Thore Cimbal
30578abaaf
Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s
Ingress-only default-deny plus per-component allow rules, using named container ports throughout (not Service ports) after the authentik port-mismatch incident. Traefik -> element-web/element-admin/haproxy (fronts both matrix.axion1337.chat and well-known)/MAS; synapse <- haproxy+MAS; postgres <- synapse+MAS; RTC signalling via Traefik, RTC media NodePorts left open to the internet by design; monitoring scrape allows for synapse/postgres/rtc-sfu metrics; ACME solver allow. coturn (hostNetwork) needs nothing - NetworkPolicy doesn't apply to it. Part of issue #10.