basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 2 Projects Releases Packages Wiki Activity Actions

fix(velero-drill): hostAliases to reach paperclip.home webhook from cluster (DEV-579)

Browse source 
Public DNS for paperclip.home.imicros.de returns the LAN IP 10.0.0.2, so the
drill's webhook POST was landing with HTTP 000 from Hetzner. The home reverse
proxy at 46.225.155.185 already serves that vhost publicly, so pinning the
hostname to the home public IP in the CronJob's hostAliases lets the webhook
fire the Paperclip routine without any home-network or SealedSecret changes.

Verified end-to-end: bearer POST via --resolve returns HTTP 202 with
status=issue_created (run issue b07fc035 created under DEV-578).

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
CTO 2026-09-12 18:15:51 +00:00
parent ac9f36b1e7
commit 765962c936
2 changed files with 14 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
velero/restore-drill/20-restore-drill-cronjob.yaml
View file

@ -28,6 +28,17 @@ spec:
spec: spec:
restartPolicy: Never restartPolicy: Never
serviceAccountName: restore-drill serviceAccountName: restore-drill
# DEV-579: public DNS for paperclip.home.imicros.de returns the LAN IP
# 10.0.0.2 (split-brain), which is unroutable from the cluster. The
# home reverse proxy at home.imicros.de (46.225.155.185) already
# serves the paperclip.home.imicros.de vhost publicly, so overriding
# the hostname to that public IP lets the webhook reach the routine.
# If the home ISP rotates the public IP, refresh this entry from
# `dig +short home.imicros.de` (DDNS record).
hostAliases:
- ip: "46.225.155.185"
hostnames:
- "paperclip.home.imicros.de"
securityContext: securityContext:
runAsNonRoot: true runAsNonRoot: true
runAsUser: 65532 runAsUser: 65532

5
velero/restore-drill/README.md
View file

@ -24,8 +24,9 @@ Velero cluster-reconstruction backup layer.
6. Writes the final report to ConfigMap `velero/velero-restore-drill-last-result` 6. Writes the final report to ConfigMap `velero/velero-restore-drill-last-result`
and logs it to stdout. and logs it to stdout.
7. Optionally POSTs a JSON payload to the Paperclip routine webhook if 7. Optionally POSTs a JSON payload to the Paperclip routine webhook if
the `velero-restore-drill-webhook` Secret is present (currently unreachable the `velero-restore-drill-webhook` Secret is present. The CronJob uses a
from the cluster — see follow-up ticket). `hostAliases` entry to route `paperclip.home.imicros.de` at the home
public IP so the webhook reaches the routine from Hetzner (DEV-579).
## Failure signalling ## Failure signalling