Public access for Gitea now terminates on kryptovisor Traefik (not directly on drg-k8s ingress).
git.julianbechtold.chkryptovisor (:80/:443)http://192.168.1.9:30331 (ingress-nginx NodePort on drg-k8s)git.julianbechtold.chgitea-skan-allowlist):
212.243.124.0/24212.120.38.144/29162.120.188.220/32Kubernetes ingress gitea-skan remains as host routing for git.julianbechtold.ch, but the ingress whitelist annotation was removed to prevent double-blocking behind Traefik.
kryptovisor: /mnt/fastdata/docker/apps/traefik/config/docker/cert_conf.ymldrg-k8s: ingress gitea-skan annotation update (remove whitelist-source-range)CN=git.julianbechtold.chLet's Encrypt R13HTTP/2 403 with router gitea-skan-public@filedrg-k8s NodePort for Host: git.julianbechtold.ch returns HTTP/1.1 200 OK.80/443 to kryptovisor.drg-k8s should not be directly exposed on WAN for this endpoint.