network: allocate new ips on final segment

2026-09-11 19:51:15 +00:00 · 2026-08-20 22:31:57 +02:00
parent 950ced8477
commit 207aa84670
4 changed files with 44 additions and 44 deletions
@@ -27,4 +27,4 @@ spec:
            patch: |
              - op: add
                path: /spec/loadBalancerIP
-                value: "10.2.1.211"
+                value: "10.2.1.4"
@@ -19,9 +19,9 @@ pushShard: ""
 # with these credentials on every cert-manager renewal.
 recoveryAdmin:
    enabled: true
-    username: ENC[AES256_GCM,data:XUlqQoM=,iv:WFaWS6MjuQ+jTAj15NCpnFjr1B5XwJexwc4k9qU0n5g=,tag:mcO8w9Ud9j1HbHgoLIJBoA==,type:str]
+    username: ENC[AES256_GCM,data:ssWcS9c=,iv:K0cpea1wPDM9tEHcsP2N5rxDegzGWir+Nkh3Vnz7Ejg=,tag:mSoy5nCqTwQSj+tg8MZDFg==,type:str]
    password: ""
-    existingSecret: ENC[AES256_GCM,data:XPR9CS3tqLkbjyunmZjLE4pq/Z5ldRo=,iv:B0Dh9vktXOpYCOVVWS31fqw1+OtsaST8dzXbygd4HxA=,tag:F4d0JVfaut8NvJY/HXPurA==,type:str]
+    existingSecret: ENC[AES256_GCM,data:IMPTLHBqnk1/xkxykOi2Sxgfocdogn0=,iv:kJz4DMVb95w/2px0UjzhtReUK6tjZ3qILPKyqlNdpV4=,tag:dME8/hiUM+XVbwDovDSxeA==,type:str]
    usernameKey: username
    passwordKey: password
 # Recovery mode suspends mail services and exposes only the management listener.
@@ -40,7 +40,7 @@ bootstrap:
 # certificate.yaml (letsencrypt-production, Cloudflare DNS-01).
 mailTls:
    enabled: true
-    existingSecret: ENC[AES256_GCM,data:tKhTXL1MFZni+gTTbDMpbZugg7HJ6w==,iv:ye0/5M51TWI2m+YfnwJoQPBCBmb/iWiWZv+aDQGE4hM=,tag:EEbcAagl8UOMR0iW8UvIDA==,type:str]
+    existingSecret: ENC[AES256_GCM,data:RyFkt8p//R+qkc3UIG9v7BEXlrVlvA==,iv:S2dOLr8fKPyv5ke++zrajv0UFKJSTx1oa5jv7TZ/+hk=,tag:q1SHST/5aLa+4iNs2TSUVg==,type:str]
    certKey: tls.crt
    privateKeyKey: tls.key
    mountPath: /etc/stalwart/tls/ingress
@@ -77,7 +77,7 @@ mailService:
