Date: 2026-04-06 UTC
Added the missing external Traefik routes for BodyLog on kryptovisor.auth.home.lan (192.168.1.4), aligned the Kubernetes ingress hosts in the bodylog namespace, enabled dedicated API hostnames, and fixed TLS for api.bodylog.app.lan with a dedicated internal certificate.
BodyLog/Bodylog.dev was deployed successfully into Kubernetes and the in-cluster Ingress was healthy, but browsers still received 404 page not found because the shared edge proxy did not have a router for bodylog.app.lan.
A second routing gap existed for bodylog.dev:
92.107.16.67)bodylog.dev as an allowed hostA third change was needed to expose dedicated API hostnames and allow browser access from the frontend origins:
api.bodylog.app.lanapi.bodylog.devhttps://bodylog.app.lan and https://bodylog.devA fourth issue affected only api.bodylog.app.lan in browsers:
*.app.lan does not cover api.bodylog.app.lanUpdated Traefik dynamic file config on kryptovisor.auth.home.lan:
bodylog.app.lanbodylog.devapi.bodylog.app.lanapi.bodylog.devhttp://192.168.1.9:30331passHostHeader: truebodylog.dev and api.bodylog.devapi.bodylog.app.lanGenerated internal certificate material in Traefik cert storage:
/mnt/fastdata/docker/apps/traefik/data/traefik/certs/api.bodylog.app.lan.key/mnt/fastdata/docker/apps/traefik/data/traefik/certs/api.bodylog.app.lan.crt/mnt/fastdata/docker/apps/traefik/data/traefik/certs/api.bodylog.app.lan.withca.crtUpdated the BodyLog repository manifests:
19eb296 (k8s: add bodylog.dev ingress host)6162d14 (backend: add dedicated api hosts)469f157 (ci: allow manifest apply)bodylog.app.lan, api.bodylog.app.lan, bodylog.dev, api.bodylog.devApplied live cluster updates:
Role/bodylog-ci so CI can patch services, deployments, and ingressesbodyloggitea.app.lan/bodylog/bodylog.dev:sha-469f15765868Deployment/bodylog to sha-469f15765868https://bodylog.app.lan/ returns 200https://bodylog.app.lan/healthz returns okhttps://bodylog.dev/ returns 200 when resolved to the correct public edge IP (92.107.16.67)https://bodylog.dev/healthz returns ok when resolved to the correct public edge IPhttps://api.bodylog.app.lan/api/health returns okhttps://api.bodylog.dev/api/health returns ok when resolved to the correct public edge IPAccess-Control-Allow-Origin for the frontend origins92.107.16.67:443 presents Let's Encrypt certificates for bodylog.dev and api.bodylog.devapi.bodylog.app.lan:443 now presents CN = api.bodylog.app.lan, issued by Kryptovisor Local CAPublic resolvers (1.1.1.1, 8.8.8.8) already return 92.107.16.67 for bodylog.dev, but the local resolver on drg-k8s still returned a stale cached value (83.169.40.234) during validation.
Gitea Actions run 14 failed before it rolled out the new backend image. Run 15 also failed, even after the CI RBAC expansion, so the final backend image rollout was completed manually. The API routes and deployment are working, but the BodyLog workflow still needs a follow-up review before relying on it for manifest-changing pushes.
kryptovisor.auth.home.lan/mnt/fastdata/docker/apps/traefik/config/docker/cert_conf.ymltraefik-traefik-1BodyLog/Bodylog.devbodylog