brain), which is unroutable from the cluster. The + # home reverse proxy at home.imicros.de (46.225.155.185) already + # serves the paperclip.home.imicros.de vhost publicly, so overriding + # the hostname to that public IP lets the webhook reach the routine. + # If the home ISP rotates the public IP, refresh this entry from + # `dig +short home.imicros.de` (DDNS record). + hostAliases: + - ip: "46.225.155.185" + hostnames: + - "paperclip.home.imicros.de" securityContext: runAsNonRoot: true runAsUser: 65532 diff --git a/velero/restore-drill/README.md b/velero/restore-drill/README.md index d63a34a..b2a7cc2 100644 --- a/velero/restore-drill/README.md +++ b/velero/restore-drill/README.md @@ -24,8 +24,9 @@ Velero cluster-reconstruction backup layer. 6. Writes the final report to ConfigMap `velero/velero-restore-drill-last-result` and logs it to stdout. 7. Optionally POSTs a JSON payload to the Paperclip routine webhook if - the `velero-restore-drill-webhook` Secret is present (currently unreachable - from the cluster — see follow-up ticket). + the `velero-restore-drill-webhook` Secret is present. The CronJob uses a + `hostAliases` entry to route `paperclip.home.imicros.de` at the home + public IP so the webhook reaches the routine from Hetzner (DEV-579). ## Failure signalling