    enabled: true
    name: stalwart-mail
    type: LoadBalancer
-    loadBalancerIP: 10.2.1.212
+    loadBalancerIP: 10.2.1.5
    annotations: {}
 # WebUI ingress. TLS is terminated by Caddy at the edge (wildcard cert), so the
 # path is: public -> Caddy (TLS) -> Traefik (HTTP) -> this Ingress -> mgmt:8080.
@@ -120,27 +120,27 @@ podSecurityContext:
        type: RuntimeDefault
 containerSecurityContext: {}
 sops:
-    lastmodified: "2026-08-17T18:27:09Z"
-    mac: ENC[AES256_GCM,data:haYZBrQ0FMB6yc8FjeP2gRxr1FUmlnxFUdPU3itqATqBGopPCE2Nbpesx9wvlDCYn+GrtTiFTMXHuc6IhtRV5ujnEs6sjRgGgON18OIpJ6A6RiWU7u58zz4/JKBmR0EMIJ6dJGpt0aHL9Bogoola2O6TNZ85N720CTvOjoS2/HU=,iv:Gb5s52EB4gX2njF/aRxFwrzL3xmOaPmMW0zAmZgdyY8=,tag:+3oyVoQ+yL99/T+YFuHIIA==,type:str]
+    lastmodified: "2026-08-20T20:31:57Z"
+    mac: ENC[AES256_GCM,data:QjvWqFfWs1WiGwpjRG7yeyO4fMlfTk8WwUlTGhNAR/4MP2fyHV31VOgj0Dpamf3zHEOfVG4CQuADWQUbcwFbArdotn9sdsGrTheDWSikjM79AC2rhh/vCeREDyYR4nKm8aZISvGlwF6SQVoYO8VomVDJkNhK9ceWLaDyxrMJIxs=,iv:lQ+Zv4H7O8R8aOwPkru6iBYFR9ODpGwIdZdTQzQ8aJE=,tag:y1MRdyTltz6c9UWOQ3tWBQ==,type:str]
    pgp:
-        - created_at: "2026-08-17T18:27:09Z"
+        - created_at: "2026-08-20T20:31:57Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ/9GXV5Z9zMj5q6Zn/Ria1dU/1WrUKl48ruJhFLwUH0owt5
-            PezZ4Kz2PS9hdgfHJfXwPn1/dywxjrLibnLPNOf9hYxVzxJgtgobFdt4EDPC1Ki4
-            bj8Sw9EwWCE8ki0YCqXTDrkcWlgFhatZHLSE+MSEWaIB/i4dujQbRXI3g6CI5Shr
-            qLo6prhLS2zrZIfWVlwFfibXIjSnX+WGeor57D4ilBqP8qRAO++7dC3jKyYiwY4W
-            kyO+eb5I5VLfepSGyKGD1WljMEEjPi2LMmTlPfPJp2/gV+aWxO8eRJLjJ4PVyjs6
-            1iFmLFnxNiI3lOLrWU0wX11LhOvaUFCOafJ4kFyECquAYLjcjFCFqAYhrzj4yNPi
-            UXCg2nv5eyZ5ohDgTU6/q3FPPvKrY60VPV8H1H6u0zOKPjlzko/1UPM9bRBRkJHj
-            n6/MQEMpsVAijBD8L2JNewj1DxCmmekTqev4g1M/VymciTPLRRLt1tU2IEZ2cCOw
-            O9EA26LnKnCU8h/grkihp3ScCLeiY++y3neh8umkpsnqF2yBlWr9/s26ZW54hybo
-            OuoohRSwYTVb4Lu+g98czNp01riv8dAMdYEaPSRS68RqaBdpDnxGDEYcNiaXpHwn
-            7pYfnGV9oNQSN9Zo1EfolLc+XWzJbkBA8Sltma8eZtWKffpAAqt5BKz97k6JX8XS
-            UQEM021guipXzgmhgpYOdWrOM4KDgsLhzIlsu3gGRZjegjg/1UYfv63zh3kWTAPp
-            wS25gS1e619KJuTyvBv7hHUWC6HwEJ6JrkT+0bX7nNBq/w==
-            =kkTl
+            hQIMA7uy4qQr71wiAQ/9EUc3vJ3fVYZm4KQ2owVf9IKdpt2rPgaAgZMqwFqNXIi+
+            ZA4/iiFv0BctD6pgx/Dwe5cHa5Wq3z6NDcO9g/wlZMRBLPIuGXcOey4AwBBvYlgt
+            +A6VxeCHimczImogGHUkJRlM39hdZh32hs8olzkVLk/nYdh6sKeGLm2dphP+kPJg
+            hnfgGA0pc5lSsz2gMHZiOy85mOpoFbj3c4Ndr1mKvSz4PbRAwIXn5idsASCZO/Dv
+            xqzmftrmahaNwfHvmKdYHApyIbb0kxRuWKiwpXFUuwpOOJDlC4QH5XuZc3mslLeb
+            vxI+l2o0ojMImgwXCreCxqGkKQN4osa/AdoqMSafGNgSjhLdkiw+XhG+Wy5EEh0V
+            eOyaLsW/OCxKhGOWPgGd570BSgGZaf9JjB9tKBmlocu/D8vhaREblziNE3/PkfZV
+            YjnrxktJsbT1sEOblfPulUwmkDQOfG1QBC4zxrJPzYnUxd0Klf5bkLFoHLBEK+KE
+            +ZOLW9TDWnccPm1ZdiIpR2CepUILRus3lVNxQUk4NKhssg3YYFH1FJy5t9cDP9eJ
+            hXSE5kq1kTL4W4+o7B6oDAljWe9UGW7OU3M18o8CQJ5nFLdv+gm9Xtzo8I4FTY/J
+            ATz77c/tILUl/TXkXvJNwzxqD4EAlq5ci5MiVFpdO0Fg2roK4fAGE4gzZZsG8FDS
+            XAH+UpKRFmQ43TdB7//yy0Qdziv8xu/FC8nWnYaYYsm6xVkMsGujnyKQ2x/j6eMH
+            4+Hh8gQocaZm5UKzKf8XFgZhupWKSNjjPivdWeoF/pHyhlzSGG0/bHjpmCpz
+            =/TCV
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
@@ -20,7 +20,7 @@ service:
    dns-udp:
