rohana.axion1337.de resolves publicly to a Hetzner address, while the host
is reachable over the private network at 10.0.0.3 - and serves a valid
Let's Encrypt certificate for that very name there, measured with full
verification. Without an internal pointer every access from the cluster
leaves it for no reason and needs an outbound exception.
A dedicated zone rather than a second hosts block: the Corefile already
runs hosts /etc/coredns/NodeHosts in the main block, so a second one there
would collide. The .server import at the end of the Corefile takes a zone
of its own, and the reload plugin picks the change up without a restart.
The price is in the file, not in a commit message nobody rereads: two paths
become one. If 10.0.0.3 is down, rohana is unreachable from the cluster
although the public route would work, and the failure looks like "Gitea is
gone" rather than "the private path is gone". The comment says where to
look first.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F2Q4Ri8NGwyTZzScvKnWFM
Thore CimbalandClaude Opus 5
69c9ef13a1