        enabled: true
        type: LoadBalancer
-        loadBalancerIP: 10.2.1.210
+        loadBalancerIP: 10.2.2.3
        # Cluster (not Local) so any node can forward to pods on any other node.
        # Required for Cilium L2 announcement failover
        externalTrafficPolicy: Cluster
@@ -69,27 +69,27 @@ resources:
 # Full list of options https://github.com/0xERR0R/blocky/blob/main/docs/config.yml
 config: "upstreams:\n    groups:\n        default:\n            - 1.1.1.1\n            - 1.0.0.1\n        lan:\n            - 10.101.207.1\n\nconditional:\n    mapping:\n        lan: 10.101.207.1\n        cluster.local: 10.96.0.10\n\nblocking:\n    allowlists:\n        ads:\n            - |\n                dealabs.digidip.net\n                s.click.aliexpress.com\n                fonts.googleapis.com\n                fonts.gstatic.com\n                wl.spotify.com\n                www.googleadservices.com\n    \n    denylists:\n        ads:\n            - https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts\n            - https://adaway.org/hosts.txt\n    \n    clientGroupsBlock:\n        default:\n            - ads\n    \n    blockType: zeroIp\n    blockTTL: 1m\n    loading:\n        refreshPeriod: 4h\n        downloads:\n            timeout: 60s\n\ncaching:\n    minTime: 5m\n    maxTime: 30m\n    # Disable negative caching (NXDOMAIN responses) for dynamic DNS\n    cacheTimeNegative: 0\n    prefetching: true\n    prefetchExpires: 2h\n    prefetchThreshold: 5\n\nprometheus:\n    enable: true\n    path: /metrics\n\nports:\n    dns: 53\n    http: 4000\n\nbootstrapDns: tcp+udp:1.1.1.1\n\nlog:\n    level: info\n    format: text\n    timestamp: true\n"
 sops:
-    lastmodified: "2026-08-17T18:27:09Z"
-    mac: ENC[AES256_GCM,data:IiJLNZlcsOrMpV3Sv9488k+Vmcin0AKV2L6wbTQDHyMmtJK5a8nt4ZTjmrbpD3xlgSNLSPt1EWAGetl0Z8MiLNkpOkv1AQQJdV3SZy+31nzqBXWn8kPP0p9AS7fcRNKR2sDPUNuXdh7GuKm/+j01y7Wetc8aC2MVdMS3fxf719U=,iv:qmigYfzVeraHiAkMGg7T29WhUDDfEur6yphAXsz0JqE=,tag:v7dbMfHVIA+pk0q4jGA9Cg==,type:str]
+    lastmodified: "2026-08-20T20:31:57Z"
+    mac: ENC[AES256_GCM,data:RsGI3l+9aiCChJLDS3HLY5V5AvHVBMPo9HZg37gNmAql2r237fBYT1D6W1i21VZtno/ylckkNPB2wcxJfHG6uh/R4SFbFcZsjCda8wgeqGDPvaTR29n0xUs/XBHxEHbOF223xLhS8x6iShX56EVJ6QPcKG47azk+/1v0TYyLs9E=,iv:RBkV4gYoecejjmVyvIX3f34ol9WFtpIiPRezVv7NfIo=,tag:nCZKJpl/T3jaFuUmhp0fzQ==,type:str]
    pgp:
-        - created_at: "2026-08-17T18:27:09Z"
+        - created_at: "2026-08-20T20:31:57Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ//VZ3zkweb4y8UwdjKJVFYT6DSfacL32lzfF+inY6B8IJ3
-            ogi5afk8MzPK1PoUTVfpeAzwm+3q5vS4D+XQn5XTVS3+RTaVjryHHuX3Bbwe1ZKa
-            Ovi03BwxjKH8qyCmqKpBqqVkbqIoNRk7i1JMbOFRTjc+5fw5EmQSEjIy4SR96Qx6
-            Df0Ul3ahdbd761EMvTOeZb2JvQBLMY+rHOEg6pkL4Tlpdd6pmMUTwGRUzUZ6QLXA
-            RQ/qO2gecBbAJb7wjSnJrS8WQXXVuj9YK5+6HZNzWoFhyUpTMfyzT4CiONaMuwPv
-            OYCHXJ+o1317zuna91ch1y8A2/+p84HvlhWCPBlzF7YzTYU/eUaH+JvG/SA+irw8
-            QuNKZYOaNYEQq7vVaheeanD2/w09l6wpA5piXSa7QdoESeYkRfZRVigh93jeRoG8
-            XdjIuQD06TV4JHIW/+MMOUuxzp/TzChrYqEO5BJ6gttZXnUjN7IZVA73i+/PhPz9
-            RIRx/CYECTFEce64Haw+utCQRAvKielnyWf07ka1ERvvptdYOQWrIb6jIB60VCIf
-            YfIy4GiPF8T5aPuSpFjNjDGiJWDusq8Jd3fL9qWPQeKZBUufxVhlFFJSeCOYolE0
-            AJajQP5PIipUiHbuRQIZ6MbFbauB0Vy+SBAOe0UkqVUZ40y/D/muTpWK4w2UZhvS
-            XAGmFHhh7f6qm/223unREbK9oBxyoTAEAa4HR4dn8mUnl3WGEMOwkySAbUPZKcyK
-            Pi8s+SHzvQ5Lbzv+NbgM90ljuUE9ekcsUsqsUT9cmDs4XiH3IGd8feSoyM8I
-            =j9Pp
+            hQIMA7uy4qQr71wiARAAkJkQQV3jR/0IYHZ0jgyvcLPV9EJQN85j5aNprps+uhRb
+            BDXf7tYR3jZiPDEBvg0pL2eYlP/Bh9a1fpTZ7NcCJWizI15PJXsIKzaJ2mDn776M
+            KaMAj0hy3kOKrmfH/Ajof9gjupJblvyQY6nqd1AlQapfdqVR4r5W6fq0iX1wuq4n
+            RLzTQ4zQaYfH76dRYQFrxCwleh5C2A16Z6drQukNTKjH79IDjVLJQT+7toLH3ws3
+            lgRUJnXCkpYY2vr8lbtmjfHI6i0g9bJFMkGlZRZ58BYhHJYcjO4JGwvZGCzgrzi8
+            U9Q7gIVS4Ccdog4H5pflgOUZB36Kc5pCAxE6puttEcvXV4KJnQCB2TrBpVZxswdG
+            /aoPKU+IYFUcxXeKKBTXtdoVWQlppqNR7aobbDhPU576SUnozV1wag4LcbZcWIt9
+            DLoJwX8A2bSBjNxC+XSYgK8p6r9SKeq8JucBD9dbwDK+4e1iHYhRNQNIXtEPuRFm
+            rAE0poTNdMeMirut4WSKy38cnb2V5lZqK9QdLk3dcs4wPxdohfUYVWmnSBzuAM/B
+            qePVPzfKod9Szp7uTAWWXVdbIXKt58Qn52GAkYQofjPamcumGksnQJ819v5TYo/Z
+            CtUMGtfi44SRPLR0vPoGgLTiYnu6jt8BUxqaRrzbv959XW8LCfm/NzY1MABuZaHS
+            XAGa3Zsq2bZHP2BpQuyCoL9QKYLTOtPxgxzcF3xyLuku/Qd7oo3/5NXY6ET3w4R4
+            aPrOhRlhOLQ00HVESc9FYjy41GT+pE/s+aa2ZXzsG3fDQb4+OTtl+b9kG9L1
+            =2k/e
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
@@ -4,7 +4,7 @@ metadata:
  name: "local-pool"
 spec:
  blocks:
-  - cidr: "10.2.1.210/32"
-  - cidr: "10.2.1.211/32"
-  - cidr: "10.2.1.212/32"
-  - cidr: "10.2.1.213/32"
+  - cidr: "10.2.2.3/32"
+  - cidr: "10.2.2.4/32"
+  - cidr: "10.2.2.5/32"
+  - cidr: "10.2.2.6/